samagotchi 0.78.0 → 0.79.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b19c3433cc4f46956563a8e4e6532d8b60061084b8050b534b9230b3c608c54
-  data.tar.gz: 97b8e078c43e1c9901139f1f937d16e43b57b6147cd8298fbb9b77abb37c0b96
+  metadata.gz: fc74f7069433e0f6be4252973309183e17c3ecc7ad06800684bf9be6fe40015f
+  data.tar.gz: 12a8d7e7c8002a8762d7752f6cae9bd20fae6565cb2d81636cc1ca9a6ff2469d
 SHA512:
-  metadata.gz: '0022706491e62a2d7f603a5290fd4c5525b17c6712af6d31dc5ce163b36c4e4414074d7b4da609f890ec5e243ea89b33a5ba0621528d8face6c5226108d0a443'
-  data.tar.gz: da23fef030284a3401d5ec17017ef2a7d1165d30909f4a96e095823315bc38bbbe1eaf1bdfd76eefe604af19cd160c5f68fd19cb3c4ccb478b28bd9ea1de57eb
+  metadata.gz: 004ef50c618ba8bb488adf9e5623da491691bf37850946870bb94511451d8e56876288232d0bae0212dcfc7d9a1c79544d4297ef0ab8692f5678ff3617fc144c
+  data.tar.gz: cb551afd6bdae21bfd61a4ff64ead0306816b41b88f4b5083fbf5e7d2afbb9ef9b9353d5d5750ccbfd1764fe10db8c60f8eb534a2cd4d728b04e3145f84dad4a

data/CHANGELOG.md

@@ -8,6 +8,19 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.79.0] - 2026-10-17
+
+### Fixed
+
+- Web: a repeated toast cannot unstick a sticky error and make it time out.
+- Anthropic: `api: anthropic` hosts on the Claude API now read their model list, including 1M-token windows and image
+  input, so `chi models` and model validation work.
+- Anthropic: on Claude 5.x models, which turn thinking off by `between_tools` and refuse `disabled`, recaps, side
+  answers and `--thinking off` sessions now send `thinking: {type: "between_tools"}` after that 400 (a recap used to
+  fall back to adaptive thinking at low effort, a `--thinking off` session to the provider's default thinking). Each
+  side-answer client learns it once for itself.
+- A host whose model list fails is asked again at most once a minute (it was asked on every context-window lookup).
+
 ## [0.78.0] - 2026-10-17
 
 ### Added
@@ -3269,7 +3282,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.78.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.79.0...HEAD
+[0.79.0]: https://github.com/dm1try/samagotchi/compare/v0.78.0...v0.79.0
 [0.78.0]: https://github.com/dm1try/samagotchi/compare/v0.77.0...v0.78.0
 [0.77.0]: https://github.com/dm1try/samagotchi/compare/v0.76.0...v0.77.0
 [0.76.0]: https://github.com/dm1try/samagotchi/compare/v0.75.0...v0.76.0

data/docs/configuration.md

@@ -644,8 +644,10 @@ What each backend gets:
 | Messages host, `dialect: fireworks` | `thinking: {type: "disabled"}` | `thinking: {type: "adaptive"}` and `output_config: {effort: <level>}` (no `display`) |
 
 On a Messages host `default` sends nothing: the provider's own default, which differs by model (some Claude models
-think adaptively but show no thinking text, their blocks still going back; others, and Splash, don't think at all). A model that refuses `disabled` (current
-Claude models) gets the request again without it, as on any chat host. A model that refuses adaptive thinking
+think adaptively but show no thinking text, their blocks still going back; others, and Splash, don't think at all). A model that refuses `disabled` and names `between_tools` in the 400 (Claude 5.x) gets `thinking: {type:
+"between_tools"}` wherever `off` asked for `disabled`, from then on: the adapter keeps that per model for as long as it
+lives, so a worker's turns keep it, and each side-answer client (recap, `ctx.ask_model`, a broadcast's triage) learns it
+once for itself. One that refuses `disabled` without naming it gets the request again without it, as on any chat host. A model that refuses adaptive thinking
 (older Claude: Haiku 4.5) is switched, once and for the worker's life, to the budget form: `thinking: {type:
 "enabled", budget_tokens: B}` with B 2048 / 8192 / 24576 for low / medium / high and no effort; `max_tokens` always
 stays above the budget (the budget is lowered to leave 1024 for the answer, or `max_tokens` raised to 2048). A

data/docs/internals/anthropic.md

@@ -17,7 +17,7 @@ ChatLoop::Run#generate
       → POST {base}/v1/messages             # LLM::HTTP: retries, cancel, first-token limit
       → AnthropicAssembly#add per SSE event # → ChatResponse (text, reasoning, tool_calls, usage,
                                             #   finish_reason, provider_content)
-      → a signature 400 (Claude 5.x preserved thinking): #binding_recovery, then the same
+      → a signature 400 (Claude 5.x preserved thinking): AnthropicBindingRecovery#advance, then the same
         request with drop_block or the blocks stripped; ChatResponse#thinking_drop names them
       → a 400 it can fix: #refusal_fix, then the same request again (once per kind)
   → ChatLoop#settle_dropped_thinking!       # the dropped blocks leave the stored model entries
@@ -31,6 +31,7 @@ Paths are under `lib/samagotchi/llm/`.
 |---|---|
 | `adapters.rb` | `Adapters::BY_API` (`openai`, `anthropic`), `.for(entry)`, `.build(api:, …)` for side requests (`IdleClient`) |
 | `anthropic_messages.rb` | `AnthropicMessages`: the request body, `#chat` (streamed or not), the 400 fixes, `#list_models`, `#thinking_fields`, `#replays_content?` |
+| `anthropic_binding_recovery.rb` | `AnthropicBindingRecovery`: the preserved-thinking recovery (`#advance` picks drop_block or strip for a signature 400, `#recovered_body`, `#with_thinking_drop`); one per adapter |
 | `anthropic_wire.rb` | `AnthropicWire`: ChatLoop's wire messages as Messages' `system` and `messages`, the two breakpoints, tool ids and names |
 | `anthropic_assembly.rb` | `AnthropicAssembly`: a response from a whole body (`.from_message`) or stream events (`#add`), its usage in the OpenAI shape |
 | `dialect.rb` | `Dialect` (`STANDARD`, `FIREWORKS`): what a provider's `/v1/messages` does differently |
@@ -54,7 +55,8 @@ with `tool_choice: {type: "auto"}` (when any), then the loop's options. The opti
 (`default.max_tokens`), else the model list's `max_tokens` capped at `DEFAULT_MAX_TOKENS` (64000), and never over an
 output cap a 400 named. `#with_budget_room` keeps `max_tokens` above a budget-form `budget_tokens` plus `MIN_BUDGET`.
 
-`#thinking_fields(level)` is the thinking level on this wire: `off` is `thinking: {type: "disabled"}`; `low`, `medium`
+`#thinking_fields(level)` is the thinking level on this wire: `off` is `thinking: {type: "disabled"}` (sent as `{type:
+"between_tools"}` to a model whose 400 for `disabled` names that form, Claude 5.x: see the 400 fallbacks); `low`, `medium`
 and `high` are `thinking: {type: "adaptive", display: <dialect's>}` with `output_config: {effort: <level>}`; `default`
 sends nothing. `#thinking_off_refused_fields` (low effort) is what `IdleClient` sends a side ask whose model refused
 thinking off.
@@ -137,7 +139,7 @@ A model switch never 400s: the API drops blocks another model can't read silentl
 
 **Recover on the 400, then settle.** Normal requests carry no beta header and no `block_binding`, so Fireworks,
 Splash and gateways see the same bytes as before. On a signature 400, before anything streamed,
-`AnthropicMessages#binding_recovery` picks the next step, once each per request:
+`AnthropicBindingRecovery#advance` (one per adapter, `anthropic_binding_recovery.rb`) picks the next step, once each per request:
 
 - **drop_block**: the same body with `thinking.block_binding: {prefix_mismatch_behavior: "drop_block"}` (the body's
   adaptive or enabled thinking, `display` as sent; adaptive when the level sends none) and the header
@@ -209,12 +211,15 @@ thinking, nil for none), `cache_breakpoints` and `session_header`.
 
 `AnthropicMessages#chat` handles the 400s it can fix itself, once each per request, and remembers the fix for the
 adapter's life, so ChatLoop's broader paths never see them (`#refusal_fix`, logged under `http`; kept in an
-`LLM::RefusalMemo`, locked, since the turn, side-ask and recap threads share the host's adapter):
+`LLM::RefusalMemo`, locked, since the turn thread and the model-list reads share the host's adapter; `IdleClient`,
+whose recap, side answers and triage each build their own adapter (`Adapters.build`), keeps what it learned for that
+client's life only):
 
 | 400 about | Fix | Remembered |
 |---|---|---|
 | `thinking.display` (`DISPLAY_RE`) | no `display` from now on (`#without_display`), the thinking kept | per host (`thinking_display_refused`) |
 | adaptive thinking or its effort (`ADAPTIVE_REFUSED_RE`) | the budget form: `thinking: {type: "enabled", budget_tokens: BUDGETS[level]}`, no effort (`#budget_form`) | per model (`thinking_form_switched`) |
+| `thinking: {type: "disabled"}` where the 400 names `between_tools` (`THINKING_OFF_FORM_RE`; Claude 5.x) | `thinking: {type: "between_tools"}` wherever `disabled` was asked (`#thinking_between_tools`), so a recap or side answer (`IdleClient` step 0) and a `--thinking off` session never fall back to adaptive low or to no thinking fields; a model that refuses `between_tools` too raises the 400 as before | per model (`thinking_off_form_switched`) |
 | `cache_control` | no breakpoints | per host (`cache_control_refused`) |
 | `max_tokens: N > M` (`OUTPUT_CAP_RE`) | `max_tokens` capped at M | per model (`output_cap`) |
 | `block_binding` or the binding beta, on a drop_block retry (`thinking_binding_unsupported?`) | the strip instead (Preserved thinking) | per host (`binding_controls_refused`) |

data/docs/internals/engine.md

@@ -273,8 +273,8 @@ One iteration with tool calls:
           → an ask verdict: Gate#settle_ask (asks the user, records waited_ms)
           → KernelLoop#dispatch_tool_call, or the denial text
           → :tool_call_completed, then the :after_tool_call hook
-          → returns {output:, capped_output:, truncated:, activity:, images:, shown_params:,
-                     shown_label:, diff:}
+          → returns a ToolRun value object with output, capped_output, truncated, activity, images, shown_params,
+            shown_label, refs, diff and output_file; fields a call doesn't produce are nil
       → :tool_dispatch_completed {iteration, call_count}
     → native: ToolResponse.joined(runs, ids:), one entry with the capped outputs
       chat:   ToolResponse.single(run, tool_call_id:, ids:) as each call finishes (the block), with the

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.78.0
+version: 0.79.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/llm/adapter_common.rb

@@ -46,12 +46,14 @@ module Samagotchi
       # Every page of the host's model list (MAX_MODEL_PAGES at most): the
       # block gives a page's URI for the last page's last_id (nil first).
       # @return [Array<ModelInfo>]
-      def list_model_pages
+      def list_model_pages(headers: {})
         models = []
         after = nil
         MAX_MODEL_PAGES.times do
           uri = yield(after)
-          body = parse_json(@http.fetch(uri, Net::HTTP::Get.new(uri), log_fields: { purpose: "models" }).body, "model list")
+          request = Net::HTTP::Get.new(uri)
+          headers.each { |name, value| request[name] = value }
+          body = parse_json(@http.fetch(uri, request, log_fields: { purpose: "models" }).body, "model list")
           models.concat(model_entries(body).map { |raw| model_info(raw) })
           break unless body.is_a?(Hash) && body["has_more"] && body["last_id"]
 

data/lib/samagotchi/llm/anthropic_binding_recovery.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require_relative "../log"
+require_relative "anthropic_wire"
+require_relative "openai_chat"
+
+module Samagotchi
+  module LLM
+    # The preserved-thinking recovery of AnthropicMessages (Claude 5.x: a
+    # replayed thinking block is bound to the prefix it was made under, and
+    # a prefix that changed gets a signature 400): which step a 400 takes
+    # (#advance), the body that step sends (#recovered_body) and the
+    # response's ThinkingDrop (#with_thinking_drop). One per adapter; a
+    # request's own state is a Recovery.
+    class AnthropicBindingRecovery
+      # The beta header thinking.block_binding needs, and the behaviour the
+      # recovery asks for: the API drops a thinking block whose prefix
+      # changed (and every thinking block after it) for that request.
+      BINDING_BETA = "thinking-binding-controls-2026-08-01"
+      DROP_BLOCK = { prefix_mismatch_behavior: "drop_block" }.freeze
+      # A signature 400 that drop_block can settle: the block is valid but
+      # bound to another prefix. Without it the signature itself is bad
+      # (tampered, unreadable, another provider's): only a strip helps.
+      BOUND_ELSEWHERE_RE = /bound to a different conversation/i
+      # The block a signature 400 names: an index into the body sent.
+      BLOCK_PATH_RE = /messages\.(\d+)\.content\.(\d+)/
+      # The only drop the loop settles: a model_binding_mismatch (a /model
+      # downgrade) keeps its blocks, a switch back reads them again.
+      PREFIX_DROP = "prefix_binding_mismatch"
+
+      # One request's binding recovery (#advance): the step taken
+      # (nil, :drop_block or :strip), the steps tried, where a strip starts
+      # ([message, block] in the body), the last signature 400 and the body
+      # it answered, and the first 400's last sentence and diagnosis for the log line.
+      Recovery = Struct.new(:step, :tried, :strip_from, :signature, :why, :diagnosis)
+
+      # @param refusals [RefusalMemo] the adapter's (the :binding_controls
+      #   the host refused is remembered there)
+      # @param host_name [String] for the log lines
+      # @param budget_form [#call] model -> whether it gets the budget form
+      #   (AnthropicMessages#budget_form?)
+      def initialize(refusals:, host_name:, budget_form:)
+        @refusals = refusals
+        @host_name = host_name
+        @budget_form = budget_form
+      end
+
+      # The step a signature 400 for +body+ takes (set on +recovery+, once
+      # each per request), or nil: the error goes on as it is.
+      # - drop_block: the same body with thinking.block_binding and the beta
+      #   header, for a block bound to another prefix, when the host takes
+      #   the controls and the body's thinking can carry them (adaptive,
+      #   enabled, or none: then adaptive; not disabled, nor none for a
+      #   model on the budget form);
+      # - strip: the block the 400 names (else the first replayed thinking
+      #   block) and every thinking block after it removed, for a bad
+      #   signature, where drop_block can't apply, when the host refused
+      #   the controls (remembered for the host), or after a second
+      #   signature 400.
+      def advance(error, body, recovery, model)
+        return nil if body.nil? || error.status != 400
+
+        if error.thinking_binding_unsupported? && recovery.step == :drop_block
+          unless @refusals.refused?(:binding_controls)
+            @refusals.remember(:binding_controls)
+            Log.info(:http, "binding_controls_refused", host: @host_name, detail: error.detail.to_s[0, 200])
+          end
+          return strip_step(recovery)
+        end
+        return nil unless error.thinking_signature?
+
+        recovery.diagnosis ||= error.diagnosis
+        recovery.signature = [error.detail.to_s, body]
+        case recovery.step
+        when nil
+          return nil if thinking_positions(body).empty?
+
+          recovery.why = last_sentence(error.detail.to_s)
+          return strip_step(recovery) unless drop_block_fits?(error, body, model)
+
+          recovery.step = :drop_block
+        when :drop_block then strip_step(recovery)
+        end
+      end
+
+      # +body+ as the recovery step sends it, and the identities a strip
+      # removed (nil for none).
+      def recovered_body(body, recovery)
+        case recovery.step
+        when :drop_block then [body.merge(thinking: drop_block_thinking(body[:thinking])), nil]
+        when :strip then stripped_body(body, recovery.strip_from)
+        else [body, nil]
+        end
+      end
+
+      # +response+ with the blocks this request went without
+      # (ThinkingDrop), logged: a strip's, or drop_block's
+      # prefix_binding_mismatch entries mapped by path into +body+ (the
+      # body sent); any other entry is counted as kept, never settled.
+      def with_thinking_drop(response, recovery, body, stripped, transformations, model)
+        if recovery.step == :strip
+          identities = stripped
+          kept = 0
+        else
+          drops = Array(transformations).select { |entry| entry["type"] == "thinking_dropped" }
+          prefix, others = drops.partition { |entry| entry["reason"] == PREFIX_DROP }
+          identities = prefix.filter_map { |entry| identity_at(body, entry["path"]) }.uniq.freeze
+          kept = others.size
+        end
+        fields = { host: @host_name, model: model.to_s, how: recovery.step.to_s, dropped: identities.size,
+                   kept: kept, why: recovery.why }
+        fields[:diagnosis] = recovery.diagnosis if recovery.diagnosis
+        Log.info(:http, "thinking_recovered", **fields)
+        return response if identities.empty?
+
+        response.with(thinking_drop: ThinkingDrop.new(identities: identities, how: recovery.step))
+      end
+
+      private
+
+      def drop_block_fits?(error, body, model)
+        return false unless BOUND_ELSEWHERE_RE.match?(error.detail.to_s) && !@refusals.refused?(:binding_controls)
+
+        case body[:thinking]
+        when nil then !@budget_form.call(model)
+        when Hash then %w[adaptive enabled].include?(body[:thinking][:type].to_s)
+        else false
+        end
+      end
+
+      # The strip, from the block the last signature 400 names in the body
+      # it answered (a thinking block there), else the first replayed one.
+      def strip_step(recovery)
+        return nil if recovery.tried.include?(:strip)
+
+        detail, body = recovery.signature
+        positions = thinking_positions(body)
+        named = detail.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        recovery.strip_from = positions.include?(named) ? named : positions.first
+        recovery.step = recovery.strip_from && :strip
+      end
+
+      # [message, block] of every thinking or redacted_thinking block in
+      # +body+'s messages.
+      def thinking_positions(body)
+        Array(body[:messages]).each_with_index.flat_map do |message, n|
+          Array(message[:content]).each_with_index.filter_map { |block, m| [n, m] if AnthropicWire.thinking_block?(block) }
+        end
+      end
+
+      # The body's thinking with block_binding: drop_block (adaptive
+      # without one: the binding controls need adaptive or enabled).
+      def drop_block_thinking(thinking)
+        thinking = thinking.is_a?(Hash) ? thinking.transform_keys(&:to_sym) : {}
+        thinking = { type: "adaptive" } unless %w[adaptive enabled].include?(thinking[:type].to_s)
+        thinking.merge(block_binding: DROP_BLOCK)
+      end
+
+      # +body+ without the thinking blocks from +from+ on (a trailing run:
+      # what Messages takes; a gap in the middle it refuses), and their
+      # identities. A message left empty says the placeholder.
+      def stripped_body(body, from)
+        first_message, first_block = from
+        removed = []
+        messages = body[:messages].each_with_index.map do |message, n|
+          next message if n < first_message
+
+          content = message[:content].each_with_index.reject do |block, m|
+            drop = (n > first_message || m >= first_block) && AnthropicWire.thinking_block?(block)
+            removed << AnthropicWire.block_identity(block) if drop
+            drop
+          end.map(&:first)
+          next message if content.size == message[:content].size
+
+          message.merge(content: content.empty? ? [{ type: "text", text: AnthropicWire::PLACEHOLDER }] : content)
+        end
+        [body.merge(messages: messages), removed.compact.uniq.freeze]
+      end
+
+      def identity_at(body, path)
+        n, m = path.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        return nil unless n
+
+        block = Array(body[:messages])[n]&.then { |message| Array(message[:content])[m] }
+        AnthropicWire.thinking_block?(block) ? AnthropicWire.block_identity(block) : nil
+      end
+
+      # The last sentence of a 400 (what it says changed: "The `system`
+      # prompt differs …"), at most 200 characters.
+      def last_sentence(detail)
+        detail.strip.split(/(?<=\.)\s+/).last.to_s[0, 200]
+      end
+    end
+  end
+end

data/lib/samagotchi/llm/anthropic_messages.rb

@@ -13,6 +13,7 @@ require_relative "openai_chat"
 require_relative "prompt_cache"
 require_relative "refusal_memo"
 require_relative "anthropic_assembly"
+require_relative "anthropic_binding_recovery"
 require_relative "anthropic_wire"
 require_relative "dialect"
 
@@ -36,6 +37,9 @@ module Samagotchi
     # broader refusal paths never see them:
     # - adaptive thinking (or output_config.effort) refused: the model gets
     #   the budget form instead (#budget_form), per model;
+    # - thinking off refused for the `between_tools` form (Claude 5.x:
+    #   `thinking: {type: "disabled"}` is refused, the 400 names
+    #   `between_tools`): that form from then on, per model;
     # - thinking.display refused (a provider whose thinking schema has no
     #   such field, e.g. Fireworks without its dialect): no display for the
     #   host, the thinking itself kept;
@@ -44,7 +48,7 @@ module Samagotchi
     # - max_tokens over the model's output limit: the limit the message
     #   names, per model.
     # A signature 400 (Claude 5.x preserved thinking: a replayed block bound
-    # to a prefix that changed) is recovered here too (#binding_recovery):
+    # to a prefix that changed) is recovered here too (AnthropicBindingRecovery):
     # asked again with drop_block, or with the blocks stripped, and the
     # dropped blocks handed to the loop (ChatResponse#thinking_drop), which
     # removes them from the history.
@@ -60,6 +64,10 @@ module Samagotchi
       # A 400 refusing adaptive thinking or its effort.
       ADAPTIVE_REFUSED_RE = /adaptive|output_config|effort/i
       CACHE_CONTROL_RE = /cache_control/i
+      # A 400 refusing `thinking: disabled` and naming the form that model
+      # takes for off: "To turn thinking off on this model, send "thinking":
+      # {"type": "between_tools"} instead of {"type": "disabled"}" (Claude 5.x).
+      THINKING_OFF_FORM_RE = /between_tools/i
       # A 400 refusing the thinking display field: its path (pydantic:
       # "thinking.adaptive.display"), or the field named as unknown or not
       # permitted. Not an error that only echoes the input
@@ -76,27 +84,6 @@ module Samagotchi
       # (configured sampling passes as written).
       DROPPED_OPTIONS = %i[reasoning_effort chat_template_kwargs stream_options prompt_cache_key logprobs top_logprobs
                            max_completion_tokens].freeze
-      # The beta header thinking.block_binding needs, and the behaviour the
-      # recovery asks for: the API drops a thinking block whose prefix
-      # changed (and every thinking block after it) for that request.
-      BINDING_BETA = "thinking-binding-controls-2026-08-01"
-      DROP_BLOCK = { prefix_mismatch_behavior: "drop_block" }.freeze
-      # A signature 400 that drop_block can settle: the block is valid but
-      # bound to another prefix. Without it the signature itself is bad
-      # (tampered, unreadable, another provider's): only a strip helps.
-      BOUND_ELSEWHERE_RE = /bound to a different conversation/i
-      # The block a signature 400 names: an index into the body sent.
-      BLOCK_PATH_RE = /messages\.(\d+)\.content\.(\d+)/
-      THINKING_TYPES = %w[thinking redacted_thinking].freeze
-      # The only drop the loop settles: a model_binding_mismatch (a /model
-      # downgrade) keeps its blocks, a switch back reads them again.
-      PREFIX_DROP = "prefix_binding_mismatch"
-
-      # One request's binding recovery (#binding_recovery): the step taken
-      # (nil, :drop_block or :strip), the steps tried, where a strip starts
-      # ([message, block] in the body), the last signature 400 and the body
-      # it answered, and the first 400's last sentence and diagnosis for the log line.
-      Recovery = Struct.new(:step, :tried, :strip_from, :signature, :why, :diagnosis)
 
       attr_reader :base_url, :host_name, :api_key_env, :models_ttl, :first_token_timeout, :dialect
 
@@ -126,6 +113,7 @@ module Samagotchi
         # The 400 fixes (#refusal_fix): :thinking_form and :output_cap per
         # model, :thinking_display and :cache_control for the host.
         @refusals = RefusalMemo.new
+        @binding = AnthropicBindingRecovery.new(refusals: @refusals, host_name: @host_name, budget_form: method(:budget_form?))
         @http = build_http(timeout: timeout, open_timeout: open_timeout, retries: retries, retry_policy: retry_policy,
                            sleeper: sleeper, first_token_timeout: first_token_timeout,
                            api_key: ApiKey.for(api_key_env, host: @host_name, env: env, scheme: auth || @dialect.auth))
@@ -137,12 +125,12 @@ module Samagotchi
       def chat(messages:, model:, tools: [], cancel_controller: nil, on_delta: nil, on_retry: nil, options: {},
                session_id: nil)
         fixed = []
-        recovery = Recovery.new(tried: [])
+        recovery = AnthropicBindingRecovery::Recovery.new(tried: [])
         shown = false
         begin
           # A rebuilt body (a refusal fix's retry) keeps the recovery.
-          body, stripped = recovered_body(request_body(messages, tools, model, options), recovery)
-          headers = recovery.step == :drop_block ? { "anthropic-beta" => BINDING_BETA } : {}
+          body, stripped = @binding.recovered_body(request_body(messages, tools, model, options), recovery)
+          headers = recovery.step == :drop_block ? { "anthropic-beta" => AnthropicBindingRecovery::BINDING_BETA } : {}
           request = post_request("#{@base_url}/v1/messages", body, session_id: session_id, extra_headers: headers)
           log_fields = { model: model, purpose: @purpose, sampling: sampling_summary(body), cache: cache_summary(body) }
           response, transformations =
@@ -151,11 +139,11 @@ module Samagotchi
             else
               chat_once(request, cancel_controller, log_fields)
             end
-          recovery.step ? with_thinking_drop(response, recovery, body, stripped, transformations, model) : response
+          recovery.step ? @binding.with_thinking_drop(response, recovery, body, stripped, transformations, model) : response
         rescue BadRequest => e
           # Only before anything was shown: a mid-stream error must not
           # repeat its deltas.
-          if !shown && binding_recovery(e, body, recovery, model)
+          if !shown && @binding.advance(e, body, recovery, model)
             recovery.tried << recovery.step
             retry
           end
@@ -202,16 +190,18 @@ module Samagotchi
       # @return [Hash] frozen
       def thinking_off_refused_fields = thinking_fields(:low)
 
+      # Whether +model+ gets the budget form (it refused adaptive thinking).
+      def budget_form?(model) = @refusals.refused?(:thinking_form, model.to_s)
+
       # The host's models, every page: GET {base}/v1/models with
       # limit=1000 and after_id paging (has_more/last_id). Anthropic's shape
       # (max_input_tokens, max_tokens, capabilities) and the OpenAI shape a
       # gateway or Splash serves here are both read (ModelListing).
-      # Whether +model+ gets the budget form (it refused adaptive thinking).
-      def budget_form?(model) = @refusals.refused?(:thinking_form, model.to_s)
-
       # @return [Array<ModelInfo>]
       def list_models
-        list_model_pages { |after| URI("#{@base_url}/v1/models?#{URI.encode_www_form({ limit: 1000, after_id: after }.compact)}") }
+        list_model_pages(headers: { "anthropic-version" => API_VERSION }) do |after|
+          URI("#{@base_url}/v1/models?#{URI.encode_www_form({ limit: 1000, after_id: after }.compact)}")
+        end
       end
 
       private
@@ -230,6 +220,7 @@ module Samagotchi
       def request_body(messages, tools, model, options)
         options = (options || {}).to_h.transform_keys(&:to_sym).except(*DROPPED_OPTIONS)
         options = budget_form(options) if budget_form?(model)
+        options = thinking_between_tools(options) if @refusals.refused?(:thinking_off_form, model.to_s)
         options = without_display(options) if @refusals.refused?(:thinking_display)
         cache = PromptCache.control if @purpose == "chat" && @dialect.cache_breakpoints && !@refusals.refused?(:cache_control)
         translated = AnthropicWire.translate(messages, cache: cache)
@@ -262,6 +253,16 @@ module Samagotchi
                       output_config: config.empty? ? nil : config)
       end
 
+      # +options+ with thinking off as the form such a model takes:
+      # `thinking: {type: "between_tools"}` where `disabled` was asked (a
+      # model that refused `disabled`).
+      def thinking_between_tools(options)
+        thinking = options[:thinking]
+        return options unless thinking.is_a?(Hash) && thinking.transform_keys(&:to_sym)[:type].to_s == "disabled"
+
+        options.merge(thinking: thinking.transform_keys(&:to_sym).merge(type: "between_tools"))
+      end
+
       # +options+ with no thinking.display (the host refused the field).
       def without_display(options)
         thinking = options[:thinking]
@@ -290,152 +291,6 @@ module Samagotchi
         body.merge(max_tokens: max_tokens, thinking: thinking.merge(budget_tokens: budget))
       end
 
-      # The step a signature 400 for +body+ takes (set on +recovery+, once
-      # each per request), or nil: the error goes on as it is.
-      # - drop_block: the same body with thinking.block_binding and the beta
-      #   header, for a block bound to another prefix, when the host takes
-      #   the controls and the body's thinking can carry them (adaptive,
-      #   enabled, or none: then adaptive; not disabled, nor none for a
-      #   model on the budget form);
-      # - strip: the block the 400 names (else the first replayed thinking
-      #   block) and every thinking block after it removed, for a bad
-      #   signature, where drop_block can't apply, when the host refused
-      #   the controls (remembered for the host), or after a second
-      #   signature 400.
-      def binding_recovery(error, body, recovery, model)
-        return nil if body.nil? || error.status != 400
-
-        if error.thinking_binding_unsupported? && recovery.step == :drop_block
-          unless @refusals.refused?(:binding_controls)
-            @refusals.remember(:binding_controls)
-            Log.info(:http, "binding_controls_refused", host: @host_name, detail: error.detail.to_s[0, 200])
-          end
-          return strip_step(recovery)
-        end
-        return nil unless error.thinking_signature?
-
-        recovery.diagnosis ||= error.diagnosis
-        recovery.signature = [error.detail.to_s, body]
-        case recovery.step
-        when nil
-          return nil if thinking_positions(body).empty?
-
-          recovery.why = last_sentence(error.detail.to_s)
-          return strip_step(recovery) unless drop_block_fits?(error, body, model)
-
-          recovery.step = :drop_block
-        when :drop_block then strip_step(recovery)
-        end
-      end
-
-      def drop_block_fits?(error, body, model)
-        return false unless BOUND_ELSEWHERE_RE.match?(error.detail.to_s) && !@refusals.refused?(:binding_controls)
-
-        case body[:thinking]
-        when nil then !budget_form?(model)
-        when Hash then %w[adaptive enabled].include?(body[:thinking][:type].to_s)
-        else false
-        end
-      end
-
-      # The strip, from the block the last signature 400 names in the body
-      # it answered (a thinking block there), else the first replayed one.
-      def strip_step(recovery)
-        return nil if recovery.tried.include?(:strip)
-
-        detail, body = recovery.signature
-        positions = thinking_positions(body)
-        named = detail.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
-        recovery.strip_from = positions.include?(named) ? named : positions.first
-        recovery.step = recovery.strip_from && :strip
-      end
-
-      # [message, block] of every thinking or redacted_thinking block in
-      # +body+'s messages.
-      def thinking_positions(body)
-        Array(body[:messages]).each_with_index.flat_map do |message, n|
-          Array(message[:content]).each_with_index.filter_map { |block, m| [n, m] if thinking_block?(block) }
-        end
-      end
-
-      def thinking_block?(block) = block.is_a?(Hash) && THINKING_TYPES.include?((block["type"] || block[:type]).to_s)
-
-      # +body+ as the recovery step sends it, and the identities a strip
-      # removed (nil for none).
-      def recovered_body(body, recovery)
-        case recovery.step
-        when :drop_block then [body.merge(thinking: drop_block_thinking(body[:thinking])), nil]
-        when :strip then stripped_body(body, recovery.strip_from)
-        else [body, nil]
-        end
-      end
-
-      # The body's thinking with block_binding: drop_block (adaptive
-      # without one: the binding controls need adaptive or enabled).
-      def drop_block_thinking(thinking)
-        thinking = thinking.is_a?(Hash) ? thinking.transform_keys(&:to_sym) : {}
-        thinking = { type: "adaptive" } unless %w[adaptive enabled].include?(thinking[:type].to_s)
-        thinking.merge(block_binding: DROP_BLOCK)
-      end
-
-      # +body+ without the thinking blocks from +from+ on (a trailing run:
-      # what Messages takes; a gap in the middle it refuses), and their
-      # identities. A message left empty says the placeholder.
-      def stripped_body(body, from)
-        first_message, first_block = from
-        removed = []
-        messages = body[:messages].each_with_index.map do |message, n|
-          next message if n < first_message
-
-          content = message[:content].each_with_index.reject do |block, m|
-            drop = (n > first_message || m >= first_block) && thinking_block?(block)
-            removed << AnthropicWire.block_identity(block) if drop
-            drop
-          end.map(&:first)
-          next message if content.size == message[:content].size
-
-          message.merge(content: content.empty? ? [{ type: "text", text: AnthropicWire::PLACEHOLDER }] : content)
-        end
-        [body.merge(messages: messages), removed.compact.uniq.freeze]
-      end
-
-      # +response+ with the blocks this request went without
-      # (ThinkingDrop), logged: a strip's, or drop_block's
-      # prefix_binding_mismatch entries mapped by path into +body+ (the
-      # body sent); any other entry is counted as kept, never settled.
-      def with_thinking_drop(response, recovery, body, stripped, transformations, model)
-        if recovery.step == :strip
-          identities = stripped
-          kept = 0
-        else
-          drops = Array(transformations).select { |entry| entry["type"] == "thinking_dropped" }
-          prefix, others = drops.partition { |entry| entry["reason"] == PREFIX_DROP }
-          identities = prefix.filter_map { |entry| identity_at(body, entry["path"]) }.uniq.freeze
-          kept = others.size
-        end
-        fields = { host: @host_name, model: model.to_s, how: recovery.step.to_s, dropped: identities.size,
-                   kept: kept, why: recovery.why }
-        fields[:diagnosis] = recovery.diagnosis if recovery.diagnosis
-        Log.info(:http, "thinking_recovered", **fields)
-        return response if identities.empty?
-
-        response.with(thinking_drop: ThinkingDrop.new(identities: identities, how: recovery.step))
-      end
-
-      def identity_at(body, path)
-        n, m = path.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
-        return nil unless n
-
-        block = Array(body[:messages])[n]&.then { |message| Array(message[:content])[m] }
-        thinking_block?(block) ? AnthropicWire.block_identity(block) : nil
-      end
-
-      # The last sentence of a 400 (what it says changed: "The `system`
-      # prompt differs …"), at most 200 characters.
-      def last_sentence(detail)
-        detail.strip.split(/(?<=\.)\s+/).last.to_s[0, 200]
-      end
-
       # What a 400 for +body+ changes (remembered), or nil: the error goes
       # on as it is.
       def refusal_fix(error, body, model)
@@ -456,6 +311,11 @@ module Samagotchi
           @refusals.remember(:thinking_form, model.to_s)
           Log.info(:http, "thinking_form_switched", host: @host_name, model: model.to_s, to: "budget", detail: detail[0, 200])
           :thinking_form
+        elsif body.dig(:thinking, :type) == "disabled" && THINKING_OFF_FORM_RE.match?(detail)
+          @refusals.remember(:thinking_off_form, model.to_s)
+          Log.info(:http, "thinking_off_form_switched", host: @host_name, model: model.to_s, to: "between_tools",
+                                                        detail: detail[0, 200])
+          :thinking_off_form
         elsif !@refusals.refused?(:cache_control) && CACHE_CONTROL_RE.match?(detail) && cache_summary(body)
           @refusals.remember(:cache_control)
           Log.info(:http, "cache_control_refused", host: @host_name, detail: detail[0, 200])