samagotchi 0.159.0 → 0.161.0

data/lib/samagotchi/memory_bundle/installer.rb

@@ -20,7 +20,7 @@ module Samagotchi
     # Installs a bundle into a scoped memories directory.
     #
     # Flow (#run):
-    #   1. Normalize source → directory, read manifest.yml (load_source)
+    #   1. Normalize source → directory, refuse retired hooks, read manifest.yml (load_source)
     #   2. Refuse a bundle whose requires_chi this chi doesn't meet,
     #      unless force (refuse_too_new)
     #   3. Copy .md files to the target scope dir and update index.md
@@ -61,7 +61,8 @@ module Samagotchi
       # chi_version: the chi this install is for (Profile and ShippedUpdate
       # check their bundles against a version they are given); default this chi.
       def initialize(source:, name:, scope: nil, force: false, strict: true, upgrade: false, dry_run: false, prepared: nil,
-                     shipped_dir: SourceNormalizer::SHIPPED_DIR, dev: false, chi_version: Samagotchi::VERSION)
+                     shipped_dir: SourceNormalizer::SHIPPED_DIR, dev: false, chi_version: Samagotchi::VERSION,
+                     refuse_mismatch: false)
         @source = source
         @shipped_dir = shipped_dir
         @prepared = prepared
@@ -73,6 +74,10 @@ module Samagotchi
         @dry_run = dry_run
         @dev = dev
         @chi_version = chi_version
+        # `chi bundle install/upgrade` refuses a file whose bytes disagree with
+        # its manifest sha before writing anything; the callers that only warn
+        # (ShippedUpdate, SystemBundle, Profile) leave it unset.
+        @refuse_mismatch = refuse_mismatch
         @results = {}
         @warnings = []
         @placeholder_warnings = []
@@ -119,10 +124,11 @@ module Samagotchi
       def run
         load_source
         refuse_too_new
+        @provenance = Provenance.new(name: @name)
+        refuse_newer_record_format
         warn_unknown_keys(@manifest) if @manifest
         @target_scope, @target_dir = resolve_target
         @file_descriptions = @manifest&.file_descriptions || {}
-        @provenance = Provenance.new(name: @name)
         @existing = @provenance.record
         check_source
         # A plain install over an installed bundle: its summary says so.
@@ -212,6 +218,18 @@ module Samagotchi
           "(to leave dev mode: chi bundle uninstall #{name}, then chi bundle install without --dev)"
       end
 
+      # The line a refused install names one file with: the checksum warning and
+      # the way past it. Only `chi bundle install/upgrade` refuses a mismatch
+      # (--force skips the early check and keeps the post-write warning); the
+      # callers that only warn (chi update, SystemBundle, a profile) never reach
+      # this.
+      # @param label [String] "a.md", "plugin plugin.rb", "script s.sh"
+      # @param upgrade [Boolean] which command the hint names
+      def self.mismatch_refusal(label, path, expected, upgrade:)
+        warning = FileDigest.mismatch(label, path, expected)
+        warning && "#{warning}; chi bundle #{upgrade ? "upgrade" : "install"} --force installs it anyway"
+      end
+
       private
 
       # The files whose result has one of +words+, in the order they ran.
@@ -233,28 +251,71 @@ module Samagotchi
         line
       end
 
-      # The steps that replace files: memories, the bundle's own folder, then
-      # the files it dropped. The record isn't written yet, so a failed run is
+      # The steps that replace files, after the check of the files the manifest
+      # names: memories, the bundle's own folder, then the files it dropped. The record isn't written yet, so a failed run is
       # retried as the same upgrade.
       # @return [AssetInstaller::Installed]
       # @raise [InstallError] a file system error (a file it can't read, a
       #   .trash it can't write)
       def replace_files
-        install_memories
-
-        installed = AssetInstaller.new(
+        assets = AssetInstaller.new(
           name: @name, source_dir: @bundle_dir, manifest: @manifest, provenance: @provenance, existing: @existing,
           results: @results, warnings: @warnings, conflicts: @conflicts, trash: @trash,
-          force: @force, strict: @strict, upgrade: @upgrade, dry_run: @dry_run, dev: @dev, chi_version: @chi_version
-        ).run
+          force: @force, strict: @strict, upgrade: @upgrade, dry_run: @dry_run, dev: @dev, chi_version: @chi_version,
+          refuse_mismatch: @refuse_mismatch
+        )
+        # Before the first write: a plugin or script the bundle lacks refuses the run with disk and record as they were.
+        assets.check_named_files
+        # And, for the commands that refuse it (--force aside), a file whose
+        # bytes disagree with the sha its manifest declares.
+        refuse_memory_mismatches
+        assets.check_named_checksums
+        write_pending
+        install_memories
+        installed = assets.run
 
         # Files the previous version shipped and this one doesn't.
-        prune_dropped_files(@existing.files, @bundle_md, @target_dir, @target_scope, @provenance) if @upgrade && @existing
+        previous_files = @provenance.files_with_pending(@existing, target_dir: @target_dir)
+        prune_dropped_files(previous_files, @bundle_md, @target_dir, @target_scope, @provenance) if @upgrade && @existing
         installed
       rescue SystemCallError => e
         raise InstallError, Trash.failure_message(e)
       end
 
+      # The intent journal (Provenance#write_pending): the text of each memory
+      # this run will change, noted before the first write, so a run that
+      # stops before its record leaves files a retry still knows as the
+      # bundle's.
+      def write_pending
+        return if @dry_run || @manifest.nil?
+
+        incoming = memory_files.to_h { |key| [key, FileDigest.hex(File.join(@bundle_dir, key))] }
+        incoming.reject! do |key, sha|
+          sha.nil? || sha == FileDigest.hex(File.join(@target_dir, key))
+        rescue SystemCallError
+          true
+        end
+        @provenance.write_pending(version: @manifest.version, scope: @target_scope, target_dir: @target_dir, files: incoming) unless incoming.empty?
+      rescue SystemCallError => e
+        raise InstallError, Trash.failure_message(e)
+      end
+
+      # Before the first write, the bundle's own bytes against the sha its
+      # manifest declares for each memory: `chi bundle install/upgrade` refuses
+      # a mismatch (--force skips the check, and #verify_memory_checksums keeps
+      # the post-write warning for the callers that only warn). A dev install
+      # follows its own tree; a non-strict run has no shas to trust.
+      # @raise [InstallError] one line per mismatched file
+      def refuse_memory_mismatches
+        return unless @refuse_mismatch && @strict && !@dev && !@force && @manifest
+
+        lines = memory_files.filter_map do |file_key|
+          self.class.mismatch_refusal(file_key, File.join(@bundle_dir, file_key),
+                                      @manifest.checksum_for(file_key), upgrade: @upgrade)
+        end
+        raise InstallError, lines.join("\n") unless lines.empty?
+      end
+
       # Who may install under this name (a manifest can take any name: a
       # repo calling itself guardrails). Sources compare by SourceIdentity
       # (a shipped dir by name, in any gem or checkout; a git URL without
@@ -356,7 +417,7 @@ module Samagotchi
         @bundle_dir = @source_dir = prepared.dir
         @source_owned = prepared.owned
         @source_commit = prepared.commit
-        refuse_hooks
+        Manifest::HooksRetired.refuse_source_files(@bundle_dir)
         @manifest = Manifest.read(dir: @bundle_dir)
         clash = @manifest.session_settings_clash
         raise InstallError, clash if clash
@@ -371,15 +432,6 @@ module Samagotchi
         @warnings << "No manifest found — proceeding without strict manifest validation"
       end
 
-      # A source that ships class-file hooks (hooks/*.rb, listed or not) is
-      # refused before its manifest is read; its manifest's hooks: is
-      # Manifest.read's refusal (Manifest::HooksRetired either way).
-      # @raise [Manifest::HooksRetired]
-      def refuse_hooks
-        files = Manifest::HooksRetired.files_in(@bundle_dir)
-        raise Manifest::HooksRetired.for_files(files) unless files.empty?
-      end
-
       # A bundle whose requires_chi this chi doesn't meet is not installed at
       # all: --force is what installs it, and its plugin and rules then
       # warn that they won't load (AssetInstaller). The words come from
@@ -393,6 +445,12 @@ module Samagotchi
         raise InstallError, "#{@name} can't be installed: #{failure} (chi update, or --force to install it anyway)"
       end
 
+      def refuse_newer_record_format
+        @provenance.ensure_supported_record_format!
+      rescue StateFormat::InvalidDocument => e
+        raise InstallError, e.message
+      end
+
       # The scope the files go to (the CLI's wins over the manifest's) and
       # its dir, created.
       # @return [Array(String, String)] scope, dir
@@ -557,6 +615,7 @@ module Samagotchi
       # cell's text merge runs on temp copies). --force would install every
       # file, unread.
       def preview_memory(file_key, state, action)
+        preview_trash_copy(file_key, state, action)
         return @results[file_key] = FileResult.new(word: :would_install, state: state, action: action) if @force
         return refuse_unreadable(file_key, state.paths[:current]) if action.do == :refuse
 
@@ -564,9 +623,20 @@ module Samagotchi
         action = decision.action if decision
         return note_conflict(file_key, decision.outcome, state) if action.behind?
 
+        preview_trash_copy(file_key, state, action)
         @results[file_key] = FileResult.new(word: DRY_WORDS.fetch(action.word), state: state, action: action)
       end
 
+      def preview_trash_copy(file_key, state, action)
+        return unless action.save_first
+
+        current = state.paths[:current]
+        incoming = state.paths[:incoming]
+        return unless File.file?(current) && !FileUtils.identical?(incoming, current)
+
+        @warnings << "Would copy to the trash first: #{file_key}"
+      end
+
       # Strict mode: a memory that takes the bundle's text (Action#takes_source?:
       # a new or missing file, --force, an upgrade's or a re-install's
       # fast-forward, a merge into a local edit) warns when the bundle's file
@@ -782,8 +852,8 @@ module Samagotchi
 
       # Not fatal, like update_target_index: a warning says so.
       def remove_target_index(scope, file_key)
-        IndexUpdater.remove_index(scope, file_key.delete_suffix(".md"))
-        IndexUpdater.remove_index(scope, file_key) # legacy "name.md" line
+        IndexUpdater.remove_index(scope, file_key.delete_suffix(".md"), target_dir: @target_dir)
+        IndexUpdater.remove_index(scope, file_key, target_dir: @target_dir) # legacy "name.md" line
       rescue StandardError => e
         @warnings << "index.md: line for #{file_key.delete_suffix(".md")} not removed (#{e.message})"
       end

data/lib/samagotchi/memory_bundle/manifest.rb

@@ -83,6 +83,12 @@ module Samagotchi
 
         # The source's hooks/*.rb, relative and sorted ([] for none).
         def self.files_in(dir) = Dir.glob(File.join(dir, "hooks", "*.rb")).map { |f| "hooks/#{File.basename(f)}" }.sort
+
+        # Refuse a source's class-file hooks before parsing its manifest.
+        def self.refuse_source_files(dir)
+          files = files_in(dir)
+          raise for_files(files) unless files.empty?
+        end
       end
 
       # A plugin file is a plain .rb name in the bundle's top directory.

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -7,6 +7,7 @@ require "fileutils"
 require "tmpdir"
 require_relative "../atomic_file"
 require_relative "../memory_paths"
+require_relative "../state_format"
 require_relative "../version"
 require_relative "file_digest"
 require_relative "installed_bundle"
@@ -32,6 +33,38 @@ module Samagotchi
       MARK_FIELDS = %w[conflict incoming_sha legacy_base why missed missed_places].freeze
       # What a merge no report has shown adds to a file's entry (#note_merged).
       MERGE_NOTE_FIELDS = %w[merged_version merged_at merged_trash].freeze
+      RECORD_FORMAT_VERSION = 1
+      RECORD_FORMAT = StateFormat.new(
+        version: RECORD_FORMAT_VERSION,
+        members: [
+          StateFormat.required(:name),
+          StateFormat.required(:version),
+          StateFormat.required(:scope),
+          StateFormat.required(:source),
+          StateFormat.required(:installed_at),
+          StateFormat.required(:files),
+          StateFormat.required(:hooks),
+          StateFormat.added(:record_format, in_version: 1, default: 1),
+          StateFormat.added(:dev, in_version: 1, default: false),
+          StateFormat.added(:guardrails, in_version: 1, default: {}),
+          StateFormat.added(:source_commit, in_version: 1, default: nil),
+          StateFormat.added(:plugin, in_version: 1, default: nil),
+          StateFormat.added(:includes, in_version: 1, default: nil),
+          StateFormat.added(:scripts, in_version: 1, default: {}),
+          StateFormat.added(:manifest_sha, in_version: 1, default: nil),
+          StateFormat.added(:installed_by, in_version: 1, default: nil),
+          StateFormat.added(:requires_chi, in_version: 1, default: nil),
+          StateFormat.added(:trust_level, in_version: 1, default: nil),
+          StateFormat.added(:needs, in_version: 1, default: nil),
+          StateFormat.added(:context_providers, in_version: 1, default: nil),
+          StateFormat.added(:block_renderers, in_version: 1, default: nil),
+          StateFormat.added(:session_settings, in_version: 1, default: nil),
+          StateFormat.added(:session_setting_types, in_version: 1, default: nil),
+          StateFormat.added(:settings, in_version: 1, default: nil),
+          StateFormat.added(:setting_types, in_version: 1, default: nil),
+          StateFormat.extra(:extra, in_version: 1)
+        ]
+      )
 
       def initialize(name:)
         @name = name
@@ -65,6 +98,55 @@ module Samagotchi
         File.join(@bundle_dir, "scripts")
       end
 
+      # The intent journal of a run that has not written its record yet
+      # (#write_pending): its scope and target dir, plus the files and sha256s
+      # of the texts a run meant to put there. #write removes it.
+      def pending_path
+        File.join(@bundle_dir, "pending.json")
+      end
+
+      # Notes, before an install's first write, the texts it is about to put
+      # in the memories dir, atomically. A journal an earlier interrupted run
+      # left keeps its shas (that run's files are still on disk).
+      # @param files [Hash{String => String}] memory => the incoming sha256
+      def write_pending(version:, scope:, target_dir:, files:)
+        shas = pending_files(target_dir: target_dir)
+        files.each { |key, sha| shas[key] = (shas.fetch(key, []) + [sha]).uniq }
+        FileUtils.mkdir_p(@bundle_dir)
+        AtomicFile.write(pending_path, JSON.pretty_generate(
+          "version" => version.to_s, "scope" => scope.to_s, "target_dir" => File.expand_path(target_dir), "files" => shas
+        ))
+      end
+
+      # The shas the journal names for +file_key+ (none without a journal, or
+      # with one that doesn't read or belongs to another target).
+      def pending_shas(file_key, target_dir:)
+        pending_files(target_dir: target_dir).fetch(file_key.to_s, [])
+      end
+
+      def pending_scope
+        pending_metadata&.fetch("scope")
+      end
+
+      def pending_target_dir
+        pending_metadata&.fetch("target_dir")
+      end
+
+      # The record's files plus interrupted files whose current bytes match a
+      # journaled sha. Files whose bytes no longer match are not claimed.
+      def files_with_pending(record, target_dir:)
+        files = record&.files&.dup || {}
+        pending_files(target_dir: target_dir).each do |key, shas|
+          next if files.key?(key)
+
+          disk_sha = FileDigest.hex(File.join(target_dir, key))
+          files[key] = {} if shas.include?(disk_sha)
+        rescue SystemCallError
+          next
+        end
+        files
+      end
+
       # The bundle's manifest.yml as installed (InstalledBundle#kept_manifest_path).
       def kept_manifest_path
         File.join(@bundle_dir, "manifest.yml")
@@ -233,6 +315,7 @@ module Samagotchi
                 guardrails_files: {}, plugin_file: nil, plugin_required: false, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
                 scripts_files: {}, context_providers: [], block_renderers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
                 dev: false, manifest_from: nil)
+        record_extra = format_record(read)&.extra || {}
         FileUtils.mkdir_p(@bundle_dir)
         bases_dir = File.join(@bundle_dir, "bases")
         FileUtils.mkdir_p(bases_dir)
@@ -280,6 +363,7 @@ module Samagotchi
 
         manifest_data = {
           "name" => @name,
+          "record_format" => RECORD_FORMAT_VERSION,
           "version" => version.to_s,
           "scope" => scope.to_s,
           "source" => source_path.to_s,
@@ -314,8 +398,10 @@ module Samagotchi
           end
         end
         manifest_data.merge!(kept_manifest_fields(existing, manifest_from, dev))
+        manifest_data = record_extra.merge(manifest_data)
 
         write_manifest(manifest_data)
+        FileUtils.rm_f(pending_path)
         marked.each_key { |key| save_incoming(key, incoming_dir) }
         prune_incoming(marked.keys)
       end
@@ -330,7 +416,7 @@ module Samagotchi
       def resolve_conflicts(conflicts)
         return [] unless installed?
 
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        raw = writable_record
         raw["files"] ||= {}
         settled = conflicts.filter_map do |file_key, info|
           key = file_key.to_s
@@ -349,7 +435,7 @@ module Samagotchi
       # A missing file was put back with the bundle's bytes: +path+ is its base,
       # its entry is made or rebuilt (no mark), and the rest of the manifest stays.
       def record_restored(file_key, path, description: nil)
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        raw = writable_record
         content = File.binread(path)
         File.binwrite(base_path(file_key), content)
         entry = { "checksum" => Digest::SHA256.hexdigest(content) }
@@ -369,7 +455,7 @@ module Samagotchi
       def refresh_marks(marks, incoming_dir)
         return unless installed?
 
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        raw = writable_record
         marks.each do |mark|
           entry = raw.dig("files", mark.file)
           next unless entry&.fetch("conflict", nil)
@@ -393,7 +479,7 @@ module Samagotchi
       def note_merged(files, version:, trash:, at: Time.now)
         return unless installed?
 
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        raw = writable_record
         files.each do |key|
           raw.dig("files", key)&.merge!({ "merged_version" => version.to_s, "merged_at" => at.iso8601, "merged_trash" => trash }.compact)
         end
@@ -409,7 +495,7 @@ module Samagotchi
       def clear_merge_notes(notes, files: [])
         return if notes.empty? && files.empty?
 
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        raw = writable_record
         stale = notes.select do |note|
           entry = raw.dig("files", note.file)
           entry && entry["merged_version"] == note.version && entry["merged_at"] == note.at
@@ -419,6 +505,8 @@ module Samagotchi
           MERGE_NOTE_FIELDS.each { |field| entry.delete(field) } if entry
         end
         write_manifest(raw)
+      rescue StateFormat::InvalidDocument => e
+        e.message
       rescue JSON::ParserError, SystemCallError
         nil
       end
@@ -437,7 +525,10 @@ module Samagotchi
       def adopt_manifest(dir, dry_run: false)
         bundle = record
         return "#{@name} isn't installed" unless bundle
+
         return "#{@name} is a dev install" if bundle.dev
+
+        raw = writable_record
         return "#{@name} keeps its manifest already" unless bundle.manifest_unkept?
 
         source = File.join(dir.to_s, "manifest.yml")
@@ -449,9 +540,10 @@ module Samagotchi
         return why if why || dry_run
 
         AtomicFile.write(kept_manifest_path, bytes)
-        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
         write_manifest(raw.merge("manifest_sha" => "sha256:#{Digest::SHA256.hexdigest(bytes)}"))
         nil
+      rescue StateFormat::InvalidDocument => e
+        e.message
       rescue JSON::ParserError, SystemCallError => e
         "#{@name}'s record can't take it: #{e.message}"
       end
@@ -463,6 +555,32 @@ module Samagotchi
         InstalledBundle.read(@name, File.join(@bundle_dir, "manifest.json"))
       end
 
+      def ensure_supported_record_format!
+        format_record(read)
+      end
+
+      # The journal's memory => shas, {} when it doesn't belong to this target
+      # or doesn't read.
+      def pending_files(target_dir:)
+        return {} if target_dir.to_s.empty?
+
+        metadata = pending_metadata
+        return {} unless metadata && File.expand_path(target_dir.to_s) == metadata["target_dir"]
+
+        files = metadata["files"]
+        files.is_a?(Hash) ? files.to_h { |key, shas| [key, Array(shas).grep(String)] } : {}
+      end
+
+      def pending_metadata
+        data = JSON.parse(File.read(pending_path))
+        return unless data.is_a?(Hash) && data["scope"].is_a?(String) && data["target_dir"].is_a?(String)
+
+        data
+      rescue JSON::ParserError, EncodingError, SystemCallError
+        nil
+      end
+      private :pending_files, :pending_metadata
+
       # manifest.json as it is on disk, symbol keys (nil if not installed).
       # Readers take #record.
       def read
@@ -472,6 +590,40 @@ module Samagotchi
         JSON.parse(File.read(manifest_path), symbolize_names: true)
       end
 
+      def writable_record
+        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        format_record(raw)
+        raw
+      end
+      private :writable_record
+
+      def format_record(data)
+        return unless data
+        raise StateFormat::InvalidDocument, "manifest.json must contain a JSON object" unless data.is_a?(Hash)
+
+        data = data.transform_keys(&:to_s)
+        version = data["record_format"]
+        unless version.nil? || (version.is_a?(Integer) && version >= 0)
+          raise StateFormat::InvalidDocument, "manifest.json has an invalid record_format"
+        end
+
+        document = RECORD_FORMAT.read({ "version" => version, "records" => [data] }, collection: "records")
+        if document.version > RECORD_FORMAT_VERSION
+          raise StateFormat::InvalidDocument,
+                "manifest.json record_format #{document.version} is newer than supported #{RECORD_FORMAT_VERSION}; update chi before writing it"
+        end
+
+        record = document.entries.first
+        unless record&.readable?
+          raise StateFormat::InvalidDocument,
+                "manifest.json is missing required record fields; repair with chi bundle uninstall #{@name} --force, " \
+                "then chi bundle install <source> --force"
+        end
+
+        record
+      end
+      private :format_record
+
       # Write aside and rename, so a reader in another process (a parallel
       # chi start) never parses a truncated manifest.json.
       def write_manifest(manifest_data)

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -52,7 +52,8 @@ module Samagotchi
       # mismatch warnings. merged and replaced are file
       # names, behind FileStanding::Behind; under plan they are what apply would
       # merge, replace or leave behind.
-      # adds is nil but for a profile: the members it installs.
+      # added_files is the new version's memory files the bundle didn't own
+      # before; adds is nil but for a profile: the members it installs.
       # kept_own is nil but for a profile that installed a member: its
       # Profile.kept_own_line lines.
       # trash_copy is nil but under apply when it saved edited files
@@ -62,8 +63,8 @@ module Samagotchi
       # manifest: what a row at the shipped version says of its manifest.yml
       # (ManifestStanding.keep's line: would keep or kept it, or why not and
       # the command), nil when nothing.
-      Row = Struct.new(:name, :from, :to, :status, :note, :merged, :behind, :replaced, :source_dir, :scope, :adds, :kept_own,
-                       :trash_copy, :earlier, :manifest, keyword_init: true) do
+      Row = Struct.new(:name, :from, :to, :status, :note, :merged, :behind, :replaced, :source_dir, :scope, :added_files, :adds,
+                       :kept_own, :trash_copy, :earlier, :manifest, keyword_init: true) do
         def kept = Array(behind).map(&:file)
       end
 
@@ -208,6 +209,7 @@ module Samagotchi
         return skip(row, "project scope: chi bundle upgrade #{ship.source} in the project") if row.scope == "project"
         return skip(row, "unknown scope #{row.scope}: upgrade chi or reinstall") unless MemoryPaths.scope_dir(row.scope)
 
+        row.added_files = (manifest.files.keys - bundle.files.keys).sort
         forecast = forecast(row, bundle)
         row.merged = forecast.merged
         row.behind = forecast.behind
@@ -290,8 +292,9 @@ module Samagotchi
       # Merger::Upgrade#forecast.
       def forecast(row, bundle)
         shipped = Dir.glob(File.join(row.source_dir, "*.md")).map { |f| File.basename(f) }.sort
+        files = Provenance.new(name: row.name).files_with_pending(bundle, target_dir: MemoryPaths.scope_dir!(row.scope))
         Merger::Upgrade.new(provenance: Provenance.new(name: row.name), target_dir: MemoryPaths.scope_dir!(row.scope),
-                            source_dir: row.source_dir).forecast(shipped & bundle.files.keys, version: row.to)
+                            source_dir: row.source_dir).forecast(shipped & files.keys, version: row.to)
       end
 
       # What the upgrade from +source_dir+ copies to the trash, as

data/lib/samagotchi/memory_bundle/status.rb

@@ -39,7 +39,7 @@ module Samagotchi
 
         scope = (scope_override ? bundle.with(scope: scope_override) : bundle).effective_scope
         target_dir = MemoryPaths.scope_dir(scope)
-        files = bundle.files
+        files = provenance.files_with_pending(bundle, target_dir: target_dir)
         details = {}
         behind = bundle.behind_files(target_dir).to_h { |file| [file.file, file] }
         notes = bundle.merge_notes.to_h { |note| [note.file, note] }
@@ -84,12 +84,12 @@ module Samagotchi
       private_class_method :digest_or_nil
 
       # The class-file hooks the record still has (a 0.157 install's; chi
-      # loads none, Manifest::HooksRetired), each "ok" or "missing" in
+      # loads none, Manifest::HooksRetired), each "present" or "missing" in
       # hooks/, by name; {} for none.
       # @return [Hash{String => String}]
       def self.retired_hooks(provenance, bundle)
         bundle.hooks.keys.sort.to_h do |file|
-          [file, File.exist?(File.join(provenance.hooks_dir, file)) ? "ok" : "missing"]
+          [file, File.exist?(File.join(provenance.hooks_dir, file)) ? "present" : "missing"]
         end
       end
 

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -84,6 +84,8 @@ module Samagotchi
       # Those notes have been shown (Provenance#clear_merge_notes), under the lock.
       def clear_merge_notes(notes, files: [])
         with_lock { Provenance.new(name: BUNDLE_NAME).clear_merge_notes(notes, files: files) }
+      rescue StateFormat::InvalidDocument => e
+        e.message
       rescue StandardError
         nil
       end

data/lib/samagotchi/memory_bundle/uninstaller.rb

@@ -44,18 +44,30 @@ module Samagotchi
       def run
         provenance = Provenance.new(name: @name)
         bundle = provenance.record
-        raise UninstallError.not_installed(@name) unless bundle
-
-        # The scope from the flag, else the record's
-        target_scope = @scope.to_s.strip.empty? ? bundle.effective_scope : @scope
-        target_dir = MemoryPaths.scope_dir(target_scope) or raise UninstallError, "invalid scope: #{target_scope}"
+        if bundle
+          target_scope = @scope.to_s.strip.empty? ? bundle.effective_scope : @scope
+          target_dir = MemoryPaths.scope_dir(target_scope) or raise UninstallError, "invalid scope: #{target_scope}"
+        else
+          target_scope = @scope.to_s.strip.empty? ? provenance.pending_scope : @scope
+          pending_target = provenance.pending_target_dir
+          raise UninstallError.not_installed(@name) unless target_scope && pending_target
+
+          target_dir = MemoryPaths.scope_dir(target_scope) or raise UninstallError, "invalid scope: #{target_scope}"
+          if @scope.to_s.strip.empty?
+            target_dir = pending_target
+          elsif File.expand_path(target_dir) != pending_target
+            raise UninstallError.not_installed(@name)
+          end
+        end
 
-        files = bundle.files
-        hooks = bundle.hooks
+        files = provenance.files_with_pending(bundle, target_dir: target_dir)
+        hooks = bundle&.hooks || {}
         if files.empty? && hooks.empty?
           # No file list, just remove provenance (rules, a plugin and scripts
           # live there too)
           save_edits(provenance, bundle)
+          plugin_path = provenance.plugin_path(bundle)
+          @removed_files << "plugin/#{File.basename(plugin_path)}" if plugin_path && File.exist?(plugin_path)
           FileUtils.rm_rf(provenance.bundle_dir)
           return true
         end
@@ -96,7 +108,7 @@ module Samagotchi
 
             @warnings << "Kept #{file_key_str}: bundle #{others.join(", ")} has it too"
             unless ModelOverlay.bundle_overlay?(file_key_str, bundle_files: files.keys.map(&:to_s), target_dir: target_dir)
-              retag(target_scope, target_path, file_key_str, others.first)
+              retag(target_scope, target_path, file_key_str, others.first, target_dir: target_dir)
             end
             next
           end
@@ -106,8 +118,8 @@ module Samagotchi
           end
           # Remove index line (not fatal: a warning says so)
           begin
-            IndexUpdater.remove_index(target_scope, file_key_str.delete_suffix(".md"))
-            IndexUpdater.remove_index(target_scope, file_key_str) # legacy "name.md" line
+            IndexUpdater.remove_index(target_scope, file_key_str.delete_suffix(".md"), target_dir: target_dir)
+            IndexUpdater.remove_index(target_scope, file_key_str, target_dir: target_dir) # legacy "name.md" line
           rescue StandardError => e
             @warnings << "index.md: line for #{file_key_str.delete_suffix(".md")} not removed (#{e.message})"
           end
@@ -149,6 +161,8 @@ module Samagotchi
       # scripts by their source-less AssetState and ASSET_UNINSTALL's
       # save_first; an older chi's hooks/ by Trash#copy_edits.
       def save_edits(provenance, bundle)
+        return unless bundle
+
         @trash.copy_edits(provenance.hooks_dir, "hooks", bundle.hooks.transform_values(&:sha256))
         { rule: [provenance.guardrails_dir, bundle.guardrails], plugin: [provenance.plugin_dir, bundle.plugin_shas],
           script: [provenance.scripts_dir, bundle.scripts] }.each do |kind_of_file, (dir, recorded)|
@@ -159,9 +173,11 @@ module Samagotchi
       end
 
       # A kept shared file's index line names the bundle that still has it
-      # (a model overlay has none: the caller skips it).
-      def retag(scope, path, file_key, bundle)
-        IndexUpdater.update_index(scope, file_key.delete_suffix(".md"), File.size(path), source: bundle)
+      # (a model overlay has none: the caller skips it). +target_dir+ is the
+      # folder the file lives in, which for an install interrupted before its
+      # record is the journal's target dir, not the current folder's.
+      def retag(scope, path, file_key, bundle, target_dir:)
+        IndexUpdater.update_index(scope, file_key.delete_suffix(".md"), File.size(path), source: bundle, target_dir: target_dir)
       rescue StandardError => e
         @warnings << "index.md: line for #{file_key.delete_suffix(".md")} not updated (#{e.message})"
       end