samagotchi 0.159.0 → 0.160.0

data/lib/samagotchi/context_candidate_choice.rb

@@ -56,11 +56,12 @@ module Samagotchi
     # @param show_card [#call] (**card) → shows it; false/nil: it wasn't
     #   shown (the UI is on another session), so no carded line
     # @return [Symbol, nil] :attached, :carded or nil
-    def after_judged(job:, fields:, settings:, project_root:, state_dir:, log:, show_card:)
+    def after_judged(job:, fields:, settings:, project_root:, state_dir:, log:, show_card:, project_id: nil)
       return nil unless settings.mode == "on" && fields && fields["stated"]
       return nil unless %w[attach offer].include?(fields["would"])
 
-      candidate = proposed(job.session_id, job.name, project_root: project_root, state_dir: state_dir) or return nil
+      candidate = proposed(job.session_id, job.name, project_root: project_root, project_id: project_id,
+                                                     state_dir: state_dir) or return nil
       if fields["would"] == "attach"
         judge_attach(candidate, job: job, p: fields["p"], state_dir: state_dir, log: log, show_card: show_card)
       else
@@ -72,8 +73,9 @@ module Samagotchi
     end
 
     # The candidate +name+ when it is still proposed in the session.
-    def proposed(session_id, name, project_root:, state_dir:)
-      rows = ContextCandidates.with_status(session_id, project_root: project_root, state_dir: state_dir)
+    def proposed(session_id, name, project_root:, state_dir:, project_id: nil)
+      rows = ContextCandidates.with_status(session_id, project_root: project_root, project_id: project_id,
+                                                       state_dir: state_dir)
       rows.find { |candidate, status| candidate.name == name && status == "proposed" }&.first
     end
 
@@ -128,7 +130,8 @@ module Samagotchi
     end
 
     def find(session, name, state_dir:)
-      ContextCandidates.with_status(session.id, project_root: session.project_root, state_dir: state_dir)
+      ContextCandidates.with_status(session.id, project_root: session.project_root, project_id: session.project_id,
+                                                state_dir: state_dir)
                        .find { |candidate, _status| candidate.name == name }
     end
 

data/lib/samagotchi/context_candidates.rb

@@ -58,18 +58,19 @@ module Samagotchi
 
     # The session's candidates with their status, by name.
     # @return [Array<Array(ContextSources::Candidate, String)>]
-    def with_status(session_id, project_root:, state_dir: nil)
+    def with_status(session_id, project_root:, project_id: nil, state_dir: nil)
       own = ContextSources.session_location(session_id, state_dir: state_dir)
       candidates = own.candidates
       return [] if candidates.empty?
 
-      attached = ContextSources.attached(session_id, project_root: project_root, state_dir: state_dir, shadowed: true)
+      attached = ContextSources.attached(session_id, project_root: project_root, project_id: project_id, state_dir: state_dir,
+                                                     shadowed: true)
       candidates.map { |candidate| [candidate, status(candidate, own: own, attached: attached)] }
     end
 
     # The candidates section of /context, nil for none.
-    def listing(session_id, project_root:, state_dir: nil)
-      rows = with_status(session_id, project_root: project_root, state_dir: state_dir)
+    def listing(session_id, project_root:, project_id: nil, state_dir: nil)
+      rows = with_status(session_id, project_root: project_root, project_id: project_id, state_dir: state_dir)
       return nil if rows.empty?
 
       lines = rows.map { |candidate, state| "- #{candidate.name} · #{state} · #{candidate.title}" }
@@ -171,8 +172,8 @@ module Samagotchi
     end
 
     # The proposed candidates (no source of theirs attached, not declined).
-    def proposed(session_id, project_root:, state_dir: nil)
-      with_status(session_id, project_root: project_root, state_dir: state_dir)
+    def proposed(session_id, project_root:, project_id: nil, state_dir: nil)
+      with_status(session_id, project_root: project_root, project_id: project_id, state_dir: state_dir)
         .filter_map { |candidate, state| candidate if state == "proposed" }
     end
 
@@ -194,7 +195,8 @@ module Samagotchi
       # The earlier owner prompts too: a proposal that came while one ran
       # (a one-shot's plugins never see a running turn's prompt).
       texts = owner_texts(session.messages) + (prompt.is_a?(String) ? [prompt] : [])
-      found = hits(texts, proposed(session.id, project_root: session.project_root, state_dir: state_dir))
+      found = hits(texts, proposed(session.id, project_root: session.project_root, project_id: session.project_id,
+                                       state_dir: state_dir))
       names = found.filter_map { |hit| attach(hit, own: own, state_dir: state_dir) }
       first_fetch(own, unfetched(own, names), cwd: session.working_directory, seconds: seconds, cancelled: cancelled)
       names
@@ -213,7 +215,8 @@ module Samagotchi
       names = own.candidates.map(&:name)
       return 0 if names.empty?
 
-      absorber = ContextAbsorber.new(session_id: session.id, state_dir: state_dir, project_root: session.project_root)
+      absorber = ContextAbsorber.new(session_id: session.id, state_dir: state_dir, project_root: session.project_root,
+                                     project_id: session.project_id)
       batch = absorber.pending or return 0
       picked = batch.deliveries.select { |delivery| names.include?(delivery.name) }
       picked.each { |delivery| engine.add_context_note(session, delivery.note) if delivery.note }

data/lib/samagotchi/context_command.rb

@@ -80,7 +80,12 @@ module Samagotchi
     # Where a command acts: a session (its own sources, then its project's)
     # or a project's sources. +label+ names it in the output, +cwd+ is
     # where its session's sources run (ContextPoller's choice).
-    Target = Data.define(:session_id, :project_root, :cwd, :label) do
+    # +project_id+ is the project's id (Session#project_id, a marked
+    # project's ProjectLookup#id): with +project_root+ it keys the project's
+    # sources (MemoryPaths.key_for).
+    Target = Data.define(:session_id, :project_root, :cwd, :label, :project_id) do
+      def initialize(session_id:, project_root:, cwd:, label:, project_id: nil) = super
+
       def project? = session_id.nil?
     end
 
@@ -421,14 +426,15 @@ module Samagotchi
       root = found.root
       # Its sources run in the root, or in this checkout when the root is a
       # git dir (ContextSources.project_cwd).
-      Target.new(session_id: nil, project_root: root, cwd: found.top || @cwd,
+      Target.new(session_id: nil, project_root: root, project_id: found.id, cwd: found.top || @cwd,
                  label: "project #{File.basename(root)}")
     end
 
     def session_target(given)
       id = @access.resolve_id(given)
       session = @access.show(id)
-      Target.new(session_id: id, project_root: session.project_root, cwd: session.working_directory, label: id[0, 8])
+      Target.new(session_id: id, project_root: session.project_root, project_id: session.project_id,
+                 cwd: session.working_directory, label: id[0, 8])
     rescue ArgumentError => e
       error_line("#{command_name}: #{e.message}")
       nil

data/lib/samagotchi/context_poller.rb

@@ -23,12 +23,14 @@ module Samagotchi
     TICK_SECONDS = 5
 
     # @param project_root [String, nil] Session#project_root
+    # @param project_id [String, nil] Session#project_id
     # @param cwd [String] the session's folder (a session source runs there)
     # @param on_change [#call] after a fetch brought a new text or failed
-    def initialize(session_id:, state_dir:, project_root:, cwd:, on_change:, tick: TICK_SECONDS)
+    def initialize(session_id:, state_dir:, project_root:, cwd:, on_change:, project_id: nil, tick: TICK_SECONDS)
       @session_id = session_id
       @state_dir = state_dir
       @project_root = project_root
+      @project_id = project_id
       @cwd = cwd
       @on_change = on_change
       @tick = tick
@@ -56,7 +58,8 @@ module Samagotchi
     # One pass (the thread's loop body; specs call it).
     # @param first [Boolean] the worker's first pass
     def poll(first: false)
-      ContextSources.attached(@session_id, project_root: @project_root, state_dir: @state_dir).each do |attached|
+      ContextSources.attached(@session_id, project_root: @project_root, project_id: @project_id,
+                                          state_dir: @state_dir).each do |attached|
         break if @stopping
         next if attached.source.push? || @own.muted?(attached.name)
 

data/lib/samagotchi/context_sources.rb

@@ -634,19 +634,21 @@ module Samagotchi
 
     # The project a session's sources come from: nil when it is in no repo.
     # @param project_root [String, nil] Session#project_root
-    def project_location_for(project_root, state_dir: nil)
+    # @param project_id [String, nil] Session#project_id (a marked project's
+    #   id keys its folder: MemoryPaths.key_for)
+    def project_location_for(project_root, project_id: nil, state_dir: nil)
       return nil if project_root.to_s.empty?
 
-      project_location(MemoryPaths.key_for_root(project_root), state_dir: state_dir)
+      project_location(MemoryPaths.key_for(root: project_root, id: project_id), state_dir: state_dir)
     end
 
     # A session's sources: its own, then the project's it doesn't shadow
     # (+shadowed+ lists those too, marked).
     # @return [Array<Attached>]
-    def attached(session_id, project_root:, state_dir: nil, shadowed: false)
+    def attached(session_id, project_root:, project_id: nil, state_dir: nil, shadowed: false)
       own = session_location(session_id, state_dir: state_dir)
       list = own.sources.map { |source| Attached.new(source: source, location: own, shadowed: false) }
-      project = project_location_for(project_root, state_dir: state_dir)
+      project = project_location_for(project_root, project_id: project_id, state_dir: state_dir)
       return list unless project
 
       names = list.map(&:name)

data/lib/samagotchi/engine/events.rb

@@ -79,8 +79,7 @@ module Samagotchi
           announce({ type: :guardrail_warning, message: message }) if message
           plugins = @plugin_failures.message
           announce({ type: :guardrail_warning, message: plugins, label: "plugins" }) if plugins
-          memory = MemoryOrphans.message
-          announce({ type: :guardrail_warning, message: memory, label: "memory" }) if memory
+          memory_load_warnings.each { |event| announce(event) }
           @extension_load.held_events.each do |event|
             announce(event[:type] == :card ? event.merge(in_turn: false) : event.merge(between_turns: true))
           end
@@ -88,6 +87,18 @@ module Samagotchi
         nil
       end
 
+      # The session-start memory warnings (label "memory"), for both load
+      # announcements (a worker's, a one-shot's first turn): an orphaned
+      # project memory folder (MemoryOrphans), a copied project sharing its
+      # id (ProjectIdClash, which also claims the id folder for this root).
+      # @return [Array<Hash>] the :guardrail_warning events
+      def memory_load_warnings
+        [MemoryOrphans.message, ProjectIdClash.check&.message].compact.map do |message|
+          { type: :guardrail_warning, message: message, label: "memory" }
+        end
+      end
+      private :memory_load_warnings
+
       # Run the block holding back the cards and between-turns notices it
       # announces on this thread, so the caller announces them after its own
       # event (a worker's command: its command_ran first, so a UI prints the

data/lib/samagotchi/engine/guardrails.rb

@@ -46,8 +46,8 @@ module Samagotchi
 
       # Once per Engine, on its first turn: what failed to load, so every UI
       # (the attached TUI, the web, a one-shot's stderr) shows it: the guardrails, then the plugins
-      # (label: "plugins"; the UIs say guardrails without one), an orphaned
-      # project memory folder (label: "memory"), then the notices and cards plugins showed as they loaded.
+      # (label: "plugins"; the UIs say guardrails without one), the memory
+      # warnings (label: "memory": #memory_load_warnings), then the notices and cards plugins showed as they loaded.
       def announce_guardrail_failures(on_event)
         return if @guardrail_failures_announced
 
@@ -56,8 +56,7 @@ module Samagotchi
         emit_event(on_event, { type: :guardrail_warning, message: message }) if message
         plugins = @plugin_failures.message
         emit_event(on_event, { type: :guardrail_warning, message: plugins, label: "plugins" }) if plugins
-        memory = MemoryOrphans.message
-        emit_event(on_event, { type: :guardrail_warning, message: memory, label: "memory" }) if memory
+        memory_load_warnings.each { |event| emit_event(on_event, event) }
         @extension_load.held_events.each { |event| emit_event(on_event, event) }
       end
       private :announce_guardrail_failures

data/lib/samagotchi/engine.rb

@@ -83,6 +83,7 @@ require_relative "guardrails"
 require_relative "reminder_store"
 require_relative "reminder_queue"
 require_relative "memory_orphans"
+require_relative "project_id_clash"
 require_relative "tools/memory"
 require_relative "muted_memories"
 require_relative "used_memories"

data/lib/samagotchi/engine_peers.rb

@@ -17,6 +17,7 @@ module Samagotchi
       def session_id = engine.session&.id
       def cwd = engine.session&.working_directory
       def project_root = engine.session&.project_root
+      def project_id = engine.session&.project_id
       def state_dir = engine.peer_state_dir
       def cancelled? = !!engine.active_cancel_controller&.cancelled?
       def cancel_reason = engine.active_cancel_controller&.reason

data/lib/samagotchi/events.rb

@@ -22,6 +22,77 @@ module Samagotchi
     STREAM_FRAMES = %i[snapshot reset stream_closed].freeze
     SYNTHETIC = %i[merged_input].freeze
 
+    # The client-facing lifetime of each event. Rows are drawn in the
+    # conversation and survive reload; state updates the live UI; transient
+    # is live-only; internal is not sent to clients.
+    CLASSIFICATION = {
+      after_generation: :internal,
+      after_tool_call: :internal,
+      after_turn: :internal,
+      answer_display: :state,
+      before_generation: :internal,
+      before_tool_call: :internal,
+      before_turn: :internal,
+      card: :row,
+      command_queued: :state,
+      command_ran: :state,
+      context_added: :row, # Reloaded from the session messages, not a turn fold or card store.
+      context_status: :state,
+      continue_offered: :state,
+      continue_resolved: :state,
+      empty_answer_retry: :row,
+      generation_cancelled: :state,
+      generation_chunk: :transient,
+      generation_completed: :state,
+      generation_progress: :internal,
+      generation_retrying: :state, # Updates live retry status; a restart also removes invalidated chunks.
+      generation_started: :state,
+      guardrail_warning: :state, # Worker startup state; not a persistent conversation notice.
+      hook_notice: :row,
+      input_merged: :state,
+      llm_context_edited: :row,
+      merged_input: :row,
+      objectives_updated: :state,
+      participants_changed: :state,
+      pending_input_merged: :row,
+      plugin_init_finished: :state,
+      plugin_init_started: :state,
+      plugin_init_wait: :state,
+      prompt_restored: :state,
+      question_answered: :state,
+      question_cancelled: :state,
+      question_relay: :state,
+      question_requested: :state,
+      reasoning_history_refused: :internal,
+      recap_ready: :state,
+      reminder_injected: :row,
+      reset: :state,
+      sampling_refused: :internal,
+      session_end: :internal,
+      session_start: :internal,
+      side_usage: :state,
+      steer_cut: :row,
+      stream_closed: :state,
+      stream_resumed: :transient,
+      stream_retrying: :transient,
+      thinking_dropped: :transient,
+      thinking_refused: :internal,
+      tool_call_completed: :row,
+      tool_call_started: :row,
+      tool_dispatch_completed: :state,
+      tool_dispatch_started: :state,
+      turn_canceled: :row,
+      turn_completed: :row,
+      turn_dequeued: :state,
+      turn_enqueued: :state,
+      turn_failed: :row,
+      turn_started: :row,
+      used_memories_updated: :state,
+      verdict_recorded: :state,
+      worker_changed: :state,
+      working_set_updated: :state
+    }.freeze
+
     # Whether +event+ ends a turn that stays in the conversation: completed,
     # canceled, or failed with its work kept (turn_failed's kept_steps).
     def self.kept_turn?(event)

data/lib/samagotchi/guardrails/approvals.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require "json"
 require "fileutils"
 require "time"
@@ -13,7 +14,9 @@ module Samagotchi
     # written aside and renamed under an exclusive flock (several chi
     # processes share it). An entry relaxes an ask, never a deny:
     #   session — this exact call (tool + normalized command / paths) in
-    #             this session;
+    #             this session; a command's in its place too (the
+    #             worktree or folder it ran in, and a digest of its env:),
+    #             since the same text acts on whatever they point at;
     #   repo    — this exact call in this repo (the cwd outside a repo);
     #   rule    — anything this rule (from this source) asks about here.
     # "This repo" is the repository (repo: its common git dir), so an
@@ -74,11 +77,14 @@ module Samagotchi
         here = ->(e) { e["repo"] ? e["repo"] == repo : e["repo_root"] == place }
         session_id = verdict.context&.session_id
         session_only = SESSION_ONLY_RULES.include?(verdict.rule.to_s)
+        command_place = session_place(verdict)
         list.find do |e|
           next false if session_only && e["scope"] != "session"
 
           case e["scope"]
-          when "session" then session_id && e["session_id"] == session_id && e["key"] == key
+          when "session"
+            session_id && e["session_id"] == session_id && e["key"] == key &&
+              (command_place.nil? || e.slice("repo_root", "env") == command_place)
           when "repo" then here.call(e) && e["key"] == key
           when "rule"
             # One rule's grant can't answer for a second rule's ask on the call.
@@ -94,7 +100,9 @@ module Samagotchi
         entry = { "scope" => scope, "tool" => verdict.targets&.tool || verdict.call[:name].to_s,
                   "acts_as" => verdict.targets&.acts_as, "rule" => verdict.rule, "source" => verdict.source, "created_at" => Time.now.utc.iso8601 }
         case scope
-        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+        when "session"
+          entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+          entry.merge!(session_place(verdict) || {})
         when "repo"
           entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo, "key" => key_for(verdict))
         when "rule" then entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo)
@@ -131,6 +139,22 @@ module Samagotchi
         t&.repo_root || t&.cwd || verdict.context&.cwd
       end
 
+      # Where a session entry of a command holds: the call's worktree root
+      # (or folder: #place_for; never the common git dir, which every
+      # worktree shares) and, when it sets one, a sha256 of its env: (never
+      # the env: it may hold a secret). nil for a call with no command:
+      # its paths are its place. An entry without them (stored before) no
+      # longer matches: one more ask.
+      # @return [Hash, nil]
+      def self.session_place(verdict)
+        t = verdict.targets
+        return nil unless t&.command
+
+        env = t.env.to_h
+        digest = env.empty? ? nil : Digest::SHA256.hexdigest(JSON.generate(env.map { |k, v| [k.to_s, v.to_s] }.sort))
+        { "repo_root" => place_for(verdict), "env" => digest }.compact
+      end
+
       private
 
       # @param locked [Boolean] the caller holds the store's lock

data/lib/samagotchi/hook_routes.rb

@@ -24,7 +24,6 @@ module Samagotchi
     # (a chi.on handler :log, or :deny for an on_error: :fail_closed one).
     HOOK_FAILURE_EFFECTS = {
       log: "it's skipped, and only the log has its next failures",
-      skip: "it's skipped, and its next failures are silent",
       deny: "it denies every tool call it guards, and its next failures are in each denial's reason"
     }.freeze
 

data/lib/samagotchi/memory_bundle/asset_installer.rb

@@ -115,7 +115,11 @@ module Samagotchi
         files.each do |file|
           @results["hooks/#{file}"] = @dry_run ? retired.with(word: :would_remove) : retired
         end
-        return if @dry_run
+        if @dry_run
+          edits = Trash.edits(dir, "hooks", @existing&.hooks&.transform_values(&:sha256))
+          @warnings << "Would copy to the trash first: #{edits.join(", ")}" unless edits.empty?
+          return
+        end
 
         @trash.copy_edits(dir, "hooks", @existing&.hooks&.transform_values(&:sha256))
         FileUtils.rm_rf(dir)
@@ -162,9 +166,9 @@ module Samagotchi
       # (FileActions' ASSET_INSTALL, or ASSET_UPGRADE over an installed
       # bundle), one result per incoming file (a dry run's DRY_WORDS of it,
       # and nothing written), an edit copied to the trash first (save_first),
-      # then the folder replaced. A file the source dropped goes without a
-      # word. A plugin or script whose sha256 differs from the declared one
-      # warns (not a dev link: it is the source).
+      #   then the folder replaced. A removed file is named in the summary.
+      #   A plugin or script whose sha256 differs from the declared one warns
+      #   (not a dev link: it is the source).
       # @param incoming [Hash{String => String}] name => the source file, in
       #   the order the results list them
       # @return [Hash{String => String}] name => installed path ({} on a dry run)
@@ -173,21 +177,36 @@ module Samagotchi
         command = @upgrade && @provenance.installed? ? :upgrade : :install
         states = AssetState.in(dir, kind_of_file: kind_of_file, recorded: recorded, incoming: incoming)
                            .to_h { |asset| [asset.name, [asset, FileActions.for_asset(command, asset)]] }
+        if @dry_run
+          copies = states.filter_map { |_, (asset, action)| asset.label if action&.save_first }
+          @warnings << "Would copy to the trash first: #{copies.join(", ")}" unless copies.empty?
+        end
         results = incoming.keys.to_h do |name|
           asset, action = states.fetch(name)
           [name, Installer::FileResult.new(word: @dry_run ? DRY_WORDS.fetch(action.word) : action.word, state: asset, action: action)]
         end
+        dropped = states.filter_map do |name, (asset, action)|
+          next unless action&.do == :remove
+
+          [result_key(kind_of_file, name),
+           Installer::FileResult.new(word: @dry_run ? :would_remove : :removed, state: asset, action: action,
+                                     note: "no longer in the bundle")]
+        end
         if @dry_run
           results.each { |name, result| @results[result_key(kind_of_file, name)] = result }
+          dropped.each { |key, result| @results[key] = result }
           return {}
         end
 
         states.each_value { |asset, action| @trash.copy(asset.path, as: asset.label) if action.save_first }
         FileUtils.rm_rf(dir)
-        return {} if incoming.empty?
+        if incoming.empty?
+          dropped.each { |key, result| @results[key] = result }
+          return {}
+        end
 
         FileUtils.mkdir_p(dir)
-        incoming.to_h do |name, src|
+        installed = incoming.to_h do |name, src|
           dest = File.join(dir, name)
           place(src, dest)
           @results[result_key(kind_of_file, name)] = results[name]
@@ -198,6 +217,8 @@ module Samagotchi
           end
           [name, dest]
         end
+        dropped.each { |key, result| @results[key] = result }
+        installed
       end
 
       # The kind's folder and the record's shas for it.

data/lib/samagotchi/memory_bundle/bundle_hook.rb

@@ -2,38 +2,18 @@
 
 module Samagotchi
   module MemoryBundle
-    # One class-file hook's metadata, as an older chi's installed record
-    # (manifest.json) keeps it (chi no longer installs or loads them:
-    # Manifest::HooksRetired; it reads them to retire, uninstall and name
-    # them, and the trash selection takes #sha256): the file's sha256
-    # ("sha256:<hex>", "" when none is recorded), the events it registers
-    # for (manifest `event:` for one, `events:` a list; none: it isn't
-    # loaded), on_error (skip, log or fail_closed) and priority. The one
-    # place the defaults live.
-    class BundleHook < Data.define(:sha256, :events, :on_error, :priority)
-      DEFAULT_ON_ERROR = "skip"
-      DEFAULT_PRIORITY = 100
+    # One class-file hook's sha256 in an older chi's installed record; its
+    # other fields are ignored now that class-file hooks are retired.
+    BundleHook = Data.define(:sha256) do
+      def initialize(sha256: "") = super
 
-      # @param event [String, nil] one event (manifest `event:`)
-      # @param events [Array<String>, String, nil] the events (manifest
-      #   `events:`); `event:` and `events:` together are joined, blanks
-      #   and repeats dropped
-      def initialize(sha256: "", event: nil, events: nil, on_error: DEFAULT_ON_ERROR, priority: DEFAULT_PRIORITY)
-        names = [*event, *events].map { |e| e.to_s.strip }.reject(&:empty?).uniq.freeze
-        super(sha256: sha256, events: names, on_error: on_error, priority: priority)
-      end
-
-      # @param raw [Hash, BundleHook, nil] string keys (manifest.yml) or
-      #   symbol keys (a read record); missing or blank values get the
-      #   defaults
+      # @param raw [Hash, BundleHook, nil] string or symbol keys; legacy
+      #   metadata beyond sha256 is ignored
       def self.parse(raw)
         return raw if raw.is_a?(BundleHook)
 
         h = raw.is_a?(Hash) ? raw.transform_keys(&:to_s) : {}
-        on_error = h["on_error"].to_s.strip
-        new(sha256: prefixed(h["sha256"]), event: h["event"], events: h["events"],
-            on_error: on_error.empty? ? DEFAULT_ON_ERROR : on_error,
-            priority: (h["priority"] || DEFAULT_PRIORITY).to_i)
+        new(sha256: prefixed(h["sha256"]))
       end
 
       # "sha256:<hex>" from either form, "" for none.

data/lib/samagotchi/memory_bundle/file_actions.rb

@@ -180,14 +180,13 @@ module Samagotchi
         %i[missing any] => ASSET_GONE
       }.freeze
 
-      # An upgrade (--force too) over the record: a file it replaces is
-      # updated, except a rule (an upgrade lists a replaced rule as installed:
-      # the corpus's rule-installed).
+      # An upgrade (--force too) over the record: a file it replaces is updated.
       ASSET_UPGRADE = ASSET_INSTALL.merge(
         %i[pristine any] => ASSET_WRITE.with(word: :updated),
         %i[edited any] => ASSET_WRITE.with(word: :updated, save_first: true),
         %i[linked any] => ASSET_WRITE.with(word: :updated),
-        %i[pristine rule] => ASSET_WRITE, %i[edited rule] => ASSET_WRITE.with(save_first: true),
+        %i[pristine rule] => ASSET_WRITE.with(word: :updated),
+        %i[edited rule] => ASSET_WRITE.with(word: :updated, save_first: true),
         %i[linked rule] => ASSET_WRITE
       ).freeze
 

data/lib/samagotchi/memory_bundle/installed_bundle.rb

@@ -26,7 +26,7 @@ module Samagotchi
     #               legacy_base: true on an older mark that has since got its incoming_sha (.legacy_mark?);
     #               why, missed, missed_places: FileStanding::Behind's, nil on an older mark;
     #               merged_version, merged_at, merged_trash: a merge no report has shown (Provenance#note_merged)
-    #   hooks       basename => BundleHook
+    #   hooks       basename => BundleHook (sha256; other legacy fields ignored)
     #   guardrails  basename => recorded sha256 ("" when none)
     #   scripts     file name => recorded sha256 ("" when none)
     #   plugin      PluginRef, nil without one

data/lib/samagotchi/memory_bundle/installer.rb

@@ -20,7 +20,7 @@ module Samagotchi
     # Installs a bundle into a scoped memories directory.
     #
     # Flow (#run):
-    #   1. Normalize source → directory, read manifest.yml (load_source)
+    #   1. Normalize source → directory, refuse retired hooks, read manifest.yml (load_source)
     #   2. Refuse a bundle whose requires_chi this chi doesn't meet,
     #      unless force (refuse_too_new)
     #   3. Copy .md files to the target scope dir and update index.md
@@ -356,7 +356,7 @@ module Samagotchi
         @bundle_dir = @source_dir = prepared.dir
         @source_owned = prepared.owned
         @source_commit = prepared.commit
-        refuse_hooks
+        Manifest::HooksRetired.refuse_source_files(@bundle_dir)
         @manifest = Manifest.read(dir: @bundle_dir)
         clash = @manifest.session_settings_clash
         raise InstallError, clash if clash
@@ -371,15 +371,6 @@ module Samagotchi
         @warnings << "No manifest found — proceeding without strict manifest validation"
       end
 
-      # A source that ships class-file hooks (hooks/*.rb, listed or not) is
-      # refused before its manifest is read; its manifest's hooks: is
-      # Manifest.read's refusal (Manifest::HooksRetired either way).
-      # @raise [Manifest::HooksRetired]
-      def refuse_hooks
-        files = Manifest::HooksRetired.files_in(@bundle_dir)
-        raise Manifest::HooksRetired.for_files(files) unless files.empty?
-      end
-
       # A bundle whose requires_chi this chi doesn't meet is not installed at
       # all: --force is what installs it, and its plugin and rules then
       # warn that they won't load (AssetInstaller). The words come from
@@ -557,6 +548,7 @@ module Samagotchi
       # cell's text merge runs on temp copies). --force would install every
       # file, unread.
       def preview_memory(file_key, state, action)
+        preview_trash_copy(file_key, state, action)
         return @results[file_key] = FileResult.new(word: :would_install, state: state, action: action) if @force
         return refuse_unreadable(file_key, state.paths[:current]) if action.do == :refuse
 
@@ -564,9 +556,20 @@ module Samagotchi
         action = decision.action if decision
         return note_conflict(file_key, decision.outcome, state) if action.behind?
 
+        preview_trash_copy(file_key, state, action)
         @results[file_key] = FileResult.new(word: DRY_WORDS.fetch(action.word), state: state, action: action)
       end
 
+      def preview_trash_copy(file_key, state, action)
+        return unless action.save_first
+
+        current = state.paths[:current]
+        incoming = state.paths[:incoming]
+        return unless File.file?(current) && !FileUtils.identical?(incoming, current)
+
+        @warnings << "Would copy to the trash first: #{file_key}"
+      end
+
       # Strict mode: a memory that takes the bundle's text (Action#takes_source?:
       # a new or missing file, --force, an upgrade's or a re-install's
       # fast-forward, a merge into a local edit) warns when the bundle's file

data/lib/samagotchi/memory_bundle/manifest.rb

@@ -83,6 +83,12 @@ module Samagotchi
 
         # The source's hooks/*.rb, relative and sorted ([] for none).
         def self.files_in(dir) = Dir.glob(File.join(dir, "hooks", "*.rb")).map { |f| "hooks/#{File.basename(f)}" }.sort
+
+        # Refuse a source's class-file hooks before parsing its manifest.
+        def self.refuse_source_files(dir)
+          files = files_in(dir)
+          raise for_files(files) unless files.empty?
+        end
       end
 
       # A plugin file is a plain .rb name in the bundle's top directory.