samagotchi 0.78.0 → 0.80.0

data/lib/samagotchi/hooks/registry.rb

@@ -49,6 +49,31 @@ module Samagotchi
       namespace.const_get(File.basename(file.to_s, ".rb").split("_").map(&:capitalize).join, false)
     end
 
+    # A hook that raised: its label, event and error (#capture_failures).
+    Failure = Data.define(:hook, :event, :error)
+
+    # Thread.current key: the Array #capture_failures fills, or nil.
+    FAILURES = :samagotchi_hook_failures
+
+    # Collect into +sink+ every hook that raises on this thread while the
+    # block runs, whatever its policy (:skip ones log nothing, a stream
+    # hook's log is rate-limited): the bundle test kit raises them. The
+    # policy still applies. Nests; threads the block starts don't inherit it.
+    # @param sink [Array<Failure>]
+    def self.capture_failures(sink)
+      previous = Thread.current[FAILURES]
+      Thread.current[FAILURES] = sink
+      yield
+    ensure
+      Thread.current[FAILURES] = previous
+    end
+
+    # Add a raising hook to the sink #capture_failures set, if any.
+    def self.record_failure(hook, event, error)
+      Thread.current[FAILURES]&.push(Failure.new(hook: hook.to_s, event: event.to_s, error: error))
+      nil
+    end
+
     # A hook's block wrapped in its error policy: what a loader registers.
     # When the block raises,
     #   :deny  denies the call (event[:guardrail], the Gate's Verdict),
@@ -70,6 +95,7 @@ module Samagotchi
       rescue Exception => e # rubocop:disable Lint/RescueException -- :deny fails closed on anything
         raise unless policy == :deny || e.is_a?(StandardError) || e.is_a?(ScriptError)
 
+        Hooks.record_failure(label, event, e)
         failed = "#{e.class}: #{e.message}"
         if policy == :deny
           payload[:guardrail]&.deny!("#{label} raised #{failed}", rule: "guardrail-load", source: "core", decided_by: "core") if payload.is_a?(Hash)
@@ -273,6 +299,7 @@ module Samagotchi
             hook_proc.call(event)
           rescue StandardError => e
             # A failing hook must not break the turn.
+            Hooks.record_failure(label, name, e)
             Log.exception(:hooks, "hook_failed", e, echo: "[samagotchi:hooks] #{label} failed: #{e.class}: #{e.message}",
                                                 hook: label, event: name.to_s)
           end
@@ -302,6 +329,7 @@ module Samagotchi
             hook_proc.call(event)
           rescue StandardError => e
             # A failing hook must not break the turn.
+            Hooks.record_failure(label, name, e)
             Log.exception(:hooks, "hook_failed", e, echo: "[samagotchi:hooks] #{label} failed: #{e.class}: #{e.message}",
                                                 hook: label, event: name.to_s)
           end
@@ -309,6 +337,16 @@ module Samagotchi
         end
       end
 
+      # The bundle hooks registered for +name+, in the order #fire calls
+      # them (priority, bundle, hook name).
+      # @param name [Symbol]
+      # @return [Array<Array(String, String, Integer)>] [bundle, hook_name, priority]
+      def bundle_hook_names(name)
+        @mutex.synchronize do
+          sorted_bundle_hooks(name).map { |h| [h[:bundle], h[:hook_name], h[:priority]] }
+        end
+      end
+
       # @return [Integer] total number of registered hooks (bundle + plain)
       def size
         @mutex.synchronize do
@@ -323,15 +361,18 @@ module Samagotchi
       # turn-scoped hooks, each in registration order.
       def ordered_procs(name)
         @mutex.synchronize do
-          bundle_procs = (@bundle_hooks[name] || [])
-            .sort_by { |h| [h[:priority].to_i, h[:bundle].to_s, h[:hook_name].to_s] }
-            .map { |h| ["#{h[:hook_name]} (bundle #{h[:bundle]})", h[:proc]] }
+          bundle_procs = sorted_bundle_hooks(name).map { |h| ["#{h[:hook_name]} (bundle #{h[:bundle]})", h[:proc]] }
           config_procs = (@persistent_hooks[name] || []).map { |h| [h[:label], h[:proc]] }
           turn_procs = (@hooks[name] || []).map { |hook_proc| [TURN_HOOK_LABEL, hook_proc] }
           bundle_procs + config_procs + turn_procs
         end
       end
 
+      # The bundle hooks for an event in fire order; call under @mutex.
+      def sorted_bundle_hooks(name)
+        (@bundle_hooks[name] || []).sort_by { |h| [h[:priority].to_i, h[:bundle].to_s, h[:hook_name].to_s] }
+      end
+
       # The helpers, once per fire; a fire site's own keys stay.
       def with_runtime(event)
         return unless event.is_a?(Hash)

data/lib/samagotchi/host_registry.rb

@@ -229,15 +229,23 @@ module Samagotchi
       # ModelRef names a host only when it is one of ours
       return [find_entry(ref.host_name), ref.id] if ref.host_name
 
-      down = ref.id.to_s.strip.downcase
-      listed = @mutex.synchronize { @model_index }&.fetch(down, nil) || []
-      candidates = @entries.values.select { |e| listed.include?(e.name) || e.models&.key?(down) }.map(&:name)
-      candidates = saved_hosts_for(down) if candidates.empty?
+      candidates = hosts_with_model(ref.id)
       default = default_entry
       name = candidates.include?(default.name) ? default.name : candidates.first
       [(name && find_entry(name)) || default, ref.id]
     end
 
+    # The hosts that list or declare the model id +id+, in hosts: order: by
+    # the cached lists and hosts.<name>.models, else by the saved lists
+    # (ModelListStore). None asked: no discovery here.
+    # @return [Array<String>] host names, empty when no host has it
+    def hosts_with_model(id)
+      down = id.to_s.strip.downcase
+      listed = @mutex.synchronize { @model_index }&.fetch(down, nil) || []
+      names = @entries.values.select { |e| listed.include?(e.name) || e.models&.key?(down) }.map(&:name)
+      names.empty? ? saved_hosts_for(down) : names
+    end
+
     # The chat adapter for a host (one per host, so its cached model list
     # serves the context window), as LLM::Adapters builds it for the host's
     # api. Only chat hosts use it for turns.

data/lib/samagotchi/llm/adapter_common.rb

@@ -24,11 +24,13 @@ module Samagotchi
 
       # The adapter's LLM::HTTP: the timeouts (#timeouts), one attempt when
       # +retries+ is false and no +retry_policy+ is given.
-      def build_http(timeout:, open_timeout:, retries:, retry_policy:, sleeper:, first_token_timeout:, api_key:)
+      def build_http(timeout:, open_timeout:, retries:, retry_policy:, sleeper:, first_token_timeout:, api_key:,
+                     diagnosis_header: nil)
         open_timeout, read_timeout = timeouts(timeout, open_timeout)
         policy = retry_policy || (retries ? nil : HTTP::RetryPolicy.none)
         HTTP.new(label: @host_name, open_timeout: open_timeout, read_timeout: read_timeout, retry_policy: policy,
-                 sleeper: sleeper, first_token_timeout: first_token_timeout, api_key: api_key)
+                 sleeper: sleeper, first_token_timeout: first_token_timeout, api_key: api_key,
+                 diagnosis_header: diagnosis_header)
       end
 
       # [open, read] seconds: server.open_timeout / server.read_timeout,
@@ -46,12 +48,14 @@ module Samagotchi
       # Every page of the host's model list (MAX_MODEL_PAGES at most): the
       # block gives a page's URI for the last page's last_id (nil first).
       # @return [Array<ModelInfo>]
-      def list_model_pages
+      def list_model_pages(headers: {})
         models = []
         after = nil
         MAX_MODEL_PAGES.times do
           uri = yield(after)
-          body = parse_json(@http.fetch(uri, Net::HTTP::Get.new(uri), log_fields: { purpose: "models" }).body, "model list")
+          request = Net::HTTP::Get.new(uri)
+          headers.each { |name, value| request[name] = value }
+          body = parse_json(@http.fetch(uri, request, log_fields: { purpose: "models" }).body, "model list")
           models.concat(model_entries(body).map { |raw| model_info(raw) })
           break unless body.is_a?(Hash) && body["has_more"] && body["last_id"]
 

data/lib/samagotchi/llm/anthropic_binding_recovery.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+
+require_relative "../log"
+require_relative "anthropic_wire"
+require_relative "openai_chat"
+
+module Samagotchi
+  module LLM
+    # The preserved-thinking recovery of AnthropicMessages (Claude 5.x: a
+    # replayed thinking block is bound to the prefix it was made under, and
+    # a prefix that changed gets a signature 400): which step a 400 takes
+    # (#advance), the body that step sends (#recovered_body) and the
+    # response's ThinkingDrop (#with_thinking_drop). One per adapter; a
+    # request's own state is a Recovery.
+    class AnthropicBindingRecovery
+      # The beta header thinking.block_binding needs, and the behaviour the
+      # recovery asks for: the API drops a thinking block whose prefix
+      # changed (and every thinking block after it) for that request.
+      BINDING_BETA = "thinking-binding-controls-2026-08-01"
+      DROP_BLOCK = { prefix_mismatch_behavior: "drop_block" }.freeze
+      # A signature 400 that drop_block can settle: the block is valid but
+      # bound to another prefix. Without it the signature itself is bad
+      # (tampered, unreadable, another provider's): only a strip helps.
+      BOUND_ELSEWHERE_RE = /bound to a different conversation/i
+      # The block a signature 400 names: an index into the body sent.
+      BLOCK_PATH_RE = /messages\.(\d+)\.content\.(\d+)/
+      # The only drop the loop settles: a model_binding_mismatch (a /model
+      # downgrade) keeps its blocks, a switch back reads them again.
+      PREFIX_DROP = "prefix_binding_mismatch"
+      # The 400's undocumented diagnosis header, kept on the ProviderError and
+      # logged as `diagnosis`.
+      DIAGNOSIS_HEADER = "anthropic-thinking-prefix-mismatch"
+
+      # One request's binding recovery (#advance): the step taken
+      # (nil, :drop_block or :strip), the steps tried, where a strip starts
+      # ([message, block] in the body), the last signature 400 and the body
+      # it answered, and the first 400's last sentence and diagnosis for the log line.
+      Recovery = Struct.new(:step, :tried, :strip_from, :signature, :why, :diagnosis)
+
+      # @param refusals [RefusalMemo] the adapter's (the :binding_controls
+      #   the host refused is remembered there)
+      # @param host_name [String] for the log lines
+      # @param budget_form [#call] model -> whether it gets the budget form
+      #   (AnthropicMessages#budget_form?)
+      def initialize(refusals:, host_name:, budget_form:)
+        @refusals = refusals
+        @host_name = host_name
+        @budget_form = budget_form
+      end
+
+      # The step a signature 400 for +body+ takes (set on +recovery+, once
+      # each per request), or nil: the error goes on as it is.
+      # - drop_block: the same body with thinking.block_binding and the beta
+      #   header, for a block bound to another prefix, when the host takes
+      #   the controls and the body's thinking can carry them (adaptive,
+      #   enabled, or none: then adaptive; not disabled, nor none for a
+      #   model on the budget form);
+      # - strip: the block the 400 names (else the first replayed thinking
+      #   block) and every thinking block after it removed, for a bad
+      #   signature, where drop_block can't apply, when the host refused
+      #   the controls (remembered for the host), or after a second
+      #   signature 400.
+      def advance(error, body, recovery, model)
+        return nil if body.nil? || error.status != 400
+
+        if error.thinking_binding_unsupported? && recovery.step == :drop_block
+          unless @refusals.refused?(:binding_controls)
+            @refusals.remember(:binding_controls)
+            Log.info(:http, "binding_controls_refused", host: @host_name, detail: error.detail.to_s[0, 200])
+          end
+          return strip_step(recovery)
+        end
+        return nil unless error.thinking_signature?
+
+        recovery.diagnosis ||= error.diagnosis
+        recovery.signature = [error.detail.to_s, body]
+        case recovery.step
+        when nil
+          return nil if thinking_positions(body).empty?
+
+          recovery.why = last_sentence(error.detail.to_s)
+          return strip_step(recovery) unless drop_block_fits?(error, body, model)
+
+          recovery.step = :drop_block
+        when :drop_block then strip_step(recovery)
+        end
+      end
+
+      # +body+ as the recovery step sends it, and the identities a strip
+      # removed (nil for none).
+      def recovered_body(body, recovery)
+        case recovery.step
+        when :drop_block then [body.merge(thinking: drop_block_thinking(body[:thinking])), nil]
+        when :strip then stripped_body(body, recovery.strip_from)
+        else [body, nil]
+        end
+      end
+
+      # +response+ with the blocks this request went without
+      # (ThinkingDrop), logged: a strip's, or drop_block's
+      # prefix_binding_mismatch entries mapped by path into +body+ (the
+      # body sent); any other entry is counted as kept, never settled.
+      def with_thinking_drop(response, recovery, body, stripped, transformations, model)
+        if recovery.step == :strip
+          identities = stripped
+          kept = 0
+        else
+          drops = Array(transformations).select { |entry| entry["type"] == "thinking_dropped" }
+          prefix, others = drops.partition { |entry| entry["reason"] == PREFIX_DROP }
+          identities = prefix.filter_map { |entry| identity_at(body, entry["path"]) }.uniq.freeze
+          kept = others.size
+        end
+        fields = { host: @host_name, model: model.to_s, how: recovery.step.to_s, dropped: identities.size,
+                   kept: kept, why: recovery.why }
+        fields[:diagnosis] = recovery.diagnosis if recovery.diagnosis
+        Log.info(:http, "thinking_recovered", **fields)
+        return response if identities.empty?
+
+        response.with(thinking_drop: ThinkingDrop.new(identities: identities, how: recovery.step))
+      end
+
+      private
+
+      def drop_block_fits?(error, body, model)
+        return false unless BOUND_ELSEWHERE_RE.match?(error.detail.to_s) && !@refusals.refused?(:binding_controls)
+
+        case body[:thinking]
+        when nil then !@budget_form.call(model)
+        when Hash then %w[adaptive enabled].include?(body[:thinking][:type].to_s)
+        else false
+        end
+      end
+
+      # The strip, from the block the last signature 400 names in the body
+      # it answered (a thinking block there), else the first replayed one.
+      def strip_step(recovery)
+        return nil if recovery.tried.include?(:strip)
+
+        detail, body = recovery.signature
+        positions = thinking_positions(body)
+        named = detail.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        recovery.strip_from = positions.include?(named) ? named : positions.first
+        recovery.step = recovery.strip_from && :strip
+      end
+
+      # [message, block] of every thinking or redacted_thinking block in
+      # +body+'s messages.
+      def thinking_positions(body)
+        Array(body[:messages]).each_with_index.flat_map do |message, n|
+          Array(message[:content]).each_with_index.filter_map { |block, m| [n, m] if AnthropicWire.thinking_block?(block) }
+        end
+      end
+
+      # The body's thinking with block_binding: drop_block (adaptive
+      # without one: the binding controls need adaptive or enabled).
+      def drop_block_thinking(thinking)
+        thinking = thinking.is_a?(Hash) ? thinking.transform_keys(&:to_sym) : {}
+        thinking = { type: "adaptive" } unless %w[adaptive enabled].include?(thinking[:type].to_s)
+        thinking.merge(block_binding: DROP_BLOCK)
+      end
+
+      # +body+ without the thinking blocks from +from+ on (a trailing run:
+      # what Messages takes; a gap in the middle it refuses), and their
+      # identities. A message left empty says the placeholder.
+      def stripped_body(body, from)
+        first_message, first_block = from
+        removed = []
+        messages = body[:messages].each_with_index.map do |message, n|
+          next message if n < first_message
+
+          content = message[:content].each_with_index.reject do |block, m|
+            drop = (n > first_message || m >= first_block) && AnthropicWire.thinking_block?(block)
+            removed << AnthropicWire.block_identity(block) if drop
+            drop
+          end.map(&:first)
+          next message if content.size == message[:content].size
+
+          message.merge(content: content.empty? ? [{ type: "text", text: AnthropicWire::PLACEHOLDER }] : content)
+        end
+        [body.merge(messages: messages), removed.compact.uniq.freeze]
+      end
+
+      def identity_at(body, path)
+        n, m = path.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
+        return nil unless n
+
+        block = Array(body[:messages])[n]&.then { |message| Array(message[:content])[m] }
+        AnthropicWire.thinking_block?(block) ? AnthropicWire.block_identity(block) : nil
+      end
+
+      # The last sentence of a 400 (what it says changed: "The `system`
+      # prompt differs …"), at most 200 characters.
+      def last_sentence(detail)
+        detail.strip.split(/(?<=\.)\s+/).last.to_s[0, 200]
+      end
+    end
+  end
+end

data/lib/samagotchi/llm/anthropic_messages.rb

@@ -13,6 +13,7 @@ require_relative "openai_chat"
 require_relative "prompt_cache"
 require_relative "refusal_memo"
 require_relative "anthropic_assembly"
+require_relative "anthropic_binding_recovery"
 require_relative "anthropic_wire"
 require_relative "dialect"
 
@@ -36,6 +37,9 @@ module Samagotchi
     # broader refusal paths never see them:
     # - adaptive thinking (or output_config.effort) refused: the model gets
     #   the budget form instead (#budget_form), per model;
+    # - thinking off refused for the `between_tools` form (Claude 5.x:
+    #   `thinking: {type: "disabled"}` is refused, the 400 names
+    #   `between_tools`): that form from then on, per model;
     # - thinking.display refused (a provider whose thinking schema has no
     #   such field, e.g. Fireworks without its dialect): no display for the
     #   host, the thinking itself kept;
@@ -44,7 +48,7 @@ module Samagotchi
     # - max_tokens over the model's output limit: the limit the message
     #   names, per model.
     # A signature 400 (Claude 5.x preserved thinking: a replayed block bound
-    # to a prefix that changed) is recovered here too (#binding_recovery):
+    # to a prefix that changed) is recovered here too (AnthropicBindingRecovery):
     # asked again with drop_block, or with the blocks stripped, and the
     # dropped blocks handed to the loop (ChatResponse#thinking_drop), which
     # removes them from the history.
@@ -60,6 +64,10 @@ module Samagotchi
       # A 400 refusing adaptive thinking or its effort.
       ADAPTIVE_REFUSED_RE = /adaptive|output_config|effort/i
       CACHE_CONTROL_RE = /cache_control/i
+      # A 400 refusing `thinking: disabled` and naming the form that model
+      # takes for off: "To turn thinking off on this model, send "thinking":
+      # {"type": "between_tools"} instead of {"type": "disabled"}" (Claude 5.x).
+      THINKING_OFF_FORM_RE = /between_tools/i
       # A 400 refusing the thinking display field: its path (pydantic:
       # "thinking.adaptive.display"), or the field named as unknown or not
       # permitted. Not an error that only echoes the input
@@ -76,27 +84,6 @@ module Samagotchi
       # (configured sampling passes as written).
       DROPPED_OPTIONS = %i[reasoning_effort chat_template_kwargs stream_options prompt_cache_key logprobs top_logprobs
                            max_completion_tokens].freeze
-      # The beta header thinking.block_binding needs, and the behaviour the
-      # recovery asks for: the API drops a thinking block whose prefix
-      # changed (and every thinking block after it) for that request.
-      BINDING_BETA = "thinking-binding-controls-2026-08-01"
-      DROP_BLOCK = { prefix_mismatch_behavior: "drop_block" }.freeze
-      # A signature 400 that drop_block can settle: the block is valid but
-      # bound to another prefix. Without it the signature itself is bad
-      # (tampered, unreadable, another provider's): only a strip helps.
-      BOUND_ELSEWHERE_RE = /bound to a different conversation/i
-      # The block a signature 400 names: an index into the body sent.
-      BLOCK_PATH_RE = /messages\.(\d+)\.content\.(\d+)/
-      THINKING_TYPES = %w[thinking redacted_thinking].freeze
-      # The only drop the loop settles: a model_binding_mismatch (a /model
-      # downgrade) keeps its blocks, a switch back reads them again.
-      PREFIX_DROP = "prefix_binding_mismatch"
-
-      # One request's binding recovery (#binding_recovery): the step taken
-      # (nil, :drop_block or :strip), the steps tried, where a strip starts
-      # ([message, block] in the body), the last signature 400 and the body
-      # it answered, and the first 400's last sentence and diagnosis for the log line.
-      Recovery = Struct.new(:step, :tried, :strip_from, :signature, :why, :diagnosis)
 
       attr_reader :base_url, :host_name, :api_key_env, :models_ttl, :first_token_timeout, :dialect
 
@@ -126,9 +113,11 @@ module Samagotchi
         # The 400 fixes (#refusal_fix): :thinking_form and :output_cap per
         # model, :thinking_display and :cache_control for the host.
         @refusals = RefusalMemo.new
+        @binding = AnthropicBindingRecovery.new(refusals: @refusals, host_name: @host_name, budget_form: method(:budget_form?))
         @http = build_http(timeout: timeout, open_timeout: open_timeout, retries: retries, retry_policy: retry_policy,
                            sleeper: sleeper, first_token_timeout: first_token_timeout,
-                           api_key: ApiKey.for(api_key_env, host: @host_name, env: env, scheme: auth || @dialect.auth))
+                           api_key: ApiKey.for(api_key_env, host: @host_name, env: env, scheme: auth || @dialect.auth),
+                           diagnosis_header: AnthropicBindingRecovery::DIAGNOSIS_HEADER)
       end
 
       # The same contract as OpenAIChat#chat; +messages+ are ChatLoop's
@@ -137,12 +126,12 @@ module Samagotchi
       def chat(messages:, model:, tools: [], cancel_controller: nil, on_delta: nil, on_retry: nil, options: {},
                session_id: nil)
         fixed = []
-        recovery = Recovery.new(tried: [])
+        recovery = AnthropicBindingRecovery::Recovery.new(tried: [])
         shown = false
         begin
           # A rebuilt body (a refusal fix's retry) keeps the recovery.
-          body, stripped = recovered_body(request_body(messages, tools, model, options), recovery)
-          headers = recovery.step == :drop_block ? { "anthropic-beta" => BINDING_BETA } : {}
+          body, stripped = @binding.recovered_body(request_body(messages, tools, model, options), recovery)
+          headers = recovery.step == :drop_block ? { "anthropic-beta" => AnthropicBindingRecovery::BINDING_BETA } : {}
           request = post_request("#{@base_url}/v1/messages", body, session_id: session_id, extra_headers: headers)
           log_fields = { model: model, purpose: @purpose, sampling: sampling_summary(body), cache: cache_summary(body) }
           response, transformations =
@@ -151,11 +140,11 @@ module Samagotchi
             else
               chat_once(request, cancel_controller, log_fields)
             end
-          recovery.step ? with_thinking_drop(response, recovery, body, stripped, transformations, model) : response
+          recovery.step ? @binding.with_thinking_drop(response, recovery, body, stripped, transformations, model) : response
         rescue BadRequest => e
           # Only before anything was shown: a mid-stream error must not
           # repeat its deltas.
-          if !shown && binding_recovery(e, body, recovery, model)
+          if !shown && @binding.advance(e, body, recovery, model)
             recovery.tried << recovery.step
             retry
           end
@@ -202,16 +191,18 @@ module Samagotchi
       # @return [Hash] frozen
       def thinking_off_refused_fields = thinking_fields(:low)
 
+      # Whether +model+ gets the budget form (it refused adaptive thinking).
+      def budget_form?(model) = @refusals.refused?(:thinking_form, model.to_s)
+
       # The host's models, every page: GET {base}/v1/models with
       # limit=1000 and after_id paging (has_more/last_id). Anthropic's shape
       # (max_input_tokens, max_tokens, capabilities) and the OpenAI shape a
       # gateway or Splash serves here are both read (ModelListing).
-      # Whether +model+ gets the budget form (it refused adaptive thinking).
-      def budget_form?(model) = @refusals.refused?(:thinking_form, model.to_s)
-
       # @return [Array<ModelInfo>]
       def list_models
-        list_model_pages { |after| URI("#{@base_url}/v1/models?#{URI.encode_www_form({ limit: 1000, after_id: after }.compact)}") }
+        list_model_pages(headers: { "anthropic-version" => API_VERSION }) do |after|
+          URI("#{@base_url}/v1/models?#{URI.encode_www_form({ limit: 1000, after_id: after }.compact)}")
+        end
       end
 
       private
@@ -230,6 +221,7 @@ module Samagotchi
       def request_body(messages, tools, model, options)
         options = (options || {}).to_h.transform_keys(&:to_sym).except(*DROPPED_OPTIONS)
         options = budget_form(options) if budget_form?(model)
+        options = thinking_between_tools(options) if @refusals.refused?(:thinking_off_form, model.to_s)
         options = without_display(options) if @refusals.refused?(:thinking_display)
         cache = PromptCache.control if @purpose == "chat" && @dialect.cache_breakpoints && !@refusals.refused?(:cache_control)
         translated = AnthropicWire.translate(messages, cache: cache)
@@ -262,6 +254,16 @@ module Samagotchi
                       output_config: config.empty? ? nil : config)
       end
 
+      # +options+ with thinking off as the form such a model takes:
+      # `thinking: {type: "between_tools"}` where `disabled` was asked (a
+      # model that refused `disabled`).
+      def thinking_between_tools(options)
+        thinking = options[:thinking]
+        return options unless thinking.is_a?(Hash) && thinking.transform_keys(&:to_sym)[:type].to_s == "disabled"
+
+        options.merge(thinking: thinking.transform_keys(&:to_sym).merge(type: "between_tools"))
+      end
+
       # +options+ with no thinking.display (the host refused the field).
       def without_display(options)
         thinking = options[:thinking]
@@ -290,152 +292,6 @@ module Samagotchi
         body.merge(max_tokens: max_tokens, thinking: thinking.merge(budget_tokens: budget))
       end
 
-      # The step a signature 400 for +body+ takes (set on +recovery+, once
-      # each per request), or nil: the error goes on as it is.
-      # - drop_block: the same body with thinking.block_binding and the beta
-      #   header, for a block bound to another prefix, when the host takes
-      #   the controls and the body's thinking can carry them (adaptive,
-      #   enabled, or none: then adaptive; not disabled, nor none for a
-      #   model on the budget form);
-      # - strip: the block the 400 names (else the first replayed thinking
-      #   block) and every thinking block after it removed, for a bad
-      #   signature, where drop_block can't apply, when the host refused
-      #   the controls (remembered for the host), or after a second
-      #   signature 400.
-      def binding_recovery(error, body, recovery, model)
-        return nil if body.nil? || error.status != 400
-
-        if error.thinking_binding_unsupported? && recovery.step == :drop_block
-          unless @refusals.refused?(:binding_controls)
-            @refusals.remember(:binding_controls)
-            Log.info(:http, "binding_controls_refused", host: @host_name, detail: error.detail.to_s[0, 200])
-          end
-          return strip_step(recovery)
-        end
-        return nil unless error.thinking_signature?
-
-        recovery.diagnosis ||= error.diagnosis
-        recovery.signature = [error.detail.to_s, body]
-        case recovery.step
-        when nil
-          return nil if thinking_positions(body).empty?
-
-          recovery.why = last_sentence(error.detail.to_s)
-          return strip_step(recovery) unless drop_block_fits?(error, body, model)
-
-          recovery.step = :drop_block
-        when :drop_block then strip_step(recovery)
-        end
-      end
-
-      def drop_block_fits?(error, body, model)
-        return false unless BOUND_ELSEWHERE_RE.match?(error.detail.to_s) && !@refusals.refused?(:binding_controls)
-
-        case body[:thinking]
-        when nil then !budget_form?(model)
-        when Hash then %w[adaptive enabled].include?(body[:thinking][:type].to_s)
-        else false
-        end
-      end
-
-      # The strip, from the block the last signature 400 names in the body
-      # it answered (a thinking block there), else the first replayed one.
-      def strip_step(recovery)
-        return nil if recovery.tried.include?(:strip)
-
-        detail, body = recovery.signature
-        positions = thinking_positions(body)
-        named = detail.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
-        recovery.strip_from = positions.include?(named) ? named : positions.first
-        recovery.step = recovery.strip_from && :strip
-      end
-
-      # [message, block] of every thinking or redacted_thinking block in
-      # +body+'s messages.
-      def thinking_positions(body)
-        Array(body[:messages]).each_with_index.flat_map do |message, n|
-          Array(message[:content]).each_with_index.filter_map { |block, m| [n, m] if thinking_block?(block) }
-        end
-      end
-
-      def thinking_block?(block) = block.is_a?(Hash) && THINKING_TYPES.include?((block["type"] || block[:type]).to_s)
-
-      # +body+ as the recovery step sends it, and the identities a strip
-      # removed (nil for none).
-      def recovered_body(body, recovery)
-        case recovery.step
-        when :drop_block then [body.merge(thinking: drop_block_thinking(body[:thinking])), nil]
-        when :strip then stripped_body(body, recovery.strip_from)
-        else [body, nil]
-        end
-      end
-
-      # The body's thinking with block_binding: drop_block (adaptive
-      # without one: the binding controls need adaptive or enabled).
-      def drop_block_thinking(thinking)
-        thinking = thinking.is_a?(Hash) ? thinking.transform_keys(&:to_sym) : {}
-        thinking = { type: "adaptive" } unless %w[adaptive enabled].include?(thinking[:type].to_s)
-        thinking.merge(block_binding: DROP_BLOCK)
-      end
-
-      # +body+ without the thinking blocks from +from+ on (a trailing run:
-      # what Messages takes; a gap in the middle it refuses), and their
-      # identities. A message left empty says the placeholder.
-      def stripped_body(body, from)
-        first_message, first_block = from
-        removed = []
-        messages = body[:messages].each_with_index.map do |message, n|
-          next message if n < first_message
-
-          content = message[:content].each_with_index.reject do |block, m|
-            drop = (n > first_message || m >= first_block) && thinking_block?(block)
-            removed << AnthropicWire.block_identity(block) if drop
-            drop
-          end.map(&:first)
-          next message if content.size == message[:content].size
-
-          message.merge(content: content.empty? ? [{ type: "text", text: AnthropicWire::PLACEHOLDER }] : content)
-        end
-        [body.merge(messages: messages), removed.compact.uniq.freeze]
-      end
-
-      # +response+ with the blocks this request went without
-      # (ThinkingDrop), logged: a strip's, or drop_block's
-      # prefix_binding_mismatch entries mapped by path into +body+ (the
-      # body sent); any other entry is counted as kept, never settled.
-      def with_thinking_drop(response, recovery, body, stripped, transformations, model)
-        if recovery.step == :strip
-          identities = stripped
-          kept = 0
-        else
-          drops = Array(transformations).select { |entry| entry["type"] == "thinking_dropped" }
-          prefix, others = drops.partition { |entry| entry["reason"] == PREFIX_DROP }
-          identities = prefix.filter_map { |entry| identity_at(body, entry["path"]) }.uniq.freeze
-          kept = others.size
-        end
-        fields = { host: @host_name, model: model.to_s, how: recovery.step.to_s, dropped: identities.size,
-                   kept: kept, why: recovery.why }
-        fields[:diagnosis] = recovery.diagnosis if recovery.diagnosis
-        Log.info(:http, "thinking_recovered", **fields)
-        return response if identities.empty?
-
-        response.with(thinking_drop: ThinkingDrop.new(identities: identities, how: recovery.step))
-      end
-
-      def identity_at(body, path)
-        n, m = path.to_s.match(BLOCK_PATH_RE)&.captures&.map(&:to_i)
-        return nil unless n
-
-        block = Array(body[:messages])[n]&.then { |message| Array(message[:content])[m] }
-        thinking_block?(block) ? AnthropicWire.block_identity(block) : nil
-      end
-
-      # The last sentence of a 400 (what it says changed: "The `system`
-      # prompt differs …"), at most 200 characters.
-      def last_sentence(detail)
-        detail.strip.split(/(?<=\.)\s+/).last.to_s[0, 200]
-      end
-
       # What a 400 for +body+ changes (remembered), or nil: the error goes
       # on as it is.
       def refusal_fix(error, body, model)
@@ -456,6 +312,11 @@ module Samagotchi
           @refusals.remember(:thinking_form, model.to_s)
           Log.info(:http, "thinking_form_switched", host: @host_name, model: model.to_s, to: "budget", detail: detail[0, 200])
           :thinking_form
+        elsif body.dig(:thinking, :type) == "disabled" && THINKING_OFF_FORM_RE.match?(detail)
+          @refusals.remember(:thinking_off_form, model.to_s)
+          Log.info(:http, "thinking_off_form_switched", host: @host_name, model: model.to_s, to: "between_tools",
+                                                        detail: detail[0, 200])
+          :thinking_off_form
         elsif !@refusals.refused?(:cache_control) && CACHE_CONTROL_RE.match?(detail) && cache_summary(body)
           @refusals.remember(:cache_control)
           Log.info(:http, "cache_control_refused", host: @host_name, detail: detail[0, 200])