samagotchi 0.77.0 → 0.78.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 433cf999c039d529cdf878223e798ed00b23efc0a35393c48111c0b1f7b597a7
-  data.tar.gz: eb13e65818fc0b2efaa04d28315d9693856ff77861d5643d668702fe80cdeca1
+  metadata.gz: 1b19c3433cc4f46956563a8e4e6532d8b60061084b8050b534b9230b3c608c54
+  data.tar.gz: 97b8e078c43e1c9901139f1f937d16e43b57b6147cd8298fbb9b77abb37c0b96
 SHA512:
-  metadata.gz: 58012cc677a1b2c14e358dabed798856f88a8a74f59dff1606f08dca297ae78d5f89d69c392b2254523308996a67a86ff828205e07a7eac7ea0b7adf99961d79
-  data.tar.gz: 7332bff82c9060f9ad9a77063891ced098572ce28861fbe2a65ab9486076478d40f1731fec13f41ec9dc4a15fc60e14ac023b40255c0356993bfe22969817986
+  metadata.gz: '0022706491e62a2d7f603a5290fd4c5525b17c6712af6d31dc5ce163b36c4e4414074d7b4da609f890ec5e243ea89b33a5ba0621528d8face6c5226108d0a443'
+  data.tar.gz: da23fef030284a3401d5ec17017ef2a7d1165d30909f4a96e095823315bc38bbbe1eaf1bdfd76eefe604af19cd160c5f68fd19cb3c4ccb478b28bd9ea1de57eb

data/CHANGELOG.md

@@ -8,6 +8,30 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.78.0] - 2026-10-17
+
+### Added
+
+- Web: dragging the message box's top-edge grip down folds the box away for room to read; the info bar stays at the
+  bottom, and the grip stays on its top edge as a handle. Pull the handle up or click it, or just type on the page, to
+  bring the box back (a draft marks the handle in the accent, a session waiting on you in the attention colour), and
+  Stop turn moves into the info bar while it is folded. The choice is remembered per browser, and an archived session
+  opens folded.
+
+### Changed
+
+- Workers no longer load the terminal UI or Reline, saving about 50–100 ms and 2 MB per worker start; a plugin
+  that uses Reline, StringIO, Forwardable or Tempfile must now require it itself.
+
+### Fixed
+
+- Claude 5.x on `api: anthropic`: a request whose earlier thinking the API refuses after the system prompt or tools
+  changed (a resume or respawn after memory or AGENTS.md edits, `/model`, `/thinking`, `/toolkit`) no longer fails the
+  turn. chi asks again with Anthropic's binding controls (or without those thinking blocks), drops that thinking from
+  the session, and `/stats` counts it as `thinking dropped`.
+
+Update with `chi update` (the system bundle 0.78.0), then restart `chi web`.
+
 ## [0.77.0] - 2026-10-17
 
 ### Changed
@@ -3245,7 +3269,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.77.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.78.0...HEAD
+[0.78.0]: https://github.com/dm1try/samagotchi/compare/v0.77.0...v0.78.0
 [0.77.0]: https://github.com/dm1try/samagotchi/compare/v0.76.0...v0.77.0
 [0.76.0]: https://github.com/dm1try/samagotchi/compare/v0.75.0...v0.76.0
 [0.75.0]: https://github.com/dm1try/samagotchi/compare/v0.74.0...v0.75.0

data/docs/cli.md

@@ -459,7 +459,8 @@ request (with the cached tokens, the cache writes, the re-prefilled tokens and t
 reports them),
 the decode speed, generation latency, cancellations, retries (the network's),
 thinking cuts (generations a plugin such as loop-guard cut) and output cap hits
-(generations that ended at the provider's cap), context used and window (the used figure is counted against the smaller of the window and the session's LLM context budget, and says so: `context used:     16000 tokens (25.0% of the 64000 budget)`), the memory indexes the session's prompt holds ([Memory](memory.md#the-indexs-size)), the model notes it carried (`model notes:      model_notes_deepseek (system, 612 chars)`, none without any; [Memory](memory.md#model-notes)), the toolkit's prompt text (`kit prompt:       coding (~20 tokens)`, only when its kit has one; [Toolkits](configuration.md#toolkits)), the prompt profile and the model the server says it ran, and the
+(generations that ended at the provider's cap), the thinking blocks a Claude 5.x preserved-thinking recovery dropped
+(`thinking dropped:`, only when there were any; [configuration](configuration.md)), context used and window (the used figure is counted against the smaller of the window and the session's LLM context budget, and says so: `context used:     16000 tokens (25.0% of the 64000 budget)`), the memory indexes the session's prompt holds ([Memory](memory.md#the-indexs-size)), the model notes it carried (`model notes:      model_notes_deepseek (system, 612 chars)`, none without any; [Memory](memory.md#model-notes)), the toolkit's prompt text (`kit prompt:       coding (~20 tokens)`, only when its kit has one; [Toolkits](configuration.md#toolkits)), the prompt profile and the model the server says it ran, and the
 cost when the provider reports one (OpenRouter's `usage.cost`), and the cost
 estimated from a price under `hosts.<name>.models` when it reports none or 0,
 marked `~` and naming the current model's host (`cost:             $0.42 reported + ~$0.12 from hosts.gw.models prices (this session only)`;

data/docs/configuration.md

@@ -343,12 +343,16 @@ hosts:
 
 `auth:` works on any host (`bearer` is the default everywhere but `api: anthropic`).
 
-**Known limit (until a later release):** Claude 5.x models (Opus, Sonnet and Haiku 5.5, Fable 5.1) bind each
-thinking block to the request it came from. When the history before a block changes (the system prompt rebuilt after a
-worker restart or a `/model` switch, a changed tool set, the forget layer's edits), such a model may answer HTTP 400
-"… bound to a different conversation" and the turn fails with that error; `/reasoning-history turn` makes it rarer.
-A later release sends Anthropic's binding controls and recovers from that 400. Fireworks, Splash and other
-non-Claude models are not affected.
+**Claude 5.x preserved thinking:** Claude 5.x models (Opus, Sonnet and Haiku 5.5, Fable 5.1) bind each thinking
+block to everything before it: the system prompt, the tools and the earlier messages. chi keeps the history
+append-only, but the system prompt or the tools can change under a session: a resume or a worker respawn after
+memory or AGENTS.md edits, `/model`, `/thinking`, `/toolkit`, a plugin's tools, or an `llm_context` layer stubbing
+older outputs. Then the API refuses the earlier thinking once (HTTP 400 "… bound to a different conversation"); chi
+asks again with Anthropic's binding controls (or without those blocks), drops that thinking from the session for
+good, and no turn fails. `/stats` counts it (`thinking dropped: N blocks (preserved-thinking recovery)`), and each
+time costs one extra (free) 400 and one cache write. `reasoning_history` on these hosts is `all` by default; `turn`
+drops more reasoning but never needs a recovery at a turn's start. Fireworks, Splash and other non-Claude models
+never see these requests. internals/anthropic.md has the details.
 
 The loop, tools, events, hooks and UIs are the chat loop's, as for `api: openai`; only the wire differs: the
 system prompt goes as the request's `system` (later system notes as user text), tool calls as `tool_use` blocks,

data/docs/internals/anthropic.md

@@ -17,7 +17,10 @@ ChatLoop::Run#generate
       → POST {base}/v1/messages             # LLM::HTTP: retries, cancel, first-token limit
       → AnthropicAssembly#add per SSE event # → ChatResponse (text, reasoning, tool_calls, usage,
                                             #   finish_reason, provider_content)
+      → a signature 400 (Claude 5.x preserved thinking): #binding_recovery, then the same
+        request with drop_block or the blocks stripped; ChatResponse#thinking_drop names them
       → a 400 it can fix: #refusal_fix, then the same request again (once per kind)
+  → ChatLoop#settle_dropped_thinking!       # the dropped blocks leave the stored model entries
 ```
 
 ## Files
@@ -32,7 +35,7 @@ Paths are under `lib/samagotchi/llm/`.
 | `anthropic_assembly.rb` | `AnthropicAssembly`: a response from a whole body (`.from_message`) or stream events (`#add`), its usage in the OpenAI shape |
 | `dialect.rb` | `Dialect` (`STANDARD`, `FIREWORKS`): what a provider's `/v1/messages` does differently |
 | `prompt_cache.rb` | `PromptCache.control`: the `cache_control` a breakpoint carries (`cache.ttl`) |
-| `chat_loop.rb` | `ChatLoop#replay_blocks`, `#reasoning_history`'s floor, `Run#with_thinking` (saves `anthropic_content`) |
+| `chat_loop.rb` | `ChatLoop#replay_blocks`, `#reasoning_history`'s floor, `Run#with_thinking` (saves `anthropic_content`), `#settle_dropped_thinking!` |
 
 ## The adapter
 
@@ -112,8 +115,70 @@ text and `tool_use` blocks (a tool loop with thinking needs the last assistant t
 - `ChatLoop#reasoning_history` floors the level at `turn` on a replaying adapter: `drop` would remove the running
   run's thinking, which Messages needs. For the same reason a reasoning 400 doesn't ask again without reasoning
   (`Run#generate`: it would resend the same body).
-- A 400 about a thinking block's signature (`BadRequest#thinking_signature?`, a Claude 5.x block bound to a
-  different conversation) fails the turn for now; configuration.md has the known limit.
+- A 400 about a thinking block's signature (`BadRequest#thinking_signature?`) is recovered in the adapter, and the
+  blocks it cost leave the history (next section).
+
+## Preserved thinking (Claude 5.x)
+
+Claude 5.x models bind each thinking block to the prefix it was minted after: both `system` blocks (the stable part
+and the per-session tail), the tool set, and every earlier message. Sent back after any of those changed, the block
+gets a 400 `messages.N.content.M: Invalid signature in thinking block. The block is bound to a different
+conversation.`, and its last sentence says what changed ("The `system` prompt differs …"). chi's history is
+append-only within a process, so what changes the prefix is:
+
+1. **A system-prompt rebuild** (`SystemPrompt#build` is cached per process and key; `PromptBuilder#reset!` drops it):
+   a new process (`--resume`, a respawn after `session.idle_exit_minutes`, a crash) after a memory index line, an
+   AGENTS.md, an appended file, a model note or a bundle memory changed; `/model` (the tail's `Model:` line, its
+   overlays and notes); `/thinking` (another key); a toolkit or profile change; a plugin's `tools_changed!`.
+2. **A tool set change**: the same triggers, plus MCP lines that differ on a respawn.
+3. **History edits by design**: the `llm_context` `stale`/`forget` stubs, and the image cut moving a batch.
+
+A model switch never 400s: the API drops blocks another model can't read silently (`model_binding_mismatch`).
+
+**Recover on the 400, then settle.** Normal requests carry no beta header and no `block_binding`, so Fireworks,
+Splash and gateways see the same bytes as before. On a signature 400, before anything streamed,
+`AnthropicMessages#binding_recovery` picks the next step, once each per request:
+
+- **drop_block**: the same body with `thinking.block_binding: {prefix_mismatch_behavior: "drop_block"}` (the body's
+  adaptive or enabled thinking, `display` as sent; adaptive when the level sends none) and the header
+  `anthropic-beta: thinking-binding-controls-2026-08-01`. The answer's `input_transformations` (in `message_start`'s
+  message, or the body; `AnthropicAssembly#input_transformations`) list the dropped blocks by path into the body
+  sent; the adapter maps the `prefix_binding_mismatch` ones to block identities. Any other entry
+  (`model_binding_mismatch`: a switch back reads those blocks again) is counted as kept, never settled.
+- **strip**: the block the 400 names (else the first replayed thinking block) and every thinking or
+  redacted_thinking block after it removed from the body (a trailing run, which Messages takes). For a bad
+  signature (the 400 without "bound to a different conversation": drop_block doesn't apply), thinking `disabled`
+  (block_binding goes only with adaptive or enabled), a model on the budget form with no thinking field, a host
+  that refused the controls (`binding_controls`, remembered), or a second signature 400 after drop_block.
+
+A third signature 400 fails the turn. The extra requests are 400s, rejected before generation and not billed. The
+step is request state that `#request_body`'s rebuild keeps, so a later `#refusal_fix` (display, cache_control,
+output cap) in the same request keeps the binding or the strip. The response carries `thinking_drop`
+(`LLM::ThinkingDrop`: `identities`, `how`), and the adapter logs `thinking_recovered` (`how`, `dropped`, `kept`,
+`why`: the 400's last sentence).
+
+A block's identity (`AnthropicWire.block_identity`, shared by the adapter and ChatLoop) is its `signature`, a
+redacted block's `data`, or, when that is empty (Splash's `signature: ""`), `text:` + the SHA256 of its text.
+
+`ChatLoop::Run#generate` hands those identities to `ChatLoop#settle_dropped_thinking!` before the step adds its own
+entry, whatever the finish reason: each model entry holding one is replaced in place (same index) with a copy
+without those blocks (`thinking:` stays; an entry left with none loses `anthropic_content`). That is the edit the
+API made, so the next request is valid with no beta (a pruned history is valid: removing exactly the dropped set
+leaves no gap), and the session file keeps it, since `Engine#kept_messages` and `#failed_messages` take the run's
+conversation whole. It emits `:thinking_dropped` (`count`, `how`) and `thinking_dropped` on `:generation_completed`,
+which `SessionMetrics` sums for `/stats`. A drop that settles nothing (blocks already settled came back, e.g. a
+rolled-back turn's) logs `thinking_recovery_repeated` once per run. A cancelled, cut or dropped generation settles
+nothing; the next request recovers again.
+
+Each break costs one free 400, one cache write of the prefix from the edit point, and the reasoning the dropped
+blocks carried. Whether the request after a drop_block one reads the cache that request wrote (it no longer carries
+`block_binding`) is unverified.
+
+Why not send drop_block on every request: it needs adaptive or enabled thinking on the body (`default` sends no
+thinking field, `off` sends disabled), it would put a beta header on every request to every host, and it would drop
+the same blocks again on every request until something pruned them. The reactive form does the same work in one
+place, for one extra 400 round trip per break. The `anthropic-thinking-prefix-mismatch` diagnosis header (on the
+400, undocumented) is kept on the provider error and logged as `diagnosis` on `thinking_recovered`.
 
 ## Cache breakpoints
 
@@ -152,7 +217,10 @@ adapter's life, so ChatLoop's broader paths never see them (`#refusal_fix`, logg
 | adaptive thinking or its effort (`ADAPTIVE_REFUSED_RE`) | the budget form: `thinking: {type: "enabled", budget_tokens: BUDGETS[level]}`, no effort (`#budget_form`) | per model (`thinking_form_switched`) |
 | `cache_control` | no breakpoints | per host (`cache_control_refused`) |
 | `max_tokens: N > M` (`OUTPUT_CAP_RE`) | `max_tokens` capped at M | per model (`output_cap`) |
+| `block_binding` or the binding beta, on a drop_block retry (`thinking_binding_unsupported?`) | the strip instead (Preserved thinking) | per host (`binding_controls_refused`) |
 
 The display check comes before the adaptive one: its path (`thinking.adaptive.display`) names adaptive too. A context
-overflow, a refused sampling field, a signature or a binding-controls 400 is not one of these: it goes on as it is,
-to the loop's own handling (ChatLoop's sampling and thinking-fields fallbacks) or to the turn's failure.
+overflow, a refused sampling field, a signature or a binding-controls 400 is not one of these (`#refusal_fix` keeps
+excluding them, so `ADAPTIVE_REFUSED_RE` never reads a binding 400's "adaptive" as a form refusal): a signature 400
+goes to the binding recovery above, the rest on as they are, to the loop's own handling (ChatLoop's sampling and
+thinking-fields fallbacks) or to the turn's failure.

data/docs/internals/engine.md

@@ -473,6 +473,7 @@ Turn events (the main ones; `Events` in `events.rb` keeps the shared sets):
 | `:generation_retrying` | the transport retries the request, or the chat loop asks again for a step whose stream dropped mid-answer (`restarted: true`: what the step streamed is void, and the web's live step, the TUI's activity line, the Bridge's TurnAccumulator and the stream hooks' watch start it over) | `{iteration, attempt, max_retries, next_delay, error_class, error_message, status, restarted?}` |
 | `:generation_completed` | a generation ended, or was cut | `{iteration, content_length, thinking_chars, served_model, requested_model, finish_reason, ...}`; a cut adds `stopped_by`, `stop_reason`; the Engine adds `speed`, `tokens`, `model_segments` |
 | `:generation_cancelled` | the turn was cancelled mid-loop | `{iteration, reason, stopped_by}` |
+| `:thinking_dropped` | the chat loop settled a preserved-thinking recovery: the adapter dropped replayed thinking blocks and they left the history (`ChatLoop#settle_dropped_thinking!`; the step's `:generation_completed` carries `thinking_dropped`; internals/anthropic.md) | `{iteration, count, how}` (`how`: `:drop_block` or `:strip`) |
 | `:empty_answer_retry` | an empty, cut or malformed answer is asked again | `{iteration, attempt, of, finish_reason, thinking_chars, stopped_by?, malformed?}` |
 | `:steer_cut` | a steer cut the generation | `{iteration, source}` |
 | `:llm_context_edited` | the apply rule applied a batch of LLM context edits (a request, a forget_outputs call, turn end; never the warm-up) | `{moment, why, freed_tokens, tail_tokens, staged, text, groups}` (`LLMContextNotice`) |

data/docs/internals/prompt-caching.md

@@ -171,7 +171,9 @@ is prefilled once. The native and the chat loop use the same plan.
    first reply, on a server that renders it; a stock Qwen template without `preserve_thinking` re-renders from the
    reply before every user message whatever chi sends). A worker's
    mid-turn checkpoint (`TurnCheckpoint`) is append-only too (the history plus what the loop appended) and
-   never changes the request bytes.
+   never changes the request bytes. On Messages with Claude 5.x a change to the prefix (the system prompt, the
+   tools, an earlier message) also costs the thinking blocks after it: one 400, then chi drops them for good
+   (internals/anthropic.md, "Preserved thinking").
 3. **Deterministic order.** Tools, memory lists and anything else that's rendered from a hash or a set needs a
    fixed sort. Plugin tools are sorted by (bundle, name) whatever order their plugins finished starting in
    (R5a).

data/docs/sessions.md

@@ -80,6 +80,7 @@ chi sessions clean --dry-run --days 7            # test sessions older than 7 da
 - Web notifications: when a session needs you while the tab is hidden or behind another window (a question or a guardrail approval, a plugin card with buttons during a turn such as check-in's, a failed turn, a turn done after 10 s or more; a delegated session only for its questions, a canceled turn never), the page title counts it, `(N) Chi`, until you come back to the tab. The bell at the right of the top bar also turns on OS notifications ("needs an answer", "needs approval", "needs you", "turn failed", "done in 42 s", under the session's first message; a click opens the session): its first click asks the browser for the permission, and the choice is kept per browser. Any session of the page's scope counts, not only the open one. What was already so when the page loaded never counts, and several chi tabs show one notification per event. A chi tab in front tells the others (a `BroadcastChannel`), so while you look at one, the ones behind neither notify nor count what it shows; coming back to a tab clears those events in the other tabs' titles too. The hub's `session` frames carry what this needs: `pending_question` (`{id, kind}`, kind `question` or `approval`), `pending_card` (`{id, bundle}`: the running turn's card with actions, from `pending_card.json` that the worker keeps in the session's folder while one is open; a card without actions, such as loop-guard's, never counts) and `last_turn` (`{outcome, ended_at, seconds, origin}`, saved in the session's JSON as the engine ends each turn).
 - The web frontend is a zero-build ES-module stack in `lib/samagotchi/web/public/`: `data.js` (retrieval, typed SSE `openStream` for a session and `openEvents` for the session list), `sessions_list.js` (the list as a pure reducer over `GET /api/events`: a snapshot replaces it, an upsert keeps a known card in place, a removal drops it; `families()` groups delegates under their parent), `families_view.js` (a parent's family chip, its rows and the strip's popover; the chip and rows as lit-html templates), `keep_focus.js` (lit reuses a list's nodes by position: a redraw keeps the focus on the same item by its `data-id` / `data-name`), `chains.js` (session chains: the links from `continues`, the cards folded into the latest link's, its `#N` chip and rows as lit-html templates, the info bar's ← → links, a refused continue, and the fresh-link rule), `notify.js` (which of those events needs the user, for the notifications), `app.js` (presentation/state; a session with no live stream gets one when its `session` event says `bridge_up`, after one re-read: `event_seq` starts over in each worker, so a dropped stream is never resumed with its old cursor), `bubbles.js` (the history's bubbles between the turns' rows: output chunks, end lines, every client's prompt bubbles by `enqueued_id` with their queued/steered badges, the idle recap, guardrail warnings, hooks' notices, plugins' steers, command and note bubbles; lit-html templates, put in the history with the sticky follow by `createBubbles`), `cards_place.js` (where plugin cards and a snapshot's notices go in the history: a card added or updated in place by its id, a running turn's into its step, a snapshot's each above the first turn after it, a finished turn's notice in its step's rows and its question resolved where it was asked; a card's action buttons), `format.js` (pure formatters such as `previewOf`), `plain_line.js` (markdown out of the plain one-line places: the stage headline, a closed step's title, an answered question card's kept-reply line), `prompt_history.js` (the composer's ↑/↓ over the shared prompt history), `commands.js` (session commands: which composer lines are commands, the page's own replies, a `command_ran`'s bubble, the page's command bubbles kept across a re-read), `composer.js` (where a composer line goes, `routeComposerLine`: /cut and /queue, the start page's own replies, a session command or `!cmd`, a typo hint, else a turn; and a session command sent from the composer or a chip), `delivery_line.js` (the composer's row above the text field in a session, always there so the composer keeps its height: the key hint while idle, and the delivery line while a turn runs: where a message typed now goes in, from the step's phase, clock and size, whether "cut in now" can land, and the queue link for a worker with the `delivery` feature, as a pure `deliveryLine`, its lit-html template and `createDeliveryControl`, which ticks it and keeps a choice armed from a link; see docs/cli.md, "Typing during a turn"), `restore.js` (a failed turn's prompt handed back into this tab's composer, before or after its `/turn` ack), `lists_view.js` (the session lists: the strip and its pill, all sessions with its search, count and select mode, their cards, the family and chain popovers; the cards, tile and pill as lit-html templates, drawn as new nodes each time, and the lists' orders as pure functions), `stream_handlers.js` (the open session's stream event handlers, by event type, over the page's views and hooks; a snapshot replays through them too), `stage_view.js` (the stage view: the running turn pinned above the composer, then handed off into the history; its pure rules and texts in `stage_model.js`, its live slots (headline, now row, trail, ticks) in `stage_slots.js`, its cap and held height in `stage_frame.js`, the in-use watch that times the hand-off in `stage_watch.js`), `info_bar.js` (the session bar's info line as a lit-html template over a plain model: id, status, model, chain links, chips, ctx, speed, clock, worker badge), `info_bar_model.js` (that model and the bar's buttons' states, built from the page's session state, its list and its in-flight continues and restarts as pure functions; `app.js`'s `updateInfoBar` applies them every second while a turn runs), `session_state.js` (what the page knows about the open session: its empty state, and `sessionStateFrom`, the fields a `GET /sessions/:id` payload sets), `refs.js` (refs: a kind and a target on the element, a plugin's ref data (label, http(s) URL actions) bound in a WeakMap by `bindRef`, the targets per kind, show in turn, one delegated set of click, key and hover listeners), `ref_menu.js` (a ref's `▾` and its menu), `ref_scan.js` (the `path:line` refs in an answer's or a step's text that name a file the session's rows touched), `answer_refs.js` (the refs a plugin attached to an answer, its `display_refs`: bound to the answer's bubble, paired with its links and text, bound with `bindRef`). Unit-tested via `npm test` (`spec/web/public/*.test.js`).
 - Selecting a session in the web UI is read-only: `GET /api/sessions/:id` never spawns a worker (it reads a live worker's snapshot when one runs, else the session file). A prompt (`POST /turn`) or a command (`POST /command`) wakes the worker, and `/stream` briefly waits for a freshly-spawned bridge before answering. A caught-up SSE reconnect holds the stream open; `reset` markers are only sent for reconnects behind the ring window, or with a cursor from another worker (event ids are `<event_seq>-<epoch>`, one epoch per worker).
+- The web session page's message box folds away for room to read. Drag the grip on its top edge (the pill that shows on hover; always on a phone) down, past the box by 32 px: the pill turns accent while releasing would hide it, and on release the box folds and the info bar stays as the page's bottom edge. The grip stays as a handle on the info bar's top edge, drawn always: pull it up (8 px opens it, and the box follows the pointer in the same gesture), click or tap it (opens it and focuses the box), or just type on the page (the key lands in the box) to bring it back; Enter or Space on the focused grip folds or opens too. A draft (text or images, which folding never clears) colours the handle with the accent, a session waiting on you with the attention colour; its tooltip says so. Stop turn moves into the info bar while it is folded. The fold is remembered per browser (`chi_composer_collapsed`), an archived session opens folded for the visit, and opening it there, like the page opening it itself (a restored line, a quote, continue →'s opener), is for that visit only, and a fold forgets the height the grip set (`chi_composer_floor`): the box reopens at one line, or at its text's height. The start page's grip only resizes.
 
 **Test-session hygiene:**
 

data/lib/samagotchi/broadcast/recipients.rb

@@ -4,8 +4,8 @@ require "time"
 require_relative "../session"
 
 module Samagotchi
-  # Loaded on first use: session_manager requires terminal_ui, which
-  # requires KernelLoop and so the tools (a require cycle otherwise).
+  # Loaded on first use: this autoload keeps SessionManager and its ~80
+  # files unloaded until the delegate/session path needs them.
   autoload :SessionManager, File.expand_path("../session_manager", __dir__)
 
   module Broadcast

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.77.0
+version: 0.78.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_move.rb

@@ -11,8 +11,8 @@ require_relative "log"
 require_relative "tools/delegate_cursor"
 
 module Samagotchi
-  # Loaded on first use: session_manager requires terminal_ui, which
-  # requires KernelLoop and so the tools (a require cycle otherwise).
+  # Loaded on first use: session_manager requires this file (a require cycle
+  # otherwise).
   autoload :SessionManager, File.expand_path("session_manager", __dir__)
   # SessionContinue::OpenChild, the rows a plan refuses: loaded on first use too.
   autoload :SessionContinue, File.expand_path("session_continue", __dir__)

data/lib/samagotchi/child_reports.rb

@@ -12,8 +12,8 @@ require_relative "tools/delegate_wait"
 require_relative "tools/delegate_cursor"
 
 module Samagotchi
-  # Loaded on first use: session_manager requires terminal_ui, which
-  # requires KernelLoop and so the tools (a require cycle otherwise).
+  # Loaded on first use: this autoload keeps SessionManager and its ~80
+  # files unloaded until the delegate/session path needs them.
   autoload :SessionManager, File.expand_path("session_manager", __dir__)
 
   # A delegate child's news reaching its parent by itself (the delegate

data/lib/samagotchi/children_status.rb

@@ -9,8 +9,8 @@ require_relative "tools/delegate"
 require_relative "tools/delegate_cursor"
 
 module Samagotchi
-  # Loaded on first use: session_manager requires terminal_ui, which
-  # requires KernelLoop and so the tools (a require cycle otherwise).
+  # Loaded on first use: this autoload keeps SessionManager and its ~80
+  # files unloaded until the delegate/session path needs them.
   autoload :SessionManager, File.expand_path("session_manager", __dir__)
 
   # A parent's children as `/children` and the glance views show them: one

data/lib/samagotchi/llm/anthropic_assembly.rb

@@ -44,14 +44,22 @@ module Samagotchi
         @stop_reason = nil
         @stop_details = nil
         @model = nil
+        @input_transformations = []
       end
 
+      # The message's input_transformations (Claude 5.x: what the API did to
+      # the request before generating, e.g. the thinking blocks drop_block
+      # dropped), as sent (string keys); [] when it named none. The paths
+      # index into the request body, which only the adapter holds.
+      attr_reader :input_transformations
+
       # A whole message: its model, usage, stop reason and blocks.
       def add_message(message)
         return unless message.is_a?(Hash)
 
         @model = served(message["model"]) || @model
         merge_usage(message["usage"])
+        read_transformations(message)
         @stop_reason = message["stop_reason"] if message["stop_reason"]
         @stop_details = message["stop_details"] if message["stop_details"].is_a?(Hash)
         Array(message["content"]).each { |block| @blocks << block.dup if block.is_a?(Hash) }
@@ -133,9 +141,15 @@ module Samagotchi
 
         @model = served(message["model"]) || @model
         merge_usage(message["usage"])
+        read_transformations(message)
         ["", ""]
       end
 
+      def read_transformations(message)
+        entries = message["input_transformations"]
+        @input_transformations = entries.select { |entry| entry.is_a?(Hash) } if entries.is_a?(Array)
+      end
+
       def start_block(index, block)
         return ["", ""] unless block.is_a?(Hash)
 

data/lib/samagotchi/llm/anthropic_messages.rb

@@ -43,6 +43,11 @@ module Samagotchi
     #   breakpoints for the host;
     # - max_tokens over the model's output limit: the limit the message
     #   names, per model.
+    # A signature 400 (Claude 5.x preserved thinking: a replayed block bound
+    # to a prefix that changed) is recovered here too (#binding_recovery):
+    # asked again with drop_block, or with the blocks stripped, and the
+    # dropped blocks handed to the loop (ChatResponse#thinking_drop), which
+    # removes them from the history.
     class AnthropicMessages
       include ModelListing
       include AdapterCommon
@@ -71,6 +76,27 @@ module Samagotchi
       # (configured sampling passes as written).
       DROPPED_OPTIONS = %i[reasoning_effort chat_template_kwargs stream_options prompt_cache_key logprobs top_logprobs
                            max_completion_tokens].freeze
+      # The beta header thinking.block_binding needs, and the behaviour the
+      # recovery asks for: the API drops a thinking block whose prefix
+      # changed (and every thinking block after it) for that request.
+      BINDING_BETA = "thinking-binding-controls-2026-08-01"
+      DROP_BLOCK = { prefix_mismatch_behavior: "drop_block" }.freeze
+      # A signature 400 that drop_block can settle: the block is valid but
+      # bound to another prefix. Without it the signature itself is bad
+      # (tampered, unreadable, another provider's): only a strip helps.
+      BOUND_ELSEWHERE_RE = /bound to a different conversation/i
+      # The block a signature 400 names: an index into the body sent.
+      BLOCK_PATH_RE = /messages\.(\d+)\.content\.(\d+)/
+      THINKING_TYPES = %w[thinking redacted_thinking].freeze
+      # The only drop the loop settles: a model_binding_mismatch (a /model
+      # downgrade) keeps its blocks, a switch back reads them again.
+      PREFIX_DROP = "prefix_binding_mismatch"
+
+      # One request's binding recovery (#binding_recovery): the step taken
+      # (nil, :drop_block or :strip), the steps tried, where a strip starts
+      # ([message, block] in the body), the last signature 400 and the body
+      # it answered, and the first 400's last sentence and diagnosis for the log line.
+      Recovery = Struct.new(:step, :tried, :strip_from, :signature, :why, :diagnosis)
 
       attr_reader :base_url, :host_name, :api_key_env, :models_ttl, :first_token_timeout, :dialect
 
@@ -111,14 +137,29 @@ module Samagotchi
       def chat(messages:, model:, tools: [], cancel_controller: nil, on_delta: nil, on_retry: nil, options: {},
                session_id: nil)
         fixed = []
+        recovery = Recovery.new(tried: [])
+        shown = false
         begin
-          body = request_body(messages, tools, model, options)
-          request = post_request("#{@base_url}/v1/messages", body, session_id: session_id)
+          # A rebuilt body (a refusal fix's retry) keeps the recovery.
+          body, stripped = recovered_body(request_body(messages, tools, model, options), recovery)
+          headers = recovery.step == :drop_block ? { "anthropic-beta" => BINDING_BETA } : {}
+          request = post_request("#{@base_url}/v1/messages", body, session_id: session_id, extra_headers: headers)
           log_fields = { model: model, purpose: @purpose, sampling: sampling_summary(body), cache: cache_summary(body) }
-          return chat_once(request, cancel_controller, log_fields) unless @stream
-
-          chat_streamed(request, cancel_controller, on_delta, on_retry, log_fields)
+          response, transformations =
+            if @stream
+              chat_streamed(request, cancel_controller, on_delta, on_retry, log_fields, -> { shown = true })
+            else
+              chat_once(request, cancel_controller, log_fields)
+            end
+          recovery.step ? with_thinking_drop(response, recovery, body, stripped, transformations, model) : response
         rescue BadRequest => e
+          # Only before anything was shown: a mid-stream error must not
+          # repeat its deltas.
+          if !shown && binding_recovery(e, body, recovery, model)
+            recovery.tried << recovery.step
+            retry
+          end
+
           fix = refusal_fix(e, body, model)
           raise if fix.nil? || fixed.include?(fix)
 
@@ -249,6 +290,152 @@ module Samagotchi
         body.merge(max_tokens: max_tokens, thinking: thinking.merge(budget_tokens: budget))
       end
 
+      # The step a signature 400 for +body+ takes (set on +recovery+, once
+      # each per request), or nil: the error goes on as it is.
+      # - drop_block: the same body with thinking.block_binding and the beta
+      #   header, for a block bound to another prefix, when the host takes
+      #   the controls and the body's thinking can carry them (adaptive,
+      #   enabled, or none: then adaptive; not disabled, nor none for a
+      #   model on the budget form);
+      # - strip: the block the 400 names (else the first replayed thinking
+      #   block) and every thinking block after it removed, for a bad
+      #   signature, where drop_block can't apply, when the host refused
+      #   the controls (remembered for the host), or after a second
+      #   signature 400.
+      def binding_recovery(error, body, recovery, model)
+        return nil if body.nil? || error.status != 400
+
+        if error.thinking_binding_unsupported? && recovery.step == :drop_block
+          unless @refusals.refused?(:binding_controls)
+            @refusals.remember(:binding_controls)
+            Log.info(:http, "binding_controls_refused", host: @host_name, detail: error.detail.to_s[0, 200])
+          end
+          return strip_step(recovery)
+        end
+        return nil unless error.thinking_signature?
+
+        recovery.diagnosis ||= error.diagnosis
+        recovery.signature = [error.detail.to_s, body]
+        case recovery.step
+        when nil
+          return nil if thinking_positions(body).empty?
+
+          recovery.why = last_sentence(error.detail.to_s)
+          return strip_step(recovery) unless drop_block_fits?(error, body, model)
+
+          recovery.step = :drop_block
+        when :drop_block then strip_step(recovery)
+        end
+      end
+
+      def drop_block_fits?(error, body, model)
+        return false unless BOUND_ELSEWHERE_RE.match?(error.detail.to_s) && !@refusals.refused?(:binding_controls)
+
+        case body[:thinking]
+        when nil then !budget_form?(model)
+        when Hash then %w[adaptive enabled].include?(body[:thinking][:type].to_s)
+        else false
+        end
+      end
+
+      # The strip, from the block the last signature 400 names in the body
+      # it answered (a thinking block there), else the first replayed one.
+      def strip_step(recovery)
+        return nil if recovery.tried.include?(:strip)
+
+        detail, body = recovery.signature
+        positions = thinking_positions(body)
+        named = detail.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        recovery.strip_from = positions.include?(named) ? named : positions.first
+        recovery.step = recovery.strip_from && :strip
+      end
+
+      # [message, block] of every thinking or redacted_thinking block in
+      # +body+'s messages.
+      def thinking_positions(body)
+        Array(body[:messages]).each_with_index.flat_map do |message, n|
+          Array(message[:content]).each_with_index.filter_map { |block, m| [n, m] if thinking_block?(block) }
+        end
+      end
+
+      def thinking_block?(block) = block.is_a?(Hash) && THINKING_TYPES.include?((block["type"] || block[:type]).to_s)
+
+      # +body+ as the recovery step sends it, and the identities a strip
+      # removed (nil for none).
+      def recovered_body(body, recovery)
+        case recovery.step
+        when :drop_block then [body.merge(thinking: drop_block_thinking(body[:thinking])), nil]
+        when :strip then stripped_body(body, recovery.strip_from)
+        else [body, nil]
+        end
+      end
+
+      # The body's thinking with block_binding: drop_block (adaptive
+      # without one: the binding controls need adaptive or enabled).
+      def drop_block_thinking(thinking)
+        thinking = thinking.is_a?(Hash) ? thinking.transform_keys(&:to_sym) : {}
+        thinking = { type: "adaptive" } unless %w[adaptive enabled].include?(thinking[:type].to_s)
+        thinking.merge(block_binding: DROP_BLOCK)
+      end
+
+      # +body+ without the thinking blocks from +from+ on (a trailing run:
+      # what Messages takes; a gap in the middle it refuses), and their
+      # identities. A message left empty says the placeholder.
+      def stripped_body(body, from)
+        first_message, first_block = from
+        removed = []
+        messages = body[:messages].each_with_index.map do |message, n|
+          next message if n < first_message
+
+          content = message[:content].each_with_index.reject do |block, m|
+            drop = (n > first_message || m >= first_block) && thinking_block?(block)
+            removed << AnthropicWire.block_identity(block) if drop
+            drop
+          end.map(&:first)
+          next message if content.size == message[:content].size
+
+          message.merge(content: content.empty? ? [{ type: "text", text: AnthropicWire::PLACEHOLDER }] : content)
+        end
+        [body.merge(messages: messages), removed.compact.uniq.freeze]
+      end
+
+      # +response+ with the blocks this request went without
+      # (ThinkingDrop), logged: a strip's, or drop_block's
+      # prefix_binding_mismatch entries mapped by path into +body+ (the
+      # body sent); any other entry is counted as kept, never settled.
+      def with_thinking_drop(response, recovery, body, stripped, transformations, model)
+        if recovery.step == :strip
+          identities = stripped
+          kept = 0
+        else
+          drops = Array(transformations).select { |entry| entry["type"] == "thinking_dropped" }
+          prefix, others = drops.partition { |entry| entry["reason"] == PREFIX_DROP }
+          identities = prefix.filter_map { |entry| identity_at(body, entry["path"]) }.uniq.freeze
+          kept = others.size
+        end
+        fields = { host: @host_name, model: model.to_s, how: recovery.step.to_s, dropped: identities.size,
+                   kept: kept, why: recovery.why }
+        fields[:diagnosis] = recovery.diagnosis if recovery.diagnosis
+        Log.info(:http, "thinking_recovered", **fields)
+        return response if identities.empty?
+
+        response.with(thinking_drop: ThinkingDrop.new(identities: identities, how: recovery.step))
+      end
+
+      def identity_at(body, path)
+        n, m = path.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        return nil unless n
+
+        block = Array(body[:messages])[n]&.then { |message| Array(message[:content])[m] }
+        thinking_block?(block) ? AnthropicWire.block_identity(block) : nil
+      end
+
+      # The last sentence of a 400 (what it says changed: "The `system`
+      # prompt differs …"), at most 200 characters.
+      def last_sentence(detail)
+        detail.strip.split(/(?<=\.)\s+/).last.to_s[0, 200]
+      end
+
       # What a 400 for +body+ changes (remembered), or nil: the error goes
       # on as it is.
       def refusal_fix(error, body, model)
@@ -309,30 +496,40 @@ module Samagotchi
         raise error if error
         raise ProtocolError.new("#{@host_name}: no content in the Messages response", host: @host_name) unless message?(body)
 
-        AnthropicAssembly.from_message(body).response
+        assembly = AnthropicAssembly.from_message(body)
+        [assembly.response, assembly.input_transformations]
       end
 
       def message?(body) = body.is_a?(Hash) && body["content"].is_a?(Array)
 
       # The SSE stream: each `data:` event goes through the assembly (the
       # `event:` lines are not needed, so a gateway that drops them works);
-      # on_delta gets every event but pings, with its text and reasoning.
-      def chat_streamed(request, cancel_controller, on_delta, on_retry, log_fields)
-        stream_assembled(request, cancel_controller, on_retry, log_fields, assembly_class: AnthropicAssembly,
-                                                                           what: "stream event") do |assembly, event, shown|
+      # on_delta gets every event but pings, with its text and reasoning;
+      # +on_shown+ hears each event that shows something. Returns the
+      # response and the message's input_transformations.
+      def chat_streamed(request, cancel_controller, on_delta, on_retry, log_fields, on_shown = nil)
+        last = nil
+        response = stream_assembled(request, cancel_controller, on_retry, log_fields, assembly_class: AnthropicAssembly,
+                                                                                      what: "stream event") do |assembly, event, shown|
+          last = assembly
           content, reasoning = assembly.add(event)
-          shown.call if AnthropicAssembly.shows?(event)
+          if AnthropicAssembly.shows?(event)
+            shown.call
+            on_shown&.call
+          end
           on_delta&.call(content: content, reasoning: reasoning, payload: assembly.with_usage(event)) unless event["type"] == "ping"
         end
+        [response, last&.input_transformations || []]
       end
 
-      def post_request(url, body, session_id: nil)
+      # +extra_headers+ go after the defaults (the binding beta).
+      def post_request(url, body, session_id: nil, extra_headers: {})
         headers = { "anthropic-version" => API_VERSION }
         unless session_id.to_s.empty?
           headers["Session-Id"] = session_id.to_s
           headers[@dialect.session_header] = session_id.to_s if @dialect.session_header
         end
-        json_post(url, body, headers)
+        json_post(url, body, headers.merge(extra_headers))
       end
     end
   end