samagotchi 0.156.0 → 0.157.0

data/lib/samagotchi/memory_bundle/merger.rb

@@ -4,6 +4,7 @@ require "digest"
 require_relative "../atomic_file"
 require_relative "file_digest"
 require_relative "installed_bundle"
+require_relative "file_actions"
 
 module Samagotchi
   module MemoryBundle
@@ -13,8 +14,8 @@ module Samagotchi
 
     # 3-way merge helper for bundle upgrades.
     #
-    # Compare base (provenance snapshot), current (on-disk), incoming (new bundle)
-    # and classify per file. Used by Installer#run when provenance exists.
+    # An upgrade's merge: what FileState and FileActions' UPGRADE table say of
+    # a file, as an Outcome, and the text merge where both sides changed it.
     module Merger
       # What an upgrade does to one file. status names the case; base is where
       # the file's next base comes from:
@@ -26,15 +27,13 @@ module Samagotchi
       #              edits, so it must never become the base (the edit is what
       #              differs from the base, and the next upgrade would
       #              fast-forward over it).
-      # Installer#next_base reads it. A new outcome and its base go here; it
-      # also needs a branch in Installer#merge_memory (which raises without
-      # one), #next_base if its base is a new kind, and its status word in
-      # Installer#preview_memory, #verify_memory_checksums' list and #summary.
+      # The same words as FileActions::Action#next_base: an Outcome is what an
+      # UPGRADE cell stands for to a plan, and a :decide cell's answer.
       #
       # merge is Upgrade#outcome's TextMerge::Result, so a merge runs git once
       # and its answer travels with the outcome: a :merged outcome's text, a
       # :conflict's why (nil for a real one). current_sha is the digest of the
-      # file that merge read: write_merged checks it. .classify leaves both nil.
+      # file that merge read: write_merged checks it. The constants leave both nil.
       Outcome = Data.define(:status, :base, :merge, :current_sha) do
         def initialize(status:, base:, merge: nil, current_sha: nil) = super
 
@@ -65,39 +64,38 @@ module Samagotchi
         def conflicts = behind.map(&:file)
       end
 
+      # One file's upgrade, read once (Upgrade#decision): its FileState, the
+      # action the upgrade takes (a :decide cell already answered) and the
+      # Outcome that action stands for.
+      Decision = Data.define(:state, :action, :outcome)
+
       # One bundle's upgrade as seen before it runs: what it does to a file,
       # nothing written. The one way to ask: Installer's merge and dry run,
       # ShippedUpdate's plan and SystemBundle's dry run. Which files to ask
       # about is the caller's, and they differ (see #forecast).
       Upgrade = Data.define(:provenance, :target_dir, :source_dir) do
-        # What the upgrade does to the file: .classify, then, where both sides
-        # changed it, the text merge (git runs here, once per call). A mark from
-        # an older chi fast-forwards only if no line of the file goes or its base
-        # is proved: see .merge_outcome.
-        # @return [Outcome]
-        def outcome(file_key)
-          classified = classified(file_key)
-          return classified unless classified.conflict? || classified == FAST_FORWARD
-
-          legacy = InstalledBundle.legacy_mark?(provenance.record&.files&.fetch(file_key, nil))
-          # Asked only when the guard would otherwise fire.
-          unproved = -> { legacy && !ShippedHistory.shipped?(provenance.name, file_key, paths(file_key)[:base]) }
-          return Merger.merge_outcome(paths(file_key), unproved: unproved) if classified.conflict?
-
-          # The guard's own case at its plainest: the file is the base, which
-          # may be the user's text. One that only gains lines loses nothing, and
-          # save_marked_file keeps a copy.
-          sides = paths(file_key)
-          return classified unless legacy && Merger.removes_lines?(File.binread(sides[:current]), File.binread(sides[:incoming]))
-
-          unproved.call ? CONFLICT.with(merge: TextMerge.failed(FileStanding::LEGACY_BASE)) : classified
+        # What the upgrade does to the file, with what it was read from: its
+        # FileState, the UPGRADE action (a :decide cell answered by #outcome's
+        # merge or legacy guard, through FileActions.decided) and the Outcome.
+        # @param state [FileState] the file's, when the caller has read it
+        # @return [Decision]
+        def decision(file_key, state = state(file_key))
+          action = FileActions.for(:upgrade, state)
+          outcome = outcome_of(file_key, state, action)
+          Decision.new(state: state, action: action.do == :decide ? FileActions.decided(outcome) : action, outcome: outcome)
         end
 
-        # .classify alone: no merge is tried.
+        # What the upgrade does to the file: its FileState's UPGRADE cell, and
+        # where both sides changed it, the text merge (git runs here, once per
+        # call). A mark from an older chi fast-forwards only if no line of the
+        # file goes or its base is proved: see .merge_outcome.
         # @return [Outcome]
-        def classified(file_key)
-          sides = paths(file_key)
-          Merger.classify(base_path: sides[:base], current_path: sides[:current], incoming_path: sides[:incoming])
+        def outcome(file_key) = decision(file_key).outcome
+
+        # The file as the upgrade meets it (FileState, with the source).
+        # @return [FileState]
+        def state(file_key)
+          FileState.of(file_key, record: provenance.record, provenance: provenance, target_dir: target_dir, source_dir: source_dir)
         end
 
         # The ones among +file_keys+ that would merge or end in a conflict. The
@@ -138,38 +136,50 @@ module Samagotchi
           { base: provenance.base_path(file_key), current: File.join(target_dir, file_key),
             incoming: File.join(source_dir, file_key) }
         end
-      end
 
-      # Classify a single file for upgrade.
-      # @return [Outcome]
-      def self.classify(base_path:, current_path:, incoming_path:)
-        base_exists = base_path && File.exist?(base_path)
-        current_exists = File.exist?(current_path)
-        incoming_exists = File.exist?(incoming_path)
-
-        return NO_INCOMING unless incoming_exists
-
-        unless current_exists
-          return INSTALL
+        private
+
+        # The Outcome a cell stands for; a :decide cell's is the text merge
+        # (:diverged) or the legacy guard ([:pristine, :legacy]).
+        def outcome_of(file_key, state, action)
+          return NO_INCOMING if state.digests.incoming.nil?
+
+          case action.do
+          when :decide then decide(file_key, state)
+          when :write_incoming then action.word == :installed ? INSTALL : FAST_FORWARD
+          when :keep
+            return no_base(state) if action.behind?
+
+            action.word == :kept ? KEEP : NOOP
+          # A file the bundle doesn't own, the user's: there is no base to merge from.
+          when :skip then no_base(state)
+          # It can't be read: the read raises, as the merge would.
+          when :refuse then FileDigest.hex(paths(file_key)[:current])
+          else raise ArgumentError, "no outcome for #{action.do.inspect} (#{file_key})"
+          end
         end
 
-        # No base (legacy bundle without provenance or first file) -> treat as modified
-        unless base_exists
-          return FileDigest.hex(current_path) == FileDigest.hex(incoming_path) ? NOOP : CONFLICT
+        # No base to merge from: the file stays behind. With none on disk
+        # TextMerge::NO_BASE says why; one the checksum contradicts (the file
+        # equals it, yet is edited) may be the user's own text, as an older
+        # chi's can (FileStanding::LEGACY_BASE).
+        def no_base(state)
+          why = state.digests.base.nil? ? TextMerge::NO_BASE : FileStanding::LEGACY_BASE
+          CONFLICT.with(merge: TextMerge.failed(why))
         end
 
-        base_digest = FileDigest.hex(base_path)
-        current_digest = FileDigest.hex(current_path)
-        incoming_digest = FileDigest.hex(incoming_path)
-
-        if current_digest == incoming_digest
-          NOOP
-        elsif current_digest == base_digest
-          FAST_FORWARD
-        elsif incoming_digest == base_digest
-          KEEP
-        else
-          CONFLICT
+        def decide(file_key, state)
+          # Asked only when the guard would otherwise fire.
+          unproved = -> { state.mark == :legacy && !ShippedHistory.shipped?(provenance.name, file_key, paths(file_key)[:base]) }
+          return Merger.merge_outcome(paths(file_key), unproved: unproved) unless state.kind == :pristine
+
+          # The guard's own case at its plainest: the file is the base, which
+          # may be the user's text. One that only gains lines loses nothing, and
+          # its save_first keeps a copy (Installer#save_first).
+          sides = paths(file_key)
+          return FAST_FORWARD unless Merger.removes_lines?(File.binread(sides[:current]), File.binread(sides[:incoming]))
+
+          unproved.call ? CONFLICT.with(merge: TextMerge.failed(FileStanding::LEGACY_BASE)) : FAST_FORWARD
         end
       end
 
@@ -243,12 +253,6 @@ module Samagotchi
       def self.digest(path)
         FileDigest.hex(path)
       end
-
-      def self.current_modified?(base_path, current_path)
-        return true unless base_path && File.exist?(base_path) && File.exist?(current_path)
-
-        FileDigest.hex(base_path) != FileDigest.hex(current_path)
-      end
     end
   end
 end

data/lib/samagotchi/memory_bundle/plugin_ref.rb

@@ -3,11 +3,12 @@
 module Samagotchi
   module MemoryBundle
     # The plugin an installed bundle's record (manifest.json) names: its
-    # file under plugin/ and the sha256 recorded at install ("" when none
+    # file under plugin/, the sha256 recorded at install ("" when none
     # is; either "sha256:<hex>" or a bare hex, Provenance.recorded_sha
-    # reads both).
-    PluginRef = Data.define(:file, :sha256) do
-      def initialize(file:, sha256: "")
+    # reads both), and whether its manifest called it required (a guardrail
+    # plugin: plugin: required: true; an older chi ignores the key).
+    PluginRef = Data.define(:file, :sha256, :required) do
+      def initialize(file:, sha256: "", required: false)
         super
       end
 
@@ -20,7 +21,7 @@ module Samagotchi
 
         h = raw.transform_keys(&:to_s)
         file = h["file"].to_s
-        file.empty? ? nil : new(file: file, sha256: h["sha256"].to_s)
+        file.empty? ? nil : new(file: file, sha256: h["sha256"].to_s, required: h["required"] == true)
       end
     end
   end

data/lib/samagotchi/memory_bundle/profile.rb

@@ -27,7 +27,7 @@ module Samagotchi
       # installed: members installed now; already: members found installed
       # (recorded, not reinstalled); skipped and failed: name => why;
       # kept_own: member installed now => its memory files the user already
-      # had, left as they are and not owned (Installer#skip_existing);
+      # had, left as they are and not owned (the INSTALL rows of a file not owned);
       # trash_copies: "member: line" for what --force copied to the trash
       # (Installer#trash_copy_line).
       InstallResult = Struct.new(:name, :version, :installed, :already, :skipped, :failed, :kept_own, :trash_copies, keyword_init: true) do
@@ -140,11 +140,11 @@ module Samagotchi
       private_class_method :install_member
 
       # An Installer result for a file the user already had, with other
-      # bytes: skipped ("already exists"), or a dry run's would_skip. One
-      # with the bundle's bytes ("already up to date") isn't named: nothing
-      # of the bundle's is missing (it stays the user's all the same).
+      # bytes: kept as the user's own (:kept_own), or a dry run's
+      # :would_skip. One with the bundle's bytes (:up_to_date) isn't named:
+      # nothing of the bundle's is missing (it stays the user's all the same).
       def kept_own?(entry)
-        entry[:status] == "would_skip" || (entry[:status] == "skipped" && entry[:reason] == "already exists")
+        %i[would_skip kept_own].include?(entry.word)
       end
       private_class_method :kept_own?
 

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -159,6 +159,16 @@ module Samagotchi
         unchecked?(recorded) || file_sha(path) == recorded_sha(recorded)
       end
 
+      # Whether a memory on disk is what the install wrote: the entry's
+      # recorded checksum, else its base copy. Unknown counts as edited. The
+      # one rule a prune, an uninstall's refusal and chi bundle status read.
+      def self.unchanged?(path, entry, base_path)
+        recorded = entry[:checksum]
+        return sha_matches?(path, recorded) unless recorded_sha(recorded).empty?
+
+        File.exist?(base_path) && file_sha(path) == file_sha(base_path)
+      end
+
       # The record's mirror of the manifest keys (InstalledBundle::MIRROR_KEYS)
       # as #write records them from its kwargs: what an older chi reads, and
       # what #adopt_manifest holds a source's manifest against.
@@ -191,6 +201,9 @@ module Samagotchi
       # @param plugin_file [String, nil] the installed plugin file; its name
       #   and sha256 are recorded (the Engine checks it at load) with a base
       #   snapshot
+      # @param plugin_required [Boolean] the manifest's plugin: required: true
+      #   (a guardrail plugin), recorded with it as "required": true, so the
+      #   Engine knows it whatever becomes of the kept manifest.yml
       # @param requires_chi [String, nil] the manifest's requirement
       # @param needs [Array<Hash>] the manifest's needs ({command:, why:, hint:})
       # @param marks [Array<FileStanding::Behind>] files an upgrade left behind;
@@ -217,7 +230,7 @@ module Samagotchi
       #   an older chi sharing this memories dir reads only them
       #   (docs/internals/bundles.md); a key a later manifest gains is never added
       def write(files:, scope:, version:, source_path:, hooks: {}, trust_level: nil, source_commit: nil, hooks_files: {},
-                guardrails_files: {}, plugin_file: nil, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
+                guardrails_files: {}, plugin_file: nil, plugin_required: false, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
                 scripts_files: {}, context_providers: [], block_renderers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
                 dev: false, manifest_from: nil)
         FileUtils.mkdir_p(@bundle_dir)
@@ -318,6 +331,7 @@ module Samagotchi
           content = File.binread(plugin_file.to_s) # the base snapshot's bytes
           manifest_data["plugin"] = { "file" => File.basename(plugin_file.to_s),
                                       "sha256" => dev ? DEV_SHA : FileDigest.sha256(plugin_file.to_s) }
+          manifest_data["plugin"]["required"] = true if plugin_required
           FileUtils.mkdir_p(File.join(bases_dir, "plugin"))
           File.binwrite(plugin_base_path(File.basename(plugin_file.to_s)), content)
         end

data/lib/samagotchi/memory_bundle/remerge.rb

@@ -3,6 +3,7 @@
 require_relative "index_updater"
 require_relative "manifest"
 require_relative "memory_files"
+require_relative "file_actions"
 require_relative "merger"
 require_relative "provenance"
 require_relative "trash"
@@ -17,7 +18,8 @@ module Samagotchi
     # scripts, and GuardrailWiring#rules stats per tool call, so a live session
     # could hit a transient deny.
     #
-    # Each marked file, by what Merger::Upgrade says of it:
+    # Each marked file, by its FileState and REMERGE row (FileActions; a
+    # :decide cell by what Merger::Upgrade says of it):
     #   - not shipped now: its mark, base and text stay, and it reads as behind
     #     unless level or missing, as every report has it;
     #   - the shipped text isn't the one the mark names (a checkout at the same
@@ -32,7 +34,7 @@ module Samagotchi
     #     to miss, so the mark goes;
     #   - conflict: behind, and the mark records why, only when that changed;
     #   - fast_forward (one Merger::Upgrade#outcome lets go ahead): the next
-    #     upgrade's (save_marked_file), behind until then;
+    #     upgrade's (its save_first), behind until then;
     #   - install: a missing file, which isn't behind (FileStanding.behind?): the
     #     next upgrade or a restore puts it back, and a warning says so;
     #   - one it can't read or replace: left as it is, behind, saying why.
@@ -90,24 +92,35 @@ module Samagotchi
           return
         end
 
-        incoming_sha = Merger.digest(view.paths(key)[:incoming])
-        if entry[:incoming_sha] && entry[:incoming_sha] != incoming_sha
+        state = view.state(key)
+        if state.source_moved?
           @behind << @record.behind_entry(key, entry) if behind
           return
         end
 
-        outcome = view.outcome(key)
-        case outcome.status
-        when :merged then merge_file(key, entry, outcome)
-        when :conflict then mark(key, entry, view.behind(key, outcome, @record.version))
-        when :noop, :keep then @settled << key
-        when :fast_forward then mark(key, entry, behind_for(key, FileStanding::WAITS_FOR_UPGRADE))
-        when :install then @warnings << "#{key}: #{FileStanding::FILE_MISSING}"
-        end
+        retry_row(key, entry, state, FileActions.for(:remerge, state))
       rescue SystemCallError => e
         stay(key, FileStanding.left_as_it_is(e.message))
       end
 
+      # The file's REMERGE row, done. A :decide cell, and a behind one, asks
+      # Merger::Upgrade#decision for the Outcome (the text merge, the legacy
+      # guard, or why no merge is possible); a fast-forward waits for the
+      # upgrade. A missing file is put back by the next upgrade or a restore;
+      # one it can't read raises here (left as it is, saying why).
+      def retry_row(key, entry, state, action)
+        decision = view.decision(key, state) if action.do == :decide || action.behind?
+        action = FileActions.decided(decision.outcome, :remerge) if action.do == :decide
+        if action.do == :merge then merge_file(key, entry, decision.outcome)
+        elsif action.behind?
+          waits = decision.outcome.status == :fast_forward
+          mark(key, entry, waits ? behind_for(key, FileStanding::WAITS_FOR_UPGRADE) : view.behind(key, decision.outcome, @record.version))
+        elsif action.word == :settled then @settled << key
+        elsif state.kind == :missing then @warnings << "#{key}: #{FileStanding::FILE_MISSING}"
+        elsif state.kind == :unreadable then FileDigest.hex(state.paths[:current])
+        end
+      end
+
       def behind_for(key, why) = FileStanding::Behind.new(file: key, version: @record.version, why: why)
 
       # The record says it too, so chi bundle status reads as the row does. There

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "asset_installer"
 require_relative "installer"
 require_relative "listing"
 require_relative "manifest"
@@ -11,6 +12,7 @@ require_relative "remerge"
 require_relative "source"
 require_relative "status"
 require_relative "system_bundle"
+require_relative "trash"
 require_relative "../memory_paths"
 require_relative "../version"
 
@@ -25,9 +27,11 @@ module Samagotchi
     # bundle that isn't installed and never downgrades.
     #
     # .md files take the Installer's 3-way merge: a clean text merge replaces
-    # the file (merged), a real conflict keeps the user's (behind). Hooks, rules and the plugin are replaced; an
-    # edited one (which didn't load: its sha no longer matched) is listed
-    # in replaced.
+    # the file (merged), a real conflict keeps the user's (behind). Hooks, rules,
+    # the plugin and scripts are replaced; an edited one (Trash.edit?: its
+    # bytes neither the recorded sha, none recorded counting as edited, nor
+    # the incoming file's) is copied to the trash first and listed in
+    # replaced (#trash_bound).
     #
     # A profile (a shipped meta bundle) is updated through Profile: its row
     # is :would_update when the shipped version is newer or it has members
@@ -41,8 +45,9 @@ module Samagotchi
     # a project-scope bundle: chi bundle upgrade in the project.
     module ShippedUpdate
       # status: :would_update, :would_merge (plan), :updated, :merged,
-      # :up_to_date, :skipped, :failed. note says why for skipped/failed, and
-      # what a retry at the same version warned of. merged and replaced are file
+      # :up_to_date, :skipped, :failed. note says why for skipped/failed,
+      # what a retry at the same version warned of, and an update's Checksum
+      # mismatch warnings. merged and replaced are file
       # names, behind FileStanding::Behind; under plan they are what apply would
       # merge, replace or leave behind.
       # adds is nil but for a profile: the members it installs.
@@ -114,6 +119,10 @@ module Samagotchi
           r.merged = installer.merged_files
           r.behind = installer.behind
           r.trash_copy = installer.trash_copy_line
+          # The integrity check's warnings; the rest of the Installer's say
+          # what the row's merged and behind already do.
+          mismatches = installer.warnings.grep(/\AChecksum mismatch/)
+          r.note = mismatches.join("; ") unless mismatches.empty?
         end
       rescue StandardError => e
         row.dup.tap do |r|
@@ -199,7 +208,7 @@ module Samagotchi
         forecast = forecast(row, bundle)
         row.merged = forecast.merged
         row.behind = forecast.behind
-        row.replaced = edited_executables(name, bundle)
+        row.replaced = trash_bound(name, bundle, manifest, row.source_dir)
         row.status = :would_update
         row
       rescue SystemCallError => e
@@ -267,6 +276,42 @@ module Samagotchi
                             source_dir: row.source_dir).forecast(shipped & bundle.files.keys, version: row.to)
       end
 
+      # What the upgrade from +source_dir+ copies to the trash, as
+      # hooks/F, guardrails/F, plugin/F, scripts/F: Trash.edit? over the files
+      # AssetInstaller replaces or removes, each against the file it puts in
+      # its place. Hooks: the ones install_hooks copies (listed, else every
+      # hooks/*.rb; present, not links) and the ones prune_dropped_hooks
+      # removes (recorded, no longer shipped; no incoming). Rules, the plugin
+      # and scripts: their whole folder, which the upgrade replaces.
+      def trash_bound(name, bundle, manifest, source_dir)
+        provenance = Provenance.new(name: name)
+        rules = Dir.glob(File.join(source_dir, "guardrails", "*.yml")).sort
+                   .reject { |file| AssetInstaller.linked?(file, source_dir) }
+        plugin = manifest.plugin ? { manifest.plugin[:file] => File.join(source_dir, manifest.plugin[:file]) } : {}
+        scripts = manifest.scripts.keys.to_h { |file| [file, File.join(source_dir, "scripts", file)] }
+        trash_bound_hooks(provenance, bundle, manifest, source_dir) +
+          Trash.edits(provenance.guardrails_dir, "guardrails", bundle.guardrails, rules.to_h { |file| [File.basename(file), file] }) +
+          Trash.edits(provenance.plugin_dir, "plugin", bundle.plugin_shas, plugin) +
+          Trash.edits(provenance.scripts_dir, "scripts", bundle.scripts, scripts)
+      end
+
+      # #trash_bound's hooks: AssetInstaller#install_hooks' set (incoming: the
+      # source's file), then #prune_dropped_hooks' (incoming: none). A stray
+      # file in hooks/ is in neither: the upgrade leaves it.
+      def trash_bound_hooks(provenance, bundle, manifest, source_dir)
+        src = ->(file) { File.join(source_dir, "hooks", file) }
+        listed = manifest.hooks.keys.select { |file| file.is_a?(String) && !file.empty? }
+        listed = Dir.glob(src.call("*.rb")).map { |file| File.basename(file) } if manifest.hooks.empty?
+        shipped = listed.reject do |file|
+          (File.symlink?(src.call(file)) || File.exist?(src.call(file))) && AssetInstaller.linked?(src.call(file), source_dir)
+        end
+        incoming = shipped.select { |file| File.exist?(src.call(file)) }.to_h { |file| [file, src.call(file)] }
+        incoming.merge!((bundle.hooks.keys - shipped).to_h { |file| [file, nil] })
+        incoming.filter_map do |file, from|
+          "hooks/#{file}" if Trash.edit?(File.join(provenance.hooks_dir, file), recorded: bundle.hooks[file]&.sha256, incoming: from)
+        end
+      end
+
       # Installed hooks, rules and the plugin whose sha differs from the
       # recorded one (they didn't load), as hooks/F, guardrails/F, plugin/F.
       def edited_executables(name, bundle)

data/lib/samagotchi/memory_bundle/status.rb

@@ -2,6 +2,7 @@
 
 require_relative "file_digest"
 require_relative "provenance"
+require_relative "file_state"
 require_relative "manifest"
 require_relative "../version"
 require_relative "index_updater"
@@ -41,16 +42,12 @@ module Samagotchi
         files.each do |file_key_str, meta|
           next details[file_key_str] = unchecked_file(meta) unless target_dir
 
-          target_path = File.join(target_dir, file_key_str)
-          base_path = provenance.base_path(file_key_str)
-          stored_checksum = meta[:checksum]
-          current_checksum = checksum(target_path)
-          unreadable = current_checksum == :unreadable
-          current_checksum = nil if unreadable
-          base_checksum = checksum(base_path)
-          base_checksum = nil if base_checksum == :unreadable
-          modified = base_checksum && current_checksum && base_checksum != current_checksum
-          missing = !File.exist?(target_path)
+          state = FileState.of(file_key_str, record: bundle, provenance: provenance, target_dir: target_dir, source_dir: nil)
+          target_path = state.paths[:current]
+          base_path = state.paths[:base]
+          unreadable = state.kind == :unreadable
+          missing = state.kind == :missing
+          modified = %i[edited edited_no_base].include?(state.kind)
           # A model overlay has no index line (Installer#note_overlay).
           overlay = ModelOverlay.bundle_overlay?(file_key_str, bundle_files: files.keys, target_dir: target_dir)
           index_present = overlay ? nil : index_has_entry?(scope, file_key_str)
@@ -59,9 +56,9 @@ module Samagotchi
             behind: behind[file_key_str],
             merge_note: notes[file_key_str],
             unreadable: unreadable,
-            stored_checksum: stored_checksum,
-            current_checksum: current_checksum,
-            base_checksum: base_checksum,
+            stored_checksum: meta[:checksum],
+            current_checksum: digest_or_nil(state.digests.disk),
+            base_checksum: digest_or_nil(state.digests.base),
             modified: modified,
             missing: missing,
             index_present: index_present,
@@ -75,13 +72,10 @@ module Samagotchi
                    hooks_requires_failure: hooks_requires_failure(bundle), needs: needs_status(bundle))
       end
 
-      # The file's digest, nil when there is none, :unreadable when it can't be read.
-      def self.checksum(path)
-        FileDigest.hex(path)
-      rescue SystemCallError
-        :unreadable
-      end
-      private_class_method :checksum
+      # A FileState digest as the Report has it: nil for none, or one that
+      # can't be read (unreadable says which).
+      def self.digest_or_nil(digest) = digest == :unreadable ? nil : digest
+      private_class_method :digest_or_nil
 
       # Why none of the bundle's hooks load (this chi doesn't meet its
       # requires_chi, Hooks::BundleLoader), or nil: it has no hooks or meets it.

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require_relative "installer"
+require_relative "file_digest"
 require_relative "provenance"
 require_relative "manifest"
 require_relative "index_updater"
@@ -204,29 +205,46 @@ module Samagotchi
       # A file from the bundle missing on disk (the user deleted it) is put
       # back, and nothing else: at the same version a checkout can carry other
       # text, so no other file is merged here (Remerge has its guard), and a live
-      # session's guardrails, plugin and scripts stay where they are.
+      # session's guardrails, plugin and scripts stay where they are. Which
+      # missing file is put back is its RESTORE row (FileActions): one the
+      # record doesn't own too. A put-back file is checked against the
+      # manifest's files: sha, as an installed one is (a bad copy warns).
       def verify_files_present(gem_manifest, version, dry_run)
         target_dir = MemoryPaths.system_dir
         missing = MemoryFiles.select(GEM_BUNDLE_DIR, gem_manifest).reject { |key| File.exist?(File.join(target_dir, key)) }
+        missing = restored_rows(missing, target_dir) unless missing.empty?
         return result(:up_to_date, from: version, to: version) if missing.empty?
         return result(:restored, from: version, to: version) if dry_run
 
-        warnings = missing.filter_map { |key| restore_file(key, gem_manifest.file_descriptions[key]) }
+        warnings = missing.flat_map { |key| restore_file(key, gem_manifest) }
         result(:restored, from: version, to: version, warnings: warnings)
       end
 
-      # @return [String, nil] a warning: the file is in place, its index line isn't
-      def restore_file(key, description)
+      # The ones among +keys+ whose FileState's RESTORE row restores.
+      def restored_rows(keys, target_dir)
+        provenance = Provenance.new(name: BUNDLE_NAME)
+        record = provenance.record
+        keys.select do |key|
+          state = FileState.of(key, record: record, provenance: provenance, target_dir: target_dir, source_dir: GEM_BUNDLE_DIR)
+          FileActions.for(:restore, state)&.do == :restore
+        end
+      end
+
+      # @return [Array<String>] warnings: its bytes don't match the manifest's
+      #   sha, or the file is in place and its index line isn't
+      def restore_file(key, gem_manifest)
         source = File.join(GEM_BUNDLE_DIR, key)
         target = File.join(MemoryPaths.system_dir, key)
+        description = gem_manifest.file_descriptions[key]
         FileUtils.cp(source, target)
         Provenance.new(name: BUNDLE_NAME).record_restored(key, source, description: description)
+        warnings = [FileDigest.mismatch(key, target, gem_manifest.checksum_for(key))].compact
         begin
           IndexUpdater.update_index(SCOPE, key.delete_suffix(".md"), File.size(target), description, source: BUNDLE_NAME)
-          nil
         rescue StandardError => e
-          "index.md: line for #{key.delete_suffix(".md")} not updated (#{e.message})"
+          warnings << "index.md: line for #{key.delete_suffix(".md")} not updated (#{e.message})"
         end
+        warnings
       end
 
       # An up-to-date bundle's marked files, retried. No marks: nothing is read.

data/lib/samagotchi/memory_bundle/trash.rb

@@ -105,11 +105,7 @@ module Samagotchi
       # +incoming+'s. A link (a dev install's) points at its source, which
       # nothing here touches.
       def copy_edit(path, as:, recorded: nil, incoming: nil)
-        return if File.symlink?(path) || !File.file?(path)
-        return if incoming && File.file?(incoming) && FileUtils.identical?(incoming, path)
-        return if !Provenance.recorded_sha(recorded).empty? && Provenance.sha_matches?(path, recorded)
-
-        copy(path, as: as)
+        copy(path, as: as) if self.class.edit?(path, recorded: recorded, incoming: incoming)
       end
 
       # copy_edit for every file under +dir+, which is about to go, at any depth
@@ -117,10 +113,29 @@ module Samagotchi
       # @param recorded [Hash, nil] path in dir => its recorded sha256
       # @param incoming [Hash] path in dir => the source replacing it
       def copy_edits(dir, label, recorded = nil, incoming = {})
-        return if File.symlink?(dir) || !File.directory?(dir)
+        self.class.edited_in(dir, recorded, incoming).each { |file| copy(File.join(dir, file), as: "#{label}/#{file}") }
+      end
+
+      # Whether #copy_edit would copy the file at +path+ (read-only): the rule
+      # ShippedUpdate's plan names its replaced files by.
+      def self.edit?(path, recorded: nil, incoming: nil)
+        return false if File.symlink?(path) || !File.file?(path)
+        return false if incoming && File.file?(incoming) && FileUtils.identical?(incoming, path)
+
+        Provenance.recorded_sha(recorded).empty? || !Provenance.sha_matches?(path, recorded)
+      end
+
+      # What #copy_edits would copy (read-only), as <label>/<its path in dir>.
+      def self.edits(dir, label, recorded = nil, incoming = {})
+        edited_in(dir, recorded, incoming).map { |file| "#{label}/#{file}" }
+      end
+
+      # The files under +dir+ (paths in it) #copy_edits copies.
+      def self.edited_in(dir, recorded, incoming)
+        return [] if File.symlink?(dir) || !File.directory?(dir)
 
-        Dir.glob("**/*", File::FNM_DOTMATCH, base: dir).sort.each do |file|
-          copy_edit(File.join(dir, file), as: "#{label}/#{file}", recorded: recorded&.[](file), incoming: incoming[file])
+        Dir.glob("**/*", File::FNM_DOTMATCH, base: dir).sort.select do |file|
+          edit?(File.join(dir, file), recorded: recorded&.[](file), incoming: incoming[file])
         end
       end