samagotchi 0.157.0 → 0.158.0

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -27,8 +27,8 @@ module Samagotchi
     # bundle that isn't installed and never downgrades.
     #
     # .md files take the Installer's 3-way merge: a clean text merge replaces
-    # the file (merged), a real conflict keeps the user's (behind). Hooks, rules,
-    # the plugin and scripts are replaced; an edited one (Trash.edit?: its
+    # the file (merged), a real conflict keeps the user's (behind). Rules,
+    # the plugin and scripts are replaced, an older chi's hooks removed; an edited one (Trash.edit?: its
     # bytes neither the recorded sha, none recorded counting as edited, nor
     # the incoming file's) is copied to the trash first and listed in
     # replaced (#trash_bound).
@@ -119,10 +119,7 @@ module Samagotchi
           r.merged = installer.merged_files
           r.behind = installer.behind
           r.trash_copy = installer.trash_copy_line
-          # The integrity check's warnings; the rest of the Installer's say
-          # what the row's merged and behind already do.
-          mismatches = installer.warnings.grep(/\AChecksum mismatch/)
-          r.note = mismatches.join("; ") unless mismatches.empty?
+          r.note = mismatch_note(installer)
         end
       rescue StandardError => e
         row.dup.tap do |r|
@@ -202,6 +199,10 @@ module Samagotchi
         if Manifest.requires_chi_failure(manifest.requires_chi, chi_version)
           return skip(row, "needs chi #{manifest.requires_chi}", keep_to: true)
         end
+
+        # The upgrade would refuse it (Installer#refuse_hooks).
+        hooks = Manifest::HooksRetired.files_in(row.source_dir)
+        return skip(row, Manifest::HooksRetired.for_files(hooks).message, keep_to: true) unless hooks.empty?
         return skip(row, "project scope: chi bundle upgrade #{ship.source} in the project") if row.scope == "project"
         return skip(row, "unknown scope #{row.scope}: upgrade chi or reinstall") unless MemoryPaths.scope_dir(row.scope)
 
@@ -210,6 +211,7 @@ module Samagotchi
         row.behind = forecast.behind
         row.replaced = trash_bound(name, bundle, manifest, row.source_dir)
         row.status = :would_update
+        row.note = planned_mismatch_note(row)
         row
       rescue SystemCallError => e
         # A file it can't read: the upgrade would fail on it, so this is that
@@ -242,6 +244,20 @@ module Samagotchi
 
       def note_of(remerged) = remerged.warnings.empty? ? nil : remerged.warnings.join("; ")
 
+      def mismatch_note(installer)
+        mismatches = installer.warnings.grep(/\AChecksum mismatch/)
+        mismatches.join("; ") unless mismatches.empty?
+      end
+
+      def planned_mismatch_note(row)
+        installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true, dry_run: true,
+                                  shipped_dir: File.dirname(row.source_dir))
+        installer.run
+        mismatch_note(installer)
+      rescue Installer::InstallError
+        nil
+      end
+
       def profile_row(row, bundle, shipped_dir, chi_version)
         manifest = Manifest.read(dir: row.source_dir)
         newer = Listing.newer?(row.to, row.from)
@@ -277,49 +293,28 @@ module Samagotchi
       end
 
       # What the upgrade from +source_dir+ copies to the trash, as
-      # hooks/F, guardrails/F, plugin/F, scripts/F: Trash.edit? over the files
-      # AssetInstaller replaces or removes, each against the file it puts in
-      # its place. Hooks: the ones install_hooks copies (listed, else every
-      # hooks/*.rb; present, not links) and the ones prune_dropped_hooks
-      # removes (recorded, no longer shipped; no incoming). Rules, the plugin
-      # and scripts: their whole folder, which the upgrade replaces.
+      # hooks/F, guardrails/F, plugin/F, scripts/F: Trash.edits over the
+      # folders AssetInstaller replaces or removes, each file against the one
+      # it puts in its place. Rules, the plugin and scripts: their whole
+      # folder, which the upgrade replaces. hooks/: an older chi's, which the
+      # upgrade removes whole (AssetInstaller#retire_hooks; no incoming).
       def trash_bound(name, bundle, manifest, source_dir)
         provenance = Provenance.new(name: name)
         rules = Dir.glob(File.join(source_dir, "guardrails", "*.yml")).sort
                    .reject { |file| AssetInstaller.linked?(file, source_dir) }
         plugin = manifest.plugin ? { manifest.plugin[:file] => File.join(source_dir, manifest.plugin[:file]) } : {}
         scripts = manifest.scripts.keys.to_h { |file| [file, File.join(source_dir, "scripts", file)] }
-        trash_bound_hooks(provenance, bundle, manifest, source_dir) +
+        Trash.edits(provenance.hooks_dir, "hooks", bundle.hooks.transform_values(&:sha256)) +
           Trash.edits(provenance.guardrails_dir, "guardrails", bundle.guardrails, rules.to_h { |file| [File.basename(file), file] }) +
           Trash.edits(provenance.plugin_dir, "plugin", bundle.plugin_shas, plugin) +
           Trash.edits(provenance.scripts_dir, "scripts", bundle.scripts, scripts)
       end
 
-      # #trash_bound's hooks: AssetInstaller#install_hooks' set (incoming: the
-      # source's file), then #prune_dropped_hooks' (incoming: none). A stray
-      # file in hooks/ is in neither: the upgrade leaves it.
-      def trash_bound_hooks(provenance, bundle, manifest, source_dir)
-        src = ->(file) { File.join(source_dir, "hooks", file) }
-        listed = manifest.hooks.keys.select { |file| file.is_a?(String) && !file.empty? }
-        listed = Dir.glob(src.call("*.rb")).map { |file| File.basename(file) } if manifest.hooks.empty?
-        shipped = listed.reject do |file|
-          (File.symlink?(src.call(file)) || File.exist?(src.call(file))) && AssetInstaller.linked?(src.call(file), source_dir)
-        end
-        incoming = shipped.select { |file| File.exist?(src.call(file)) }.to_h { |file| [file, src.call(file)] }
-        incoming.merge!((bundle.hooks.keys - shipped).to_h { |file| [file, nil] })
-        incoming.filter_map do |file, from|
-          "hooks/#{file}" if Trash.edit?(File.join(provenance.hooks_dir, file), recorded: bundle.hooks[file]&.sha256, incoming: from)
-        end
-      end
-
-      # Installed hooks, rules and the plugin whose sha differs from the
-      # recorded one (they didn't load), as hooks/F, guardrails/F, plugin/F.
+      # Installed rules and the plugin whose sha differs from the recorded
+      # one (they didn't load), as guardrails/F, plugin/F.
       def edited_executables(name, bundle)
         provenance = Provenance.new(name: name)
         edited = []
-        bundle.hooks.each do |file, hook|
-          edited << "hooks/#{file}" if edited?(File.join(provenance.hooks_dir, file), hook.sha256)
-        end
         bundle.guardrails.each do |file, sha|
           edited << "guardrails/#{file}" if edited?(File.join(provenance.guardrails_dir, file), sha)
         end

data/lib/samagotchi/memory_bundle/status.rb

@@ -16,14 +16,15 @@ module Samagotchi
       # A bundle as this chi reads it now (what chi bundle status prints):
       # its stored record, the scope it resolves to (scope_error when it
       # can't), the folder its files belong in, what each file looks like on
-      # disk, its installed plugin, why none of its hooks load, and its needs
+      # disk, its installed plugin, the class-file hooks its record still
+      # has (retired_hooks: they don't load), and its needs
       # with what this process's PATH found. The +files+ entries and +plugin+
       # stay Hashes: their fields differ per case (an unchecked file has no
       # paths at all). An entry's behind is its FileStanding::Behind, nil for a
       # file that isn't; merge_note its FileStanding::MergeNote, nil without one;
       # unreadable: the file is there, but this chi can't read it.
       Report = Data.define(:provenance, :scope, :scope_error, :target_dir, :files, :plugin,
-                           :hooks_requires_failure, :needs)
+                           :retired_hooks, :needs)
 
       # A scope this chi can't resolve (a newer chi's, a hand edit) isn't
       # guessed: scope_error says so, target_dir is nil and each file is
@@ -69,7 +70,7 @@ module Samagotchi
         end
         Report.new(provenance: bundle, scope: scope, scope_error: target_dir ? nil : "unknown scope: #{scope}",
                    target_dir: target_dir, files: details, plugin: plugin_status(provenance, bundle),
-                   hooks_requires_failure: hooks_requires_failure(bundle), needs: needs_status(bundle))
+                   retired_hooks: retired_hooks(provenance, bundle), needs: needs_status(bundle))
       end
 
       # A FileState digest as the Report has it: nil for none, or one that
@@ -77,13 +78,14 @@ module Samagotchi
       def self.digest_or_nil(digest) = digest == :unreadable ? nil : digest
       private_class_method :digest_or_nil
 
-      # Why none of the bundle's hooks load (this chi doesn't meet its
-      # requires_chi, Hooks::BundleLoader), or nil: it has no hooks or meets it.
-      def self.hooks_requires_failure(bundle)
-        manifest = bundle.manifest
-        return nil if manifest.hooks.empty?
-
-        manifest.requires_chi_failure
+      # The class-file hooks the record still has (a 0.157 install's; chi
+      # loads none, Manifest::HooksRetired), each "ok" or "missing" in
+      # hooks/, by name; {} for none.
+      # @return [Hash{String => String}]
+      def self.retired_hooks(provenance, bundle)
+        bundle.hooks.keys.sort.to_h do |file|
+          [file, File.exist?(File.join(provenance.hooks_dir, file)) ? "ok" : "missing"]
+        end
       end
 
       # The stored needs, each with found: from this process's PATH (the

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -214,7 +214,11 @@ module Samagotchi
         missing = MemoryFiles.select(GEM_BUNDLE_DIR, gem_manifest).reject { |key| File.exist?(File.join(target_dir, key)) }
         missing = restored_rows(missing, target_dir) unless missing.empty?
         return result(:up_to_date, from: version, to: version) if missing.empty?
-        return result(:restored, from: version, to: version) if dry_run
+
+        if dry_run
+          warnings = missing.filter_map { |key| restore_mismatch(key, gem_manifest) }
+          return result(:restored, from: version, to: version, warnings: warnings)
+        end
 
         warnings = missing.flat_map { |key| restore_file(key, gem_manifest) }
         result(:restored, from: version, to: version, warnings: warnings)
@@ -238,7 +242,7 @@ module Samagotchi
         description = gem_manifest.file_descriptions[key]
         FileUtils.cp(source, target)
         Provenance.new(name: BUNDLE_NAME).record_restored(key, source, description: description)
-        warnings = [FileDigest.mismatch(key, target, gem_manifest.checksum_for(key))].compact
+        warnings = [restore_mismatch(key, gem_manifest)].compact
         begin
           IndexUpdater.update_index(SCOPE, key.delete_suffix(".md"), File.size(target), description, source: BUNDLE_NAME)
         rescue StandardError => e
@@ -247,6 +251,10 @@ module Samagotchi
         warnings
       end
 
+      def restore_mismatch(key, gem_manifest)
+        FileDigest.mismatch(key, File.join(GEM_BUNDLE_DIR, key), gem_manifest.checksum_for(key))
+      end
+
       # An up-to-date bundle's marked files, retried. No marks: nothing is read.
       def remerge(bundle, verified, dry_run)
         done = Remerge.new(name: BUNDLE_NAME, scope: SCOPE, target_dir: MemoryPaths.system_dir, source_dir: GEM_BUNDLE_DIR, record: bundle)
@@ -264,7 +272,10 @@ module Samagotchi
         owned = provenance.record&.files&.keys || []
         forecast = Merger::Upgrade.new(provenance: provenance, target_dir: MemoryPaths.system_dir, source_dir: GEM_BUNDLE_DIR)
                                   .forecast(gem_manifest.files.keys.map(&:to_s).sort & owned, version: to)
-        result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind)
+        installer = upgrade_installer(dry_run: true)
+        installer.run
+        warnings = installer.warnings.grep(/\AChecksum mismatch/)
+        result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind, warnings: warnings)
       end
 
       # Provenance#adopt_manifest from the shipped dir, for a record without a
@@ -276,9 +287,9 @@ module Samagotchi
         Provenance.new(name: BUNDLE_NAME).adopt_manifest(GEM_BUNDLE_DIR)
       end
 
-      def upgrade_installer
+      def upgrade_installer(dry_run: false)
         Installer.new(source: GEM_BUNDLE_DIR, name: BUNDLE_NAME, scope: SCOPE, force: false, strict: true, upgrade: true,
-                      shipped_dir: File.dirname(GEM_BUNDLE_DIR))
+                      dry_run: dry_run, shipped_dir: File.dirname(GEM_BUNDLE_DIR))
       end
       private_class_method :with_lock, :note_newer_installed, :install_fresh, :keep_manifest, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
                            :upgrade_installer, :result, :planned_update

data/lib/samagotchi/memory_bundle/trash.rb

@@ -99,24 +99,19 @@ module Samagotchi
         dest
       end
 
-      # Copies the file at +path+ as +as+ before it is replaced or removed, when
-      # that would lose something: its bytes are neither what the record says
-      # was installed (no sha recorded: unknown, so it counts as edited) nor
-      # +incoming+'s. A link (a dev install's) points at its source, which
-      # nothing here touches.
-      def copy_edit(path, as:, recorded: nil, incoming: nil)
-        copy(path, as: as) if self.class.edit?(path, recorded: recorded, incoming: incoming)
-      end
-
-      # copy_edit for every file under +dir+, which is about to go, at any depth
-      # (kept as <label>/<its path in dir>). A linked dir isn't followed.
+      # Copies every file under +dir+, which is about to be replaced or
+      # removed, when that would lose something: its bytes are neither what
+      # the record says was installed (no sha recorded: unknown, so it counts
+      # as edited) nor the incoming source's, at any depth (kept as
+      # <label>/<its path in dir>). A link (a dev install's) points at its
+      # source, which nothing here touches; a linked dir isn't followed.
       # @param recorded [Hash, nil] path in dir => its recorded sha256
       # @param incoming [Hash] path in dir => the source replacing it
       def copy_edits(dir, label, recorded = nil, incoming = {})
         self.class.edited_in(dir, recorded, incoming).each { |file| copy(File.join(dir, file), as: "#{label}/#{file}") }
       end
 
-      # Whether #copy_edit would copy the file at +path+ (read-only): the rule
+      # Whether #copy_edits would copy the file at +path+ (read-only): the rule
       # ShippedUpdate's plan names its replaced files by.
       def self.edit?(path, recorded: nil, incoming: nil)
         return false if File.symlink?(path) || !File.file?(path)

data/lib/samagotchi/memory_orphans.rb

@@ -19,14 +19,14 @@ module Samagotchi
 
     module_function
 
-    # The orphan candidates for +cwd+'s project, or nil: only inside a git
-    # repository (outside one the root is cwd, and every src/ or tmp/ would
-    # match), and only while the computed folder holds no *.md (a
+    # The orphan candidates for +cwd+'s project, or nil: only inside a
+    # project, a git repository or a marked folder (outside both the root is
+    # cwd, and every src/ or tmp/ would match), and only while the computed folder holds no *.md (a
     # memory_write's mkdir_p or a project-scope bundle install alone must
     # not silence it).
     # @return [Found, nil]
     def find(env: ENV, cwd: Dir.pwd)
-      return nil unless MemoryPaths.in_repo?(cwd)
+      return nil unless MemoryPaths.in_project?(cwd)
 
       projects = MemoryPaths.projects_dir(env: env)
       computed = MemoryPaths.project_dir(env: env, cwd: cwd)

data/lib/samagotchi/memory_paths.rb

@@ -2,6 +2,7 @@
 
 require "digest"
 require_relative "config"
+require_relative "guardrails/path_resolve"
 
 module Samagotchi
   # Where memories live: <config dir>/memories, i.e. $XDG_CONFIG_HOME/samagotchi/memories
@@ -9,11 +10,61 @@ module Samagotchi
   # ConfigFile.global_path, so an XDG_CONFIG_HOME set after load (specs, smoke runs,
   # a fixture chi) moves memories together with config.yml.
   #
-  # Project memories are keyed by the project root (see project_root), so every
-  # worktree and subdirectory of one git repository shares one folder.
+  # Project memories are keyed by the project root (see #lookup): one folder
+  # per project root, a git repository (every worktree and subdirectory of it
+  # shares one folder) or a folder marked by `chi project init` (and its
+  # subfolders).
   module MemoryPaths
+    # The file that makes a folder in no git repository a chi project
+    # (`chi project init`). The file, not the bare .chi/ dir, is the marker.
+    MARKER = File.join(".chi", "project.yml").freeze
+
+    # How a folder's project was found (#lookup): +kind+ is :git, :marker or
+    # :none; +root+ is what memories are keyed on (#project_root: git's
+    # common-dir checkout, the marked folder's realpath, or the folder
+    # itself); +top+ is the folder a session reads its AGENTS.md chain from
+    # (the work tree's top, the marked root; nil for :none).
+    ProjectLookup = Data.define(:kind, :root, :top) do
+      def project? = kind != :none
+      def git? = kind == :git
+      def marker? = kind == :marker
+    end
+
     module_function
 
+    # The project +cwd+ belongs to, looked up once: a .git above it wins
+    # (git is the identity wherever it exists); only when there is none, the
+    # nearest MARKER above it, ignoring one in $HOME or any folder above it
+    # (and /), so a marker in ~ never makes every folder under home one
+    # project. The marker walk starts from +cwd+'s real path and the marked
+    # root is a realpath, as git's root is, so every spelling of a folder
+    # (/tmp, /var on macOS, a symlink into or out of a marked tree) gets the
+    # answer the worker's physical Dir.pwd gets.
+    # @param home [String, nil] $HOME by default; nil or blank ignores only /
+    # @return [ProjectLookup]
+    def lookup(cwd = Dir.pwd, home: default_home)
+      dot_git = find_dot_git(cwd)
+      return ProjectLookup.new(kind: :git, root: git_root(dot_git), top: File.dirname(dot_git)) if dot_git
+
+      marked = nearest_marker(cwd, home: home)
+      return ProjectLookup.new(kind: :marker, root: marked, top: marked) if marked
+
+      ProjectLookup.new(kind: :none, root: cwd, top: nil)
+    end
+
+    # Whether a marker at +dir+ is ignored: +dir+ is / or holds $HOME (both
+    # resolved; Guardrails::PathResolve.home_root?).
+    def above_home?(dir, home: default_home)
+      Guardrails::PathResolve.real(dir) == "/" || Guardrails::PathResolve.home_root?(dir, home)
+    end
+
+    # $HOME, or nil when it can't be found (no HOME, no passwd entry).
+    def default_home
+      Dir.home
+    rescue ArgumentError
+      nil
+    end
+
     def system_dir(env: ENV)
       File.join(ConfigFile.config_dir(env: env), "memories")
     end
@@ -28,16 +79,31 @@ module Samagotchi
     # #project_key for a root already resolved (a session's project_root).
     def key_for_root(root) = "#{File.basename(root)}_#{Digest::MD5.hexdigest(root)[0..7]}"
 
-    # The repository's common git directory identifies the project; every linked
-    # worktree shares it. Returns the checkout holding it when it is named .git,
-    # otherwise the git dir itself (a bare repo, a proj/.bare layout,
-    # --separate-git-dir, a submodule's .git/modules/<name>), so for those layouts
-    # the "project root" is a git dir, not a checkout. Outside any repository the
-    # root is cwd. No git subprocess: at most two small files are read.
-    def project_root(cwd = Dir.pwd)
-      dot_git = find_dot_git(cwd)
-      return cwd unless dot_git
+    # The project root (#lookup): in a repository, its common git directory
+    # identifies the project; every linked worktree shares it. Returns the
+    # checkout holding it when it is named .git, otherwise the git dir itself
+    # (a bare repo, a proj/.bare layout, --separate-git-dir, a submodule's
+    # .git/modules/<name>), so for those layouts the "project root" is a git
+    # dir, not a checkout. Outside any repository, the marked folder holding
+    # +cwd+, else cwd. No git subprocess: at most two small files are read.
+    def project_root(cwd = Dir.pwd) = lookup(cwd).root
+
+    # Is +cwd+ in a project: a git repository or a marked folder?
+    def in_project?(cwd = Dir.pwd) = lookup(cwd).project?
+
+    # The marked folder (realpath) +cwd+'s project is, or nil (in a git
+    # repository, or in no project).
+    def marked_root(cwd = Dir.pwd)
+      found = lookup(cwd)
+      found.marker? ? found.root : nil
+    end
+
+    # The top of +cwd+'s project: the git work tree's top (#work_tree_root) or
+    # the marked root; nil in no project.
+    def project_top(cwd = Dir.pwd) = lookup(cwd).top
 
+    # The project root of the checkout whose .git is +dot_git+ (#project_root).
+    def git_root(dot_git)
       holder = File.dirname(dot_git)
       gitdir = File.directory?(dot_git) ? dot_git : gitdir_from_file(dot_git)
       return holder unless gitdir
@@ -78,7 +144,8 @@ module Samagotchi
       File.directory?(dot_git) ? dot_git : gitdir_from_file(dot_git)
     end
 
-    # Is +cwd+ inside a git repository (a .git somewhere above it)?
+    # Is +cwd+ inside a git repository (a .git somewhere above it)? Git only:
+    # a marked folder is not a repository (#in_project?).
     def in_repo?(cwd = Dir.pwd)
       !find_dot_git(cwd).nil?
     end
@@ -96,6 +163,28 @@ module Samagotchi
       end
     end
 
+    # The realpath of the nearest folder at or above +start+ holding MARKER,
+    # git or not (#lookup asks only outside a repository; `chi project` tells
+    # of one a repository makes ignored), or nil. A marker at or above +home+
+    # (#above_home?) ends the walk with nil: every folder above it is above
+    # home too.
+    def nearest_marker(start, home: default_home)
+      dir = Guardrails::PathResolve.real(start)
+      loop do
+        if File.file?(File.join(dir, MARKER))
+          return nil if above_home?(dir, home: home)
+
+          return File.realpath(dir)
+        end
+        parent = File.dirname(dir)
+        return nil if parent == dir
+
+        dir = parent
+      end
+    rescue SystemCallError
+      nil
+    end
+
     # A ".git" file holds "gitdir: <path>", relative to the file's directory.
     def gitdir_from_file(path)
       line = File.read(path, 4096).to_s[/\Agitdir:\s*(.+)$/, 1]&.strip
@@ -115,7 +204,7 @@ module Samagotchi
     rescue SystemCallError
       gitdir
     end
-    private_class_method :find_dot_git, :gitdir_from_file, :common_dir
+    private_class_method :find_dot_git, :git_root, :gitdir_from_file, :common_dir
 
     def project_dir(env: ENV, cwd: Dir.pwd)
       File.join(projects_dir(env: env), project_key(cwd))

data/lib/samagotchi/plugin/api.rb

@@ -32,10 +32,7 @@ module Samagotchi
       # plugin writes it (ApiCalls#keywords: `ctx.sessions.send(…,
       # delivery:)` is seen, a `sessions = ctx.sessions` alias isn't).
       # Events aren't listed: chi.on takes any symbol and an older chi never
-      # fires one it doesn't know (harmless; chi bundle check warns on it),
-      # and a manifest hook's events: list (BundleHook) needs the bundle's
-      # requires_chi set by hand (docs/hooks.md, Bundle Hooks): no source
-      # scan covers manifest.yml.
+      # fires one it doesn't know (harmless; chi bundle check warns on it).
       SINCE = {
         "ctx.steer" => "0.3.0", "ctx.stop_turn" => "0.3.0", "ctx.stop_generation" => "0.6.0",
         "Samagotchi::AtomicFile" => "0.8.0", "ctx.model" => "0.17.0", "ctx.model_key" => "0.17.0",

data/lib/samagotchi/plugin/loader.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require_relative "api"
 require_relative "context"
 require_relative "../hooks"
@@ -10,6 +11,11 @@ require_relative "../memory_bundle/manifest"
 require_relative "../memory_bundle/provenance"
 
 module Samagotchi
+  # Where installed bundles' plugin code is evaluated: one module per
+  # bundle (Plugin::Loader.namespace_for), so two bundles defining the same
+  # class name can't collide on a top-level constant.
+  module Bundles; end
+
   module Plugin
     # What a plugin registers into: an Engine's own registries.
     # +context_for+ is (bundle_name, settings, label) → the Plugin::Context
@@ -36,7 +42,7 @@ module Samagotchi
     #
     # For each bundle, by name: the file must match the sha256 recorded at
     # install and chi must meet the bundle's requires_chi. The file is
-    # module_eval'd into the bundle's namespace (as its hooks are), the
+    # module_eval'd into the bundle's namespace (#namespace_for), the
     # class named like the file (plugin.rb → Plugin) is built with the
     # bundle's settings, and its #register gets a Plugin::Api. What it
     # registered takes effect only when #register returns: a plugin that
@@ -140,14 +146,45 @@ module Samagotchi
         return failure if failure
         return "the file is missing" unless file && File.file?(file)
 
-        Hooks::BundleLoader.sha_mismatch(file, bundle.plugin.sha256, required: true)
+        sha_mismatch(file, bundle.plugin.sha256)
+      end
+
+      # Why +file+ doesn't match the sha256 recorded at install (+recorded+,
+      # "sha256:<hex>" or bare hex), or nil. None recorded is a mismatch;
+      # Provenance.unchecked? (a dev install) is none.
+      def sha_mismatch(file, recorded)
+        return nil if MemoryBundle::Provenance.unchecked?(recorded)
+
+        expected = MemoryBundle::Provenance.recorded_sha(recorded)
+        return "no sha256 recorded for it (reinstall the bundle)" if expected.empty?
+
+        actual = MemoryBundle::Provenance.file_sha(file)
+        return nil if actual == expected
+
+        "its sha256 #{actual[0, 12]}… differs from the installed #{expected[0, 12]}… (edited after install? reinstall the bundle)"
+      end
+
+      # The (lazily created) namespace module for a bundle, under
+      # Samagotchi::Bundles. The name is sanitized and made injective by a
+      # short digest, so `my-bundle` and `my_bundle` don't collide.
+      def namespace_for(bundle_name)
+        raw = bundle_name.to_s
+        base = raw.gsub(/[^A-Za-z0-9_]/, "_")
+        base = "B_#{base}" unless base.match?(/\A[A-Z]/)
+        ns_name = :"#{base}_#{Digest::MD5.hexdigest(raw)[0, 4]}"
+        if Samagotchi::Bundles.const_defined?(ns_name, false)
+          Samagotchi::Bundles.const_get(ns_name)
+        else
+          Samagotchi::Bundles.const_set(ns_name, Module.new)
+        end
       end
 
       # module_eval the file into a fresh module in the bundle's namespace
       # (Samagotchi::Bundles::<bundle>::PluginLoad<n>: each load gets new
       # classes, not the last load's reopened) and build its class
-      # (plugin.rb → Plugin; my_plugin.rb → MyPlugin) as hooks are built:
-      # an initialize that takes an argument gets the settings.
+      # (plugin.rb → Plugin; my_plugin.rb → MyPlugin) as config hooks are
+      # built (Hooks.build_plugin): an initialize that takes an argument
+      # gets the settings.
       def instantiate(bundle_name, file, settings, namespace: nil)
         namespace ||= fresh_namespace(bundle_name)
         namespace.module_eval(File.read(file), file, 1)
@@ -163,7 +200,7 @@ module Samagotchi
       def fresh_namespace(bundle_name)
         LOADS.synchronize do
           @loads = (@loads || 0) + 1
-          Hooks::BundleLoader.namespace_for(bundle_name).const_set(:"PluginLoad#{@loads}", Module.new)
+          namespace_for(bundle_name).const_set(:"PluginLoad#{@loads}", Module.new)
         end
       end