samagotchi 0.156.0 → 0.158.0

data/lib/samagotchi/context_sources.rb

@@ -7,6 +7,7 @@ require "time"
 require_relative "atomic_file"
 require_relative "memory_paths"
 require_relative "paths"
+require_relative "session_paths"
 require_relative "session"
 
 module Samagotchi
@@ -617,13 +618,13 @@ module Samagotchi
       nil
     end
 
-    # <state dir>/context; +state_dir+ is the sessions dir (Session.default_state_dir).
+    # <state dir>/context; +state_dir+ is the sessions dir (SessionPaths.default_state_dir).
     def root(state_dir: nil)
-      File.join(File.dirname(state_dir || Session.default_state_dir), DIR)
+      File.join(File.dirname(state_dir || SessionPaths.default_state_dir), DIR)
     end
 
     def session_location(session_id, state_dir: nil)
-      Location.new(scope: "session", dir: File.join(root(state_dir: state_dir), "sessions", Session.check_id!(session_id)),
+      Location.new(scope: "session", dir: File.join(root(state_dir: state_dir), "sessions", SessionPaths.check_id!(session_id)),
                    key: session_id)
     end
 
@@ -657,19 +658,21 @@ module Samagotchi
     end
 
     # Where a project's source runs: the project root when it is a checkout
-    # (its .git is there), else +fallback+ (the session's folder): a bare
+    # (its .git is there) or a marked folder (MemoryPaths::MARKER), else
+    # +fallback+ (the session's folder): a bare
     # repo, proj/.bare or --separate-git-dir makes the root the git dir
     # itself (MemoryPaths.project_root), and a command run there sees no
     # files.
     def project_cwd(project_root, fallback)
       root = project_root.to_s
-      !root.empty? && File.exist?(File.join(root, ".git")) ? root : fallback
+      checkout = !root.empty? && [".git", MemoryPaths::MARKER].any? { |name| File.exist?(File.join(root, name)) }
+      checkout ? root : fallback
     end
 
     # A deleted session's sources, snapshots, subscriptions and markers.
     # @return [Array<String>] the paths removed
     def remove_session(session_id, state_dir: nil)
-      return [] unless Session.valid_id?(session_id.to_s)
+      return [] unless SessionPaths.valid_id?(session_id.to_s)
 
       dir = session_location(session_id, state_dir: state_dir).dir
       return [] unless Dir.exist?(dir)

data/lib/samagotchi/context_window.rb

@@ -11,14 +11,14 @@ module Samagotchi
   #      provider's context_length)
   #   3. models.<key>.window_tokens, else hosts.<name>.window_tokens
   #      (#setting: the most specific wins)
-  #   4. context.window_tokens (CLI, SAMAGOTCHI_CONTEXT_WINDOW_TOKENS or the
-  #      config file)
+  #   4. context.window_tokens (--context-window-tokens,
+  #      SAMAGOTCHI_CONTEXT_WINDOW_TOKENS or the config file)
   #   5. DEFAULT_TOKENS
   # Settings (3 and 4) only fill in when the server and its list report
   # nothing.
   #
-  # Sources: :server, :model_list, :model_setting, :host_setting, :config
-  # (CLI or file), :env, :default.
+  # Sources: :server, :model_list, :model_setting, :host_setting, :cli,
+  # :env, :config (the file), :default.
   module ContextWindow
     DEFAULT_TOKENS = 256_000
 
@@ -48,16 +48,13 @@ module Samagotchi
     # The window config.yml gives this model or its host:
     # models.<key>.window_tokens (by the model's lookup names, as sampling
     # and vision look a model up), else hosts.<name>.window_tokens.
-    # @param target [HostRegistry::ModelTarget]
-    # @param names [Array<String>] HostRegistry#lookup_names
-    # @param models [Hash{String => ModelSettings}, nil] ModelSettings.all (specs)
+    # @param lookup [ModelLookup] the model's layers (EffectiveModel#lookup)
     # @return [Resolved, nil]
-    def setting(target, names:, models: nil)
-      models ||= ModelSettings.all
-      tokens = ModelSettings.find(names, :window_tokens, models: models)&.value
+    def setting(lookup)
+      tokens = lookup.model(:window_tokens)&.value
       return Resolved.new(tokens: tokens, source: :model_setting) if positive_integer?(tokens)
 
-      tokens = target&.entry&.window_tokens
+      tokens = lookup.host(:window_tokens)
       positive_integer?(tokens) ? Resolved.new(tokens: tokens, source: :host_setting) : nil
     rescue StandardError
       nil
@@ -79,7 +76,7 @@ module Samagotchi
       end
       return Resolved.new(tokens: DEFAULT_TOKENS, source: :default) unless positive_integer?(value)
 
-      Resolved.new(tokens: value, source: origin == :env ? :env : :config)
+      Resolved.new(tokens: value, source: { cli: :cli, env: :env }.fetch(origin, :config))
     end
 
     # For callers with no client at hand (tool output guardrails): the last

data/lib/samagotchi/effective_model.rb

@@ -4,6 +4,7 @@ require_relative "host_registry"
 require_relative "log"
 require_relative "context_window"
 require_relative "llm_context_strategy"
+require_relative "model_lookup"
 require_relative "model_profile"
 require_relative "reasoning_history"
 require_relative "sampling_settings"
@@ -22,7 +23,8 @@ module Samagotchi
 
   # The effective model resolved once (HostRegistry#resolve: its host and
   # client, the id sent) with the names its models: entry may be under
-  # (HostRegistry#lookup_names), and its settings read from them. An
+  # (HostRegistry#lookup_names), and its settings read from them through
+  # one ModelLookup (every layer's input, with the registry's env). An
   # immutable snapshot built per read, never kept across reads: config.yml,
   # a model listing (which may move a bare id to another host) and another
   # process's saved lists all change what a resolve gives without any
@@ -32,14 +34,17 @@ module Samagotchi
   # Engine has always given (Unresolved); building one raises as
   # HostRegistry#resolve does (SessionModelSettings#model_setting gives the
   # fallback then).
-  EffectiveModel = Data.define(:registry, :name, :typed, :target, :names) do
+  EffectiveModel = Data.define(:registry, :name, :typed, :target, :names, :lookup) do
     # @param registry [HostRegistry]
     # @param choice [ModelChoice]
+    # @param models [Hash{String => ModelSettings}, nil] one models: map for
+    #   many models (a picker); ModelSettings.all at each read by default
     # @raise what HostRegistry#resolve raises
-    def self.of(registry, choice)
+    def self.of(registry, choice, models: nil)
       target = registry.resolve(choice.name)
-      new(registry: registry, name: choice.name, typed: choice.typed, target: target,
-          names: registry.lookup_names(choice.typed, resolved: choice.name, target: target))
+      names = registry.lookup_names(choice.typed, resolved: choice.name, target: target)
+      new(registry: registry, name: choice.name, typed: choice.typed, target: target, names: names,
+          lookup: ModelLookup.for(target, names: names, models: models, env: registry.env))
     end
 
     # A saved session's model (no worker): its model name, the default when
@@ -50,6 +55,34 @@ module Samagotchi
       of(registry, ModelChoice.new(name: name, typed: session.model_typed || name))
     end
 
+    # A saved session's LLM context strategy, apply rule and budget, each
+    # with where it came from (LLMContextStrategy::Explained#summary), as
+    # its worker would resolve them; nil when they can't be (an unreadable
+    # config, a model that resolves nowhere). From config and the registry
+    # only: no network, no model call. What a session page, a session
+    # list's ctx % and a spawn-time check all read.
+    # @param session [Session, nil]
+    # @param registry [HostRegistry, nil] the hosts to resolve against;
+    #   HostRegistry.current by default
+    # @return [Hash, nil] Explained#summary, symbol keys
+    def self.session_llm_context(session, registry: nil)
+      return nil if session.nil?
+
+      own = session.llm_context
+      of_session(session, registry: registry || HostRegistry.current).llm_context_explained(own&.resolve_args || {})&.summary(own)
+    rescue StandardError # degrade-ok: a saved session's model that resolves nowhere has no budget to show; the readers log their own
+      nil
+    end
+
+    # The budget a saved session's turns run under
+    # (.session_llm_context's :budget_tokens), nil when it is off or can't
+    # be resolved. What a session list's ctx % counts against, so a saved
+    # session's fill reads as the live meter.
+    # @return [Integer, nil]
+    def self.session_budget(session, registry: nil)
+      session_llm_context(session, registry: registry)&.fetch(:budget_tokens, nil)
+    end
+
     def entry = target.entry
     def client = target.client
     def bare = target.bare_model
@@ -63,21 +96,21 @@ module Samagotchi
 
     # The configured request parameters (hosts: and models: sampling).
     def sampling
-      SamplingSettings.for(target, names: names)
+      SamplingSettings.for(lookup)
     rescue StandardError => e
       unresolved(:sampling_unresolved, e, SamplingSettings::EMPTY)
     end
 
     # "temperature=0.6 (hosts.work)", nil when none.
     def sampling_summary
-      SamplingSettings.summary(target, names: names)
+      SamplingSettings.summary(lookup)
     rescue StandardError => e
       unresolved(:sampling_unresolved, e, nil)
     end
 
     # The thinking level (Thinking.resolve), the session's +own+ first.
     def thinking(own:)
-      Thinking.resolve(target, names: names, session: own).first
+      Thinking.resolve(lookup, session: own).first
     rescue StandardError => e
       unresolved(:thinking_unresolved, e, Thinking::DEFAULT)
     end
@@ -85,23 +118,25 @@ module Samagotchi
     # The thinking level with where it came from (SettingExplained), nil
     # when it can't be resolved.
     def thinking_explained(own:)
-      Thinking.explain(target, names: names, session: own)
+      Thinking.explain(lookup, session: own)
     rescue StandardError => e
       unresolved(:thinking_unresolved, e, nil)
     end
 
     # What a thinking level change costs the prompt cache
     # (Thinking.cache_cost); the block gives the prompt profile, asked only
-    # on a native host. Raises.
+    # on a native host; a local chat host's is the one its name says. Raises.
     # @return [Symbol]
     def thinking_cache_cost(&)
-      Thinking.cache_cost(target, profile: entry&.chat? ? nil : yield&.name)
+      return Thinking.cache_cost(target, inferred: ModelProfile.inferred_profile_name(bare)) if entry&.chat?
+
+      Thinking.cache_cost(target, profile: yield&.name)
     end
 
     # The reasoning_history level (ReasoningHistory.resolve), the session's
     # +own+ first.
     def reasoning_history(own:)
-      ReasoningHistory.resolve(target, names: names, session: own).first
+      ReasoningHistory.resolve(lookup, session: own).first
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, ReasoningHistory::DEFAULT)
     end
@@ -112,7 +147,7 @@ module Samagotchi
     def reasoning_history_explained(own:, native: false)
       return nil unless native || entry&.chat?
 
-      ReasoningHistory.explain(target, names: names, session: own)
+      ReasoningHistory.explain(lookup, session: own)
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, nil)
     end
@@ -122,7 +157,7 @@ module Samagotchi
     def reasoning_history_summary(own:)
       return nil unless entry&.chat?
 
-      level, source = ReasoningHistory.resolve(target, names: names, session: own)
+      level, source = ReasoningHistory.resolve(lookup, session: own)
       source ? ReasoningHistory.label(level, source) : nil
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, nil)
@@ -139,7 +174,7 @@ module Samagotchi
     # [seconds, source] a cut waits for thinking (SteerCutAfter.resolve);
     # the global and its name when it can't be resolved.
     def steer_cut_after_explained
-      SteerCutAfter.resolve(target, names: names)
+      SteerCutAfter.resolve(lookup)
     rescue StandardError => e
       unresolved(:steer_cut_after_unresolved, e, [SteerCut.cut_after, "steer.cut_after"])
     end
@@ -148,7 +183,7 @@ module Samagotchi
     # (LLMContextStrategy.explain) under the session's +args+
     # (LLMContextOverride#resolve_args), nil when it can't be resolved.
     def llm_context_explained(args)
-      LLMContextStrategy.explain(target, names: names, **args)
+      LLMContextStrategy.explain(lookup, **args)
     rescue StandardError => e
       unresolved(:llm_context_unresolved, e, nil)
     end
@@ -156,14 +191,14 @@ module Samagotchi
     # The LLM context layers its turns run under; [] when they can't be
     # resolved.
     def llm_context_layers(args)
-      LLMContextStrategy.resolve(target, names: names, **args).active_layers
+      LLMContextStrategy.resolve(lookup, **args).active_layers
     rescue StandardError => e
       unresolved(:llm_context_unresolved, e, [])
     end
 
     # models:/hosts: window_tokens (ContextWindow.setting), nil when unset.
     def window_setting
-      ContextWindow.setting(target, names: names)
+      ContextWindow.setting(lookup)
     rescue StandardError => e
       unresolved(:window_unresolved, e, nil)
     end
@@ -171,7 +206,7 @@ module Samagotchi
     # The window config.yml gives this model or its host
     # (ContextWindow.setting), never asking a server: a session loaded on
     # it (Engine#session=, before a worker's Bridge serves). nil when none.
-    def configured_context_window = ContextWindow.setting(target, names: names)
+    def configured_context_window = ContextWindow.setting(lookup)
 
     # The window as its loop would see it (ChatLoop#context_window: a remote
     # chat host has no /props, only its model list); nil when it can't be
@@ -183,7 +218,7 @@ module Samagotchi
         adapter = registry.adapter_for(entry)
         client = nil if adapter.remote?
       end
-      ContextWindow.resolve(client: client, model: bare, adapter: adapter, setting: ContextWindow.setting(target, names: names))
+      ContextWindow.resolve(client: client, model: bare, adapter: adapter, setting: ContextWindow.setting(lookup))
     rescue StandardError => e
       unresolved(:window_unresolved, e, nil)
     end
@@ -232,7 +267,7 @@ module Samagotchi
 
     # Whether it sees images (VisionSupport.for) under +profile+.
     def vision_support(profile)
-      VisionSupport.for(target, profile: profile, adapter: vision_adapter, names: names)
+      VisionSupport.for(lookup, profile: profile, adapter: vision_adapter)
     end
 
     # A chat host's adapter (what it says of images), nil on a native host.
@@ -246,7 +281,7 @@ module Samagotchi
     # Not cached here. Raises.
     # @return [ModelProfile::Resolution]
     def profile_resolution
-      ModelProfile.resolve(names: names, entry: entry, client: client, bare_model: bare)
+      ModelProfile.resolve(names: names, entry: entry, client: client, bare_model: bare, models: lookup.models)
     end
 
     # See Unresolved.fallback.

data/lib/samagotchi/engine/plugins.rb

@@ -60,7 +60,7 @@ module Samagotchi
           prompt_sections: @prompt_sections,
           prompt_changed: -> { prompt_changed! },
           judgments: @judgments,
-          hook_failed: ->(hook, failed) { @hook_routes.plugin_hook_failed(hook, failed) }
+          hook_failed: ->(hook, failed, effect: :log) { @hook_routes.plugin_hook_failed(hook, failed, effect: effect) }
         )
         # What plugins show while they load (an MCP server that didn't
         # start) waits for the first turn, beside the load warnings: no UI

data/lib/samagotchi/engine/recap.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../recap_place"
+
 module Samagotchi
   class Engine
     # The idle recap (IdleRecap) and the shared idle scheduler: the recap job
@@ -96,9 +98,10 @@ module Samagotchi
         @recap ? @recap.request_now : :off
       end
 
-      # The recap saved with the current session (recap.json), and how many
-      # user turns came after it (0: it is current).
-      # @return [Hash, nil] {text:, covered:, turns_since:, created_at:}
+      # The recap saved with the current session (recap.json), how many
+      # user turns came after it (0: it is current), and the stamp of the
+      # last turn it covers (RecapPlace: where a page puts it; nil, the count).
+      # @return [Hash, nil] {text:, covered:, turns_since:, opening_id:, created_at:}
       def saved_recap
         state = @recap&.state
         return nil unless state
@@ -106,7 +109,8 @@ module Samagotchi
         messages = @session&.messages || []
         covered = state[:covered].to_i
         turns_since = Array(messages).drop(covered).count { |m| Steer.turn_opening?(m) }
-        { text: state[:text], covered: covered, turns_since: turns_since, created_at: state[:created_at] }
+        { text: state[:text], covered: covered, turns_since: turns_since, opening_id: RecapPlace.opening_id(messages, covered),
+          created_at: state[:created_at] }
       end
 
       # Start the shared idle scheduler (reminders + optional recap). The recap

data/lib/samagotchi/engine.rb

@@ -230,7 +230,9 @@ module Samagotchi
       @chat_backend_mutex = Mutex.new
       @side_judgments = SideJudgments.new
       @judgments = build_judgments
-      @host_registry = host_registry || HostRegistry.new
+      # Taken once: a running worker keeps the hosts it started with. A
+      # client (specs) goes on a registry of its own, never the shared one.
+      @host_registry = host_registry || (client ? HostRegistry.new : HostRegistry.current)
       # The turn stages over the objectives (its audit, view and proposals)
       # and the Verify/Revise anchors (TurnStages).
       @objectives_stage = build_objectives_stage
@@ -355,12 +357,7 @@ module Samagotchi
     # toolkit, the tool index, peer sources), then the plugins themselves
     # unless +load+ is false (see #initialize for when).
     def build_tools_and_plugins(load:, task_finish_notes:)
-      # The routes are built already (#initialize), so a bundle's hook file
-      # that raises at fire time is told the same way a chi.on handler is:
-      # once per hook in this worker. The guard covers a hook that raises
-      # before the routes are there (nothing in the Engine's path does).
-      @extension_load = ExtensionLoad.new(hook_failures: @guardrail_failures,
-                                          hook_failed: ->(hook, failed, effect: nil) { @hook_routes&.plugin_hook_failed(hook, failed, effect: effect) })
+      @extension_load = ExtensionLoad.new(hook_failures: @guardrail_failures)
       @hooks = @extension_load.hooks
       # The tools this session offers (the prompts' declarations and the
       # kernel's dispatch): the built-ins, per Engine. execute.description
@@ -718,7 +715,10 @@ module Samagotchi
     # (its limit goes in last_turn). The end event names its turn
     # (`turn_id:`, as :turn_started does) and, for a Verify turn,
     # `verify: true` (its opening's stamp: a page watching it live offers
-    # no Revise on its answer, verdict or not, as a reload does).
+    # no Revise on its answer, verdict or not, as a reload does). When the
+    # turn keeps messages, the event also names its own range in them,
+    # `kept[kept_from...kept_to]` (display-side: Bridge::TurnDrawings
+    # reads it; no message gains a key).
     def end_turn(turn, outcome, save: false, exhausted: false)
       seconds = turn.elapsed
       turn.outcome = outcome
@@ -727,6 +727,7 @@ module Samagotchi
         event[:turn_id] = turn.id
         event[:verify] = true if turn.verify
         revises = @verify_anchors.stamp_opening(kept, turn, outcome)
+        kept_range!(event, turn, kept)
         replace_session_messages(turn.session, kept) if kept
         verdict = @verify_anchors.record_verdict(turn, outcome)
         event[:verdict] = verdict if verdict
@@ -744,6 +745,20 @@ module Samagotchi
     end
     private :end_turn
 
+    # The end event's kept_from/kept_to (#end_turn): only when the turn
+    # keeps messages and its start is known (#turn_messages ran). An ending
+    # that replaces an earlier turn's note at the history's tail
+    # (TurnNote.replace_trailing on a Continue stopped before its first step)
+    # leaves only system messages and its own note after it, so the range
+    # still starts at or before the turn's note and draws nothing else.
+    def kept_range!(event, turn, kept)
+      return unless kept && turn.history_size
+
+      event[:kept_from] = turn.history_size
+      event[:kept_to] = kept.size
+    end
+    private :kept_range!
+
     # What a notice may stand in for (hook_notify's fallback_for:).
     NOTICE_FALLBACKS = HookRoutes::NOTICE_FALLBACKS
 
@@ -806,8 +821,11 @@ module Samagotchi
     # +wall+: the wall time it started (MessageTime.now, once): the
     # :turn_started event's at and its user message's (and reminders') stamp.
     # +verify+, +revises+: a Verify turn's claim, a Revise turn's draft.
+    # +history_size+: turn.messages' size under the system head, before
+    # the reminders and the prompt (#turn_messages): where the turn's own
+    # messages start in what it keeps (the end event's kept_from).
     Turn = Struct.new(:context, :prompt, :continue, :on_event, :started_at, :messages, :ended, :prepared_settings,
-                      :limit, :resumed, :resume_from, :wall, :verify, :revises, :outcome) do
+                      :limit, :resumed, :resume_from, :wall, :verify, :revises, :outcome, :history_size) do
       # The turn's id (:turn_started's turn_id, its metrics record's id and
       # its saved prompt's), session, origin and controller: its context's.
       def id = context.id
@@ -1124,6 +1142,9 @@ module Samagotchi
       # Built once per Engine (and again after a model switch) so the prompt
       # prefix, and the model server's KV cache for it, stay stable.
       turn.messages = ContextNote.with_system_head(turn.messages, { role: "system", content: system_prompt })
+      # Where the turn's own messages start (the end event's kept_from):
+      # after the head this may have added, before the reminders and prompt.
+      turn.history_size = turn.messages.size
       # Explicit --memory preloads are now known after system prompt build.
       @used_memories.add(activated_memory_names).absorb(session)
 

data/lib/samagotchi/events.rb

@@ -13,8 +13,9 @@ module Samagotchi
     # (#kept_turn?).
     TURN_KEPT = %i[turn_completed turn_canceled].freeze
     # The kinds of a running turn's parts (Bridge::TurnAccumulator), which a
-    # joining UI replays as live events.
-    PART_KINDS = %w[generation thinking text tool input steer reminder notice].freeze
+    # joining UI replays as live events (a card part only in a finished
+    # turn's drawing: a join takes its cards from CardStore).
+    PART_KINDS = %w[generation thinking text tool input steer reminder notice card].freeze
     # Types no Engine emits that a UI handles: the Bridge's stream frames
     # and the web's one synthetic replay event (a prompt merged into the
     # turn, turn_events.js snapshotEvents).

data/lib/samagotchi/extension_load.rb

@@ -7,20 +7,13 @@ require_relative "plugin/loader"
 
 module Samagotchi
   # What an Engine loads from outside chi as it starts: config.yml's hooks,
-  # installed bundles' hooks and plugins, and config.yml `bundles:` (their
-  # settings). It holds what plugins showed while they loaded (notices,
+  # installed bundles' plugins, and config.yml `bundles:` (their settings). It holds what plugins showed while they loaded (notices,
   # cards): no UI is there yet, so the Engine announces them on the first
   # turn (Engine#announce_load_events!).
   class ExtensionLoad
     # @param hook_failures [Guardrails::LoadFailures] where hooks that fail to load go
-    # @param hook_failed [#call, nil] (label, "Class: message", effect:) when
-    #   an installed bundle's hook file raises at fire time: the Engine's
-    #   HookRoutes, so the user is told once per hook. nil where there is no
-    #   UI to tell (the test kit's sandbox): a hook that raises then says
-    #   nothing, and raises nothing.
-    def initialize(hook_failures:, hook_failed: nil)
+    def initialize(hook_failures:)
       @hook_failures = hook_failures
-      @hook_failed = hook_failed
       @loading = false
       @held_events = []
     end
@@ -40,27 +33,30 @@ module Samagotchi
     end
 
     # The hooks: config.yml's (Hooks::Loader; an empty Registry without a
-    # hooks config), then the installed bundles' added to them.
+    # hooks config). An installed record that still has class-file hooks (a
+    # 0.157 install) adds a not-required failure each, which the Engine
+    # announces at the first turn: they don't load (#tell_retired_hooks).
     # @return [Hooks::Registry]
     def hooks
-      registry = hooks_from_config
-      add_bundle_hooks(registry)
-      registry
+      tell_retired_hooks
+      hooks_from_config
     end
 
     # Load the installed bundles' plugins into +registries+; one that fails
-    # goes to +failures+, and the rest still load. The block runs after them,
-    # still loading: what it shows is held with theirs.
+    # goes to +failures+, a required one (a guardrail plugin) to the hook
+    # failures, where it denies every tool call, and the rest still load.
+    # The block runs after them, still loading: what it shows is held with
+    # theirs.
     def load_plugins(registries, failures:)
       @held_events = []
       @loading = true
-      Plugin::Loader.load_installed(registries, failures: failures, settings: bundle_settings).tap { yield if block_given? }
+      Plugin::Loader.load_installed(registries, failures: failures, guardrail_failures: @hook_failures, settings: bundle_settings)
+                    .tap { yield if block_given? }
     ensure
       @loading = false
     end
 
-    # config.yml `bundles:` (ConfigFile.bundle_settings), read once: the
-    # bundle hooks and the plugins both want it.
+    # config.yml `bundles:` (ConfigFile.bundle_settings), read once.
     def bundle_settings
       @bundle_settings ||= Samagotchi::ConfigFile.bundle_settings
     end
@@ -75,36 +71,22 @@ module Samagotchi
       Hooks::Registry.new
     end
 
-    def add_bundle_hooks(registry)
+    # One failure per record whose hooks: map isn't empty; an empty
+    # hooks/ dir is not one, nor a manifest.json that doesn't read (the
+    # plugin loader and the rules report that: a record holding only hooks/
+    # with an unreadable manifest.json is silent at start, as its hooks
+    # wouldn't load anyway; `chi bundle status` lists it unreadable).
+    def tell_retired_hooks
       require_relative "memory_bundle/provenance"
-      settings = bundle_settings
       MemoryBundle::Provenance.each_installed(holding: :hooks) do |bundle_name, bundle|
-        if bundle.error?
-          Log.warn(:hooks, "bundle_manifest_invalid", echo: "[samagotchi:hooks] bundle '#{bundle_name}': #{bundle.error}; its hooks are not loaded",
-                                                      bundle: bundle_name)
-          @hook_failures.add("hooks (bundle #{bundle_name})", bundle.error, required: false)
-          next
-        end
-        bundle_dir = File.join(MemoryBundle::Provenance.bundles_dir, bundle_name)
-        hooks_dir = File.join(bundle_dir, "hooks")
-        manifest = bundle.manifest
-        if manifest.experimental?
-          Log.info(:hooks, "experimental_bundle", echo: "[hooks] Bundle '#{bundle_name}' is experimental — its hooks may change or misbehave.", bundle: bundle_name)
-        end
-        begin
-          Hooks::BundleLoader.load(bundle_name: bundle_name, hooks_dir: hooks_dir, metadata: manifest.hooks, registry: registry,
-                                   failures: @hook_failures, settings: settings[bundle_name.to_s] || {},
-                                   manifest: manifest, hook_failed: @hook_failed)
-        rescue Exception => e # rubocop:disable Lint/RescueException -- a hook's SyntaxError or exit must not stop chi
-          raise if e.is_a?(SignalException) # Ctrl-C and kill signals are the user's
+        next if bundle.error?
 
-          Log.error(:hooks, "bundle_load_failed", echo: "[samagotchi:hooks] bundle '#{bundle_name}' failed to load hooks: #{e.class}: #{e.message}", bundle: bundle_name, error: e.class.name)
-        end
+        Log.warn(:hooks, "bundle_hooks_retired", bundle: bundle_name, hooks: bundle.hooks.size)
+        @hook_failures.add("hooks (bundle #{bundle_name})", MemoryBundle::Manifest::HooksRetired::WORDS, required: false)
       end
-    rescue Exception => e # rubocop:disable Lint/RescueException -- a hook's SyntaxError or exit must not stop chi
-      raise if e.is_a?(SignalException) # Ctrl-C and kill signals are the user's
-
-      Log.error(:hooks, "bundles_load_failed", echo: "[samagotchi:hooks] failed to load bundle hooks: #{e.class}: #{e.message}", error: e.class.name)
+    rescue StandardError => e
+      Log.error(:hooks, "bundles_load_failed", echo: "[samagotchi:hooks] failed to read the installed bundles: #{e.class}: #{e.message}",
+                                               error: e.class.name)
     end
   end
 end

data/lib/samagotchi/guardrails/load_failures.rb

@@ -2,8 +2,9 @@
 
 module Samagotchi
   module Guardrails
-    # What failed to load at Engine start: hooks, bundle hook checksums,
-    # rule files. A required one makes the gate deny every tool call (a
+    # What failed to load at Engine start: config hooks, a required
+    # plugin, rule files, an older chi's class-file bundle hooks (which no
+    # longer load). A required one makes the gate deny every tool call (a
     # guardrail that silently vanished is the failure this guards against);
     # the rest are only announced.
     class LoadFailures

data/lib/samagotchi/guardrails/path_resolve.rb

@@ -153,6 +153,17 @@ module Samagotchi
         (low == low_dir || low.start_with?(File.join(low_dir, ""))) && folds_case?(dir)
       end
 
+      # Whether +root+ is the home folder or a folder above it (symlinks
+      # resolved on both; false for a blank one). ReviewPaths (a participant
+      # turn's project) and MemoryPaths (where a chi project marker is
+      # ignored) ask this.
+      # @param root [String, nil] @param home [String, nil]
+      def home_root?(root, home)
+        return false if home.to_s.empty? || root.to_s.empty?
+
+        under?(real(home.to_s), real(root.to_s))
+      end
+
       # Whether +path+ is in +dir+, not +dir+ itself (.under?'s terms).
       def strictly_under?(path, dir, fold: true)
         return true if path.start_with?(File.join(dir, ""))

data/lib/samagotchi/guardrails/review_paths.rb

@@ -59,11 +59,7 @@ module Samagotchi
       # review turn reads nothing there (#refusal: HOME_ROOT); a pair turn
       # asks the owner before every write (PairBoundary).
       # @param root [String] @param home [String, nil]
-      def self.home_root?(root, home)
-        return false if home.to_s.empty? || root.to_s.empty?
-
-        PathResolve.under?(PathResolve.real(home.to_s), PathResolve.real(root.to_s))
-      end
+      def self.home_root?(root, home) = PathResolve.home_root?(root, home)
 
       # @param root [String, nil] the session's project root (the work tree
       #   top of its folder); nil or blank refuses every path

data/lib/samagotchi/guardrails_command.rb

@@ -190,7 +190,7 @@ module Samagotchi
       threshold = threshold(options[:threshold])
       return usage_error(threshold) if threshold.is_a?(String)
 
-      client = @client || SystemOne::Client.from_config(host_registry: HostRegistry.new, mode: Config.get("guardrails.system_one.mode"), model: options[:model])
+      client = @client || SystemOne::Client.from_config(host_registry: HostRegistry.current, mode: Config.get("guardrails.system_one.mode"), model: options[:model])
       if client.nil?
         error_line("chi guardrails replay: no System 1 client — set guardrails.system_one.mode to audit or on " \
                    "and system_one.host in config.yml")

data/lib/samagotchi/hook_routes.rb

@@ -21,7 +21,7 @@ module Samagotchi
     # How much of a failed hook's error #plugin_hook_failed shows.
     HOOK_FAILURE_CHARS = 300
     # What the notice says the hook now does, by the policy Hooks.wrap gave it
-    # (a chi.on handler is always :log; a bundle's hook file any of the three).
+    # (a chi.on handler :log, or :deny for an on_error: :fail_closed one).
     HOOK_FAILURE_EFFECTS = {
       log: "it's skipped, and only the log has its next failures",
       skip: "it's skipped, and its next failures are silent",
@@ -98,7 +98,7 @@ module Samagotchi
       nil
     end
 
-    # A bundle hook file or a chi.on handler raised (Hooks.wrap; the log has
+    # A chi.on handler raised (Hooks.wrap; the log has
     # every firing of a :log one). Its first failure on this Engine, so in
     # this worker, tells the user, as a plugin that failed to load does; then
     # only the log. One line per label — file, bundle and event — so a