samagotchi 0.60.0 → 0.61.0

data/lib/samagotchi/web/public/app.js

@@ -46,7 +46,7 @@ import { createTaskStopper } from "./task_stop.js";
 import { appendQuote } from "./annotations.js";
 import { parsePresets } from "./annotate_presets.js";
 import { createAnnotateBar } from "./annotate_bar.js";
-import { COPY_SOURCE_ATTR, copySource, copyText, installCopy, showsAnswer } from "./copy.js";
+import { copyText, installCopy } from "./copy.js";
 import { ctxBarText, ctxBarTip, lastSpeedText, speedText } from "./ctx.js";
 import { createQuestionCards } from "./question_cards.js";
 import { cardClass, cardInnerHtml, cardPlace, isCard, isNoticeCard, noticeInnerHtml, splitSnapshotCards, turnNoticePlace } from "./card.js";
@@ -65,6 +65,7 @@ import {
   appendAboveLiveTiming, formatDuration, mergeTiming, normalizeTiming, sessionDurationNow, STOPPED_LINE_CLASS,
 } from "./timing.js";
 import { createLiveTurn } from "./live_turn.js";
+import { applyFinalAnswer, pairAnswerRefs } from "./answer_refs.js";
 import { installRefClicks } from "./refs.js";
 import { linkRefs, touchedFiles } from "./ref_scan.js";
 import { DONE_MS, applyInitEvent, dropDone, initRowHtml, newInitTasks, seedInitTasks } from "./init_row.js";
@@ -904,30 +905,26 @@ async function readTurnEnd() {
   } catch(_){}
 }
 
-// The turn's answer as its rendered markdown, once it is final (the
-// turn-end read, an answer_display re-read); then its refs.
+// The turn's answer as its rendered markdown and with its plugin refs,
+// once it is final (the turn-end read, an answer_display re-read:
+// answer_refs.js applyFinalAnswer); then the refs.
 function applyFinalMarkdown(messages) {
-  const message = [...messages].reverse().find(
-    (item) => item?.role === "assistant" && typeof item.html === "string",
-  );
-  const bubble = message && findInTurnRoots(".bubble.output")
-    .reverse()
-    .find((item) => showsAnswer(item, message, normalize));
-  if (bubble) {
-    bubble.classList.add("markdown");
-    bubble.setAttribute(COPY_SOURCE_ATTR, copySource(message));
-    bubble.innerHTML = message.html;
-  }
+  applyFinalAnswer(messages, findInTurnRoots(".bubble.output"), normalize);
   linkTextRefs();
 }
 
-// The `path:line` refs in the answers' and closed steps' texts that name a
-// file the session's rows (and cards) touched, on this page (ref_scan.js).
-// Not mid-stream: at a turn's end and after a reload's render. A ref
-// already made stays as it is.
+// The refs on the answers' and closed steps' texts, on this page: first
+// each answer's own (a plugin's, answer_refs.js), then the `path:line`
+// refs that name a file the session's rows (and cards) touched
+// (ref_scan.js), which leave a plugin's alone. Not mid-stream: at a
+// turn's end and after a reload's render. A ref already made stays as it
+// is.
 function linkTextRefs() {
   const roots = turnRoots();
   const touched = touchedFiles(roots);
+  for (const root of roots) {
+    for (const el of root.querySelectorAll(".bubble.output")) pairAnswerRefs(el);
+  }
   if (!touched.size) return;
   for (const root of roots) {
     for (const el of root.querySelectorAll(".bubble.output, .gen:not(.live) > .gen-text")) linkRefs(el, touched, current.dir);

data/lib/samagotchi/web/public/index.html

@@ -382,16 +382,18 @@ button.task-stop:hover:not(:disabled){background:var(--danger-bg-dim);filter:non
 .diff code{display:block;min-width:max-content}
 .diff-line{display:block;padding:0 10px;white-space:pre;color:var(--text-2)}
 /* Refs (refs.js): text until hovered or focused, and only with a target for this viewer (refs.js marks it: data-ref-main, the main one). A link ref keeps its link look. */
-.ref[data-ref-main]:not(a):is(:hover,:focus-visible){color:var(--accent);text-decoration:underline dotted;text-underline-offset:3px;cursor:pointer}
-.ref[data-ref-main="editor"]:not(a):is(:hover,:focus-visible)::after{content:"\2197";margin-left:.3em;color:var(--text-faint);display:inline-block}
+.ref[data-ref-main]:not(a):is(:hover,:focus-visible,[data-ref-more]){color:var(--accent);text-decoration:underline dotted;text-underline-offset:3px;cursor:pointer}
+.ref[data-ref-main="editor"]:not(a):is(:hover,:focus-visible,[data-ref-more])::after{content:"\2197";margin-left:.3em;color:var(--text-faint);display:inline-block}
 .ref[data-ref-kind]:focus-visible{outline:2px solid var(--accent);outline-offset:2px;border-radius:3px}
 :is(.activity-row,.bubble.approval) .diff-line[data-ref-main]:hover{cursor:pointer;box-shadow:inset 2px 0 var(--accent)}
 :is(.activity-row,.bubble.approval) .diff-line[data-ref-main]:hover::after{content:"\2197  " attr(data-line);float:right;padding-left:12px;color:var(--text-faint)}
 .activity-row .read-line[data-ref-main]:hover{cursor:pointer;box-shadow:inset 2px 0 var(--accent)}
 .activity-row .read-line[data-ref-main]:hover::before{color:var(--accent)}
 /* A ref's ▾ and its menu (ref_menu.js): one each, placed next to the ref. */
-.ref-more{position:fixed;z-index:60;display:inline-flex;align-items:center;justify-content:center;width:20px;height:20px;padding:0;border:1px solid var(--border-strong);border-radius:5px;background:var(--bg-panel);color:var(--text-muted);font-size:12px;line-height:1;cursor:pointer;box-shadow:0 1px 3px var(--shadow-strong)}
+.ref-more{position:fixed;z-index:60;display:inline-flex;align-items:center;justify-content:center;width:16px;height:16px;padding:0;border:1px solid var(--border-strong);border-radius:4px;background:var(--bg-panel);color:var(--text-muted);font-size:12px;line-height:1;cursor:pointer;box-shadow:0 1px 3px var(--shadow-strong)}
 .ref-more[hidden]{display:none}
+/* A ref makes room after itself for its ▾ while it shows (ref_menu.js), and keeps its hover look (its ↗ too) until the ▾ goes: the ▾ never covers what follows it. */
+.ref[data-ref-more]{padding-right:19px}
 .ref-more:hover{color:var(--accent);border-color:var(--accent)}
 .ref-menu{position:fixed;z-index:61;min-width:160px;max-width:calc(100vw - 16px);padding:4px;border:1px solid var(--border-strong);border-radius:8px;background:var(--bg-panel);box-shadow:var(--toast-shadow);animation:fadeIn .12s ease-out}
 .ref-menu [role="menuitem"]{display:block;width:100%;padding:6px 10px;border:0;border-radius:5px;background:none;color:var(--text);font:inherit;font-size:13px;text-align:left;cursor:pointer;white-space:nowrap}

data/lib/samagotchi/web/public/ref_menu.js

@@ -10,6 +10,9 @@
 const HIDE_MS = 300;
 // Kept from the viewport's edges (a phone's width).
 const EDGE = 8;
+// The ▾ sits in room its ref makes after itself while it shows
+// (data-ref-more, index.html), so it never covers what follows the ref:
+// the next words of an answer, a row's duration.
 
 // +doc+'s ▾ and menu. open(el, items, {focus}) shows +items+ ({id, label,
 // run}) under +el+; showMore(el, onOpen) puts the ▾ after +el+, whose click
@@ -50,18 +53,23 @@ export function createRefMenu(doc = globalThis.document) {
   function showMore(el, onOpen) {
     clearTimeout(hideTimer);
     const button = moreButton();
+    if (moreFor && moreFor !== el) delete moreFor.dataset.refMore;
     moreFor = el;
     onMore = onOpen;
+    el.dataset.refMore = "";
     button.hidden = false;
     const rect = lastRect(el);
+    const width = button.offsetWidth || 16;
     const top = rect.top + (rect.height - (button.offsetHeight || rect.height)) / 2;
-    button.style.left = `${Math.min(rect.right + 2, win.innerWidth - (button.offsetWidth || 16) - 2)}px`;
+    const left = rect.right - width - 1;
+    button.style.left = `${Math.min(left, win.innerWidth - width - 2)}px`;
     button.style.top = `${top}px`;
   }
 
   function hideMore() {
     clearTimeout(hideTimer);
     if (more) more.hidden = true;
+    if (moreFor) delete moreFor.dataset.refMore;
     moreFor = null;
   }
 

data/lib/samagotchi/web/public/ref_scan.js

@@ -103,13 +103,15 @@ function resolved(ref, touched, cwd) {
   return path ? { kind: "file", path, line: ref.line, end_line: ref.endLine } : null;
 }
 
-// The absolute paths of the file refs under +roots+ (the session's rows,
-// approval cards): what a text ref may name.
+// The absolute paths of the file refs in the session's rows and approval
+// cards under +roots+: what a text ref may name. Not an answer's own refs
+// (a scanned one repeats a row's; a plugin's file ref names a file the
+// session may not have touched).
 export function touchedFiles(roots) {
   const touched = new Set();
   for (const root of roots) {
     for (const el of root.querySelectorAll('[data-ref-kind="file"][data-ref-path]')) {
-      touched.add(el.dataset.refPath);
+      if (el.closest(".activity-row, .bubble.approval")) touched.add(el.dataset.refPath);
     }
   }
   return touched;

data/lib/samagotchi/web/public/refs.js

@@ -34,18 +34,34 @@ export function refAttrs(ref) {
 // A kind, as the server's Ref allows it (Ref::KIND).
 const KIND = /^[a-z][a-z0-9_-]{0,31}$/;
 
+// +kind+ is one bindRef binds.
+export function refKindOk(kind) {
+  return typeof kind === "string" && KIND.test(kind);
+}
+
 // A plugin's ref data per element (bindRef): {kind, target, label,
 // actions}. A WeakMap, so a redrawn element takes its data with it.
 const REF_DATA = new WeakMap();
 
-// +url+ as the page opens it when it is an http(s) one, else null. The
-// server checks it too (Ref, RefAction); the page never opens another
-// scheme a plugin gave (javascript:, data:, an editor's).
+// The longest URL the page opens: the server's RefAction::MAX_URL.
+const MAX_URL = 2000;
+
+// +url+ as the page opens it when it is an http(s) one with no userinfo
+// and at most MAX_URL characters (trimmed), else null. The server's
+// RefAction.http_url? checks it too; the page is at least as strict on
+// userinfo, and the URL parser refuses an http(s) URL without a host. The
+// page never opens another scheme a plugin gave (javascript:, data:, an
+// editor's), nor a "https://github.com@evil.example/" (one host shown,
+// another opened).
 export function httpUrl(url) {
   if (typeof url !== "string") return null;
+  const trimmed = url.trim();
+  if (trimmed.length > MAX_URL) return null;
   try {
-    const parsed = new URL(url.trim());
-    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.href : null;
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    if (parsed.username || parsed.password) return null;
+    return parsed.href;
   } catch {
     return null;
   }
@@ -58,7 +74,7 @@ export function httpUrl(url) {
 // nothing. A rebind replaces the target attributes. +el+, or null without one.
 export function bindRef(el, ref) {
   if (!el) return null;
-  if (typeof ref?.kind !== "string" || !KIND.test(ref.kind)) return el;
+  if (!refKindOk(ref?.kind)) return el;
   const target = ref.target || {};
   el.classList.add("ref");
   el.dataset.refKind = ref.kind;
@@ -74,6 +90,12 @@ export function bindRef(el, ref) {
   return el;
 }
 
+// The plugin ref bound to +el+ (bindRef's data), or null: a row title or
+// a scanned ref (attributes only) has none.
+export function boundRef(el) {
+  return (el && REF_DATA.get(el)) || null;
+}
+
 // The same URL either way (a link's href against an action's URL).
 function sameUrl(a, b) {
   const url = httpUrl(a);

data/lib/samagotchi/web/public/stream_handlers.js

@@ -141,12 +141,14 @@ export function createStreamHandlers(deps) {
       if (display) await display.promise;
       turnDom.answerReady?.();
     },
-    // An after_turn hook presented the answer (AnswerDisplay): it comes after
-    // turn_completed, so re-read the answer once that read is done.
+    // An after_turn hook presented the answer (AnswerDisplay) or attached
+    // refs to it (AnswerRefs: refs, a count; display null when only refs):
+    // it comes after turn_completed, so re-read the answer once that read
+    // is done.
     answer_display: async (data) => {
       try {
         await liveTurn.endRead;
-        if (!selected() || !data.display) return;
+        if (!selected() || (!data.display && !data.refs)) return;
         const d = await getSession(selected(), { tail: true, recent: true });
         if (Array.isArray(d.messages)) applyFinalMarkdown(d.messages);
       } catch (_) {

data/lib/samagotchi/web/public/turn_view.js

@@ -21,6 +21,7 @@
 // chrome (CSS :has), so a plain answer streams like today's bubble, and is
 // removed at the end: the answer bubble takes its place.
 import { html, nothing, render } from "./vendor/lit-html.js";
+import { setAnswerRefs } from "./answer_refs.js";
 import { leavesBlock } from "./card.js";
 import { copySourceAttr } from "./copy.js";
 import { escapeHtml, failedTurnText, messageBodyHtml, noteHtml, normalize, sourceLabel, steerRowHtml } from "./format.js";
@@ -779,10 +780,12 @@ export function turnHistoryNodes(items, timing, { thumbs }) {
       : "";
   };
   // The timing line after the bubble, not in it: where the live view
-  // leaves it at the turn's end.
-  const answerHtml = (m, timing) => {
+  // leaves it at the turn's end. +at+: the message's index, for its refs
+  // (data-answer-at, gone before the nodes are returned).
+  const answerHtml = (at, timing) => {
+    const m = items[at];
     const { body, renderedMarkdown } = messageBodyHtml(m);
-    return `<div class="bubble output${renderedMarkdown ? " markdown" : ""}"${copySourceAttr(m, renderedMarkdown)}>${body}</div>${timing}`;
+    return `<div class="bubble output${renderedMarkdown ? " markdown" : ""}" data-answer-at="${at}"${copySourceAttr(m, renderedMarkdown)}>${body}</div>${timing}`;
   };
   // A user's line, labelled when chi brought it in (a delegate report). A
   // `!cmd`'s saved message (the worker's "!(<command>)\n<output>") renders
@@ -799,14 +802,14 @@ export function turnHistoryNodes(items, timing, { thumbs }) {
     const j = items.findIndex((m, k) => k > i && m?.role === "assistant" && String(m.content ?? "").trim());
     if (j < 0 || j === group.answer || items.slice(i + 1, j).some((m) => m?.role === "user" && !m.merged)) return "";
     const { body, renderedMarkdown } = messageBodyHtml(items[j]);
-    return `<div class="bubble output report-reply${renderedMarkdown ? " markdown" : ""}"${copySourceAttr(items[j], renderedMarkdown)}>${body}</div>`;
+    return `<div class="bubble output report-reply${renderedMarkdown ? " markdown" : ""}" data-answer-at="${j}"${copySourceAttr(items[j], renderedMarkdown)}>${body}</div>`;
   };
   const steerHtml = (i, bubble) => steerRowHtml({ source: items[i].source, text: items[i].content }, { bubble });
   const parts = [];
   for (const group of turnGroups(items, timing)) {
     if (group.kind === "note") { parts.push(`<div class="bubble note">${noteHtml(items[group.i])}</div>`); continue; }
     if (group.kind === "steer") { parts.push(steerHtml(group.i, true)); continue; }
-    if (group.kind === "answer") { parts.push(answerHtml(items[group.answer], "")); continue; }
+    if (group.kind === "answer") { parts.push(answerHtml(group.answer, "")); continue; }
     const prompt = items[group.user];
     // A context wake turn starts with its note.
     parts.push(prompt.role === "note" ? `<div class="bubble note">${noteHtml(prompt)}</div>` : userHtml(prompt));
@@ -846,11 +849,18 @@ export function turnHistoryNodes(items, timing, { thumbs }) {
     // A turn with no answer (canceled, or running: no record yet) shows its
     // timing after its prompt and steps, where the live view leaves it.
     else if (group.answer === null) parts.push(timingHtml(group));
-    else parts.push(answerHtml(items[group.answer], timingHtml(group)));
+    else parts.push(answerHtml(group.answer, timingHtml(group)));
     // A canceled turn ends with its cancel line, a failed one whose steps
     // stayed with its failure line, as the live view left them.
     parts.push(cancelLineHtml(group.record, escapeHtml));
     parts.push(failedLineHtml(group.record));
   }
-  return fragmentOf(parts);
+  const out = fragmentOf(parts);
+  // Each answer bubble knows its message's refs (answer_refs.js; the
+  // page pairs them after the render), the index stays out of the DOM.
+  for (const bubble of out.querySelectorAll("[data-answer-at]")) {
+    setAnswerRefs(bubble, items[Number(bubble.dataset.answerAt)]?.display_refs);
+    bubble.removeAttribute("data-answer-at");
+  }
+  return out;
 }

data/lib/samagotchi/worker.rb

@@ -12,10 +12,12 @@ require_relative "steer"
 require_relative "worker_idle_exit"
 require_relative "worker_wakes"
 require_relative "worker_inbound"
+require_relative "worker_signals"
 require_relative "session_manager"
 require_relative "archive_store"
 require_relative "log"
 require_relative "turn_flow"
+require_relative "turn_checkpoint"
 require_relative "llm/errors"
 require_relative "continue_offer"
 require_relative "iteration_limit"
@@ -52,6 +54,13 @@ module Samagotchi
   # /continue) run on the loop between turns, before any queued prompt. One
   # taken while a turn runs (at an iteration boundary, or right after the
   # turn) is refused as busy.
+  #
+  # A TERM, HUP or INT (WorkerSignals, trapped in a spawned worker only)
+  # stops the running turn as a Stop does (reason :signal), the turn's
+  # work is saved as after any Stop, and the worker leaves (:signal) taking
+  # no new work. A turn that hasn't ended SIGNAL_GRACE seconds after the
+  # signal is cut: the session is saved as it is and the signal raised in
+  # the loop's thread, as Ruby's default would (the teardown still runs).
   class Worker
     FALLBACK_TICK_SECONDS = 5
     # A worker just started runs no wake turn for delegate reports this
@@ -64,6 +73,18 @@ module Samagotchi
     BUSY_OUTPUT = "busy: wait for the turn to end"
     # !rollback mid-turn would mean "the turn I'm in".
     ROLLBACK_BUSY_OUTPUT = "busy: Ctrl-C the turn first, then !rollback"
+    # How long a signalled worker's turn has to end (it is canceled at once,
+    # and again every SIGNAL_RETRY until it ends: a signal that lands just
+    # before the turn begins finds none to cancel).
+    SIGNAL_GRACE = 3.0
+    # A second signal, or a TERM after `chi sessions stop` marked the
+    # session stopped (that stop already canceled over the Bridge and waits
+    # only seconds for the lock): this much.
+    SIGNAL_SHORT_GRACE = 0.5
+    SIGNAL_RETRY = 0.1
+    # After the grace ran out and the signal was raised: the process ends
+    # this much later at the latest (a teardown that hangs).
+    SIGNAL_HARD_EXIT = 10.0
 
     # Wakes the worker loop. Whoever queues work writes it first and wakes
     # after, and #wait drains every wake before the loop looks for work: a
@@ -90,7 +111,12 @@ module Samagotchi
 
     # @param idle_exit_minutes [Numeric, nil] nil: session.idle_exit_minutes
     # @param poll_interval [Numeric, nil] seconds between fallback ticks
-    def initialize(session_id:, state_dir:, session_dir:, idle_exit_minutes: nil, poll_interval: nil)
+    # @param signals [WorkerSignals, WorkerSignals::None] the process's
+    #   trapped signals (SessionManager.run_session_loop); none by default
+    # @param signal_grace [Array(Numeric, Numeric, Numeric)] the grace, the
+    #   short grace and the hard exit's delay (specs shorten them)
+    def initialize(session_id:, state_dir:, session_dir:, idle_exit_minutes: nil, poll_interval: nil,
+                   signals: WorkerSignals::NONE, signal_grace: [SIGNAL_GRACE, SIGNAL_SHORT_GRACE, SIGNAL_HARD_EXIT])
       @session_id = session_id
       @state_dir = state_dir
       @session_dir = session_dir
@@ -116,6 +142,20 @@ module Samagotchi
       @asked_parent = false
       @owes_parent = false
       @initial_turn = false
+      @signals = signals
+      @signal_grace, @signal_short_grace, @signal_hard_exit = signal_grace
+      # Set as the loop starts, and as it returns (or raises): a signal's
+      # grace runs out only in between.
+      @loop_started = false
+      @left_loop = false
+      @signal_mutex = Mutex.new
+      @grace_expired = false
+      # The running turn has ended (its end event) and its after_turn hooks
+      # run: a signal's grace waits for them (#signalled).
+      @turn_ending = false
+      # The worker's own saves and a signal's (#signal_grace_expired), one
+      # at a time.
+      @save_mutex = Mutex.new
     end
 
     # Whether the session was empty as the worker left it, so the caller
@@ -135,30 +175,46 @@ module Samagotchi
     # @return [Symbol] :idle_exit, :exit_requested when a client asked it
     #   to exit (Bridge POST /exit), :restart when it asked for a restart
     #   (the caller starts a new worker), :stopped when the session was stopped
-    #   (chi stop), :crashed when the loop raised (the session is marked
-    #   errored); SessionManager.run_session_loop turns it into the exit
+    #   (chi stop), :signal when a signal stopped it (WorkerSignals),
+    #   :crashed when the loop raised (the session is marked errored);
+    #   SessionManager.run_session_loop turns it into the exit
     def run
+      # The thread a signal's expired grace raises in (the main thread in a
+      # worker process).
+      @run_thread = Thread.current
+      @signals.on_signal { |name, count| signalled(name, count) }
       start
       serve
-      begin
-        # A session stopped before this worker took the lock (e.g. a stop
-        # right after create) must not run its initial prompt.
-        return :stopped if stopped_on_disk?
-
-        start_background
-        loop do
-          leaving = pass
-          return leaving if leaving
-        end
+      # That raise lands in the loop only (#signal_grace_expired arms once
+      # it started, and never after it left): the teardown always runs
+      # whole, a raise already on its way waits until it is done.
+      Thread.handle_interrupt(SignalException => :never) do
+        Thread.handle_interrupt(SignalException => :immediate) { run_loop }
       rescue StandardError => e
         crashed(e)
       ensure
+        @signal_mutex.synchronize { @left_loop = true }
         teardown
       end
     end
 
     private
 
+    # @return [Symbol] what #run returns
+    def run_loop
+      @signal_mutex.synchronize { @loop_started = true }
+      # A session stopped before this worker took the lock (e.g. a stop
+      # right after create) must not run its initial prompt.
+      return :stopped if stopped_on_disk?
+      return signal_leave if signalled?
+
+      start_background
+      loop do
+        leaving = pass
+        return leaving if leaving
+      end
+    end
+
     # The session, its Engine and what runs its turns, before anyone can
     # reach it.
     def start
@@ -171,7 +227,10 @@ module Samagotchi
       ChildMove.adopt(@session_id, state_dir: @state_dir)
       @session = Session.load(@session_id, state_dir: @state_dir)
       drop_dead_question
+      # The running turn, on disk at its iteration boundaries.
+      @checkpoint = TurnCheckpoint.new(session: @session, state_dir: @state_dir)
       @engine = build_engine
+      settle_interrupted_turn
       # Before the Bridge serves anything: a UI joining a resumed worker's
       # stream gets the session's history and status in its snapshot, not
       # an empty session until the first turn.
@@ -200,8 +259,12 @@ module Samagotchi
         if Events::TURN_END.include?(event[:type])
           @turn_end_seq = event[:event_seq]
           @turn_end_type = event[:type]
+          @turn_ending = true
+        end
+        if event[:type] == :turn_started
+          @turn_id = event[:turn_id]
+          @turn_ending = false
         end
-        @turn_id = event[:turn_id] if event[:type] == :turn_started
         ring_question(event) if event[:type] == :question_requested
       })
       # This session's own delegate children's news (rings in children/).
@@ -268,6 +331,9 @@ module Samagotchi
     # next pass looks again; with none, #idle_pass.
     # @return [Symbol, nil] what #run returns as the worker leaves, nil to go on
     def pass
+      # A signalled worker takes no new work.
+      return signal_leave if signalled?
+
       # Check if the session was externally marked as stopped. Not
       # stopped_on_disk?, which reads a vanished file as "not stopped":
       # a session file deleted under a running worker crashes it here
@@ -316,8 +382,8 @@ module Samagotchi
     # @return [nil]
     def run_input_files(input_files)
       input_files.sort.each do |input_file|
-        # A stop between two queued turns leaves the rest queued.
-        break if stopped_on_disk?
+        # A stop (or a signal) between two queued turns leaves the rest queued.
+        break if signalled? || stopped_on_disk?
 
         # Commands that came before this file (D1: a queued /model X sent
         # before this prompt, a command an earlier file carried) run first.
@@ -385,6 +451,17 @@ module Samagotchi
       engine
     end
 
+    # A turn an earlier worker died in (TurnCheckpoint's mark in the file):
+    # ended now as canceled, with its note, and saved, before the Bridge
+    # serves the session (TurnCheckpoint.settle).
+    def settle_interrupted_turn
+      mark = TurnCheckpoint.settle(@session)
+      return unless mark
+
+      Log.info(:worker, "interrupted_turn_settled", turn_id: mark.id, iteration: mark.iteration, at: mark.at)
+      save_or_log(:interrupted_turn) { @session.save(state_dir: @state_dir) }
+    end
+
     # A question saved by a worker that died while it waited (an
     # ask_user_question, an approval, a hook's question): the turn that
     # asked is gone, so nobody can answer it, and left in the file it
@@ -572,7 +649,8 @@ module Samagotchi
     # @return [Boolean] whether any command ran
     def run_queued_commands
       ran = false
-      while (command = next_ready_command)
+      # A signalled worker runs no more (a /continue would start a turn).
+      while !signalled? && (command = next_ready_command)
         run_command(command)
         ran = true
       end
@@ -822,6 +900,7 @@ module Samagotchi
       @reporting_turn = reports_to_parent?(turn_args[:origin])
       restores = @turn_flow.restores
       begin
+        @checkpoint.begin_turn(prompt: prompt)
         @session.status = Session::STATUS_RUNNING
         # A continue that moved this session to the chain's new link wrote
         # the new parent beside it (Session::PARENT_FILE): this turn's
@@ -840,6 +919,8 @@ module Samagotchi
           Log.warn(:worker, "turn_not_begun", error: e.class.name, msg: e.message)
         end
       ensure
+        # Ended (or never begun): the saves write the session's own messages.
+        @checkpoint.end_turn
         refuse_queued_commands
       end
       yield result, error
@@ -995,6 +1076,9 @@ module Samagotchi
                 reports.map(&:line)
         # A wake turn starts with its first line, whoever sent it.
         lines[0] = lines[0].with(mark: mark) if mark && lines.any?
+        # The turn so far, with what this boundary merges (its input files
+        # are gone now), on disk at most every TurnCheckpoint::INTERVAL.
+        @checkpoint.boundary(@engine.live_conversation, merging: lines, turn_id: @turn_id)
         lines
       end
     end
@@ -1127,11 +1211,74 @@ module Samagotchi
       SessionManager.stopped_on_disk?(@session_id, state_dir: @state_dir)
     end
 
-    # Save the session unless it was stopped meanwhile: the stop (chi stop,
-    # from another process) saved its status, and this save would write
-    # the worker's over it.
+    # Save the session, a stopped one too: a stop is the marker file
+    # (Session.mark_stopped), which every load reads over the saved status,
+    # so this save can't hide it, and the turn the stop canceled is kept.
     def save_session
-      @session.save(state_dir: @state_dir) unless stopped_on_disk?
+      @save_mutex.synchronize { @session.save(state_dir: @state_dir) }
+    end
+
+    def signalled? = !@signals.signal.nil?
+
+    # @return [Symbol] :stopped when the session was stopped too (chi
+    #   sessions stop TERMs its worker), else :signal
+    def signal_leave
+      Session.stopped_marker?(@session_id, state_dir: @state_dir) ? :stopped : :signal
+    end
+
+    # A signal (WorkerSignals#fire), on a thread of its own: the loop wakes
+    # (an idle worker leaves at once), the running turn is canceled as a
+    # Stop (again every SIGNAL_RETRY, until the loop has left), and when
+    # the grace runs out first, #signal_grace_expired. A turn that has
+    # ended and runs its after_turn hooks (which store the answer's display
+    # and refs) is no longer canceled, and gets until SIGNAL_HARD_EXIT
+    # past the grace, the worker's own end of the turn (its saves, after
+    # the turn stopped running) too: the loop leaves next. A grace that runs out before the loop started waits
+    # for it (the loop's first look leaves). A signal after the loop left
+    # (the teardown, the caller's last steps) only brings the hard exit.
+    def signalled(name, count)
+      Log.info(:worker, "signal", signal: name, count: count, turn_running: @engine&.turn_running? || false)
+      return signal_hard_exit if @left_loop
+
+      @waker.wake
+      short = count > 1 || Session.stopped_marker?(@session_id, state_dir: @state_dir)
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      deadline = now + (short ? @signal_short_grace : @signal_grace)
+      hooks_deadline = deadline + @signal_hard_exit
+      ended = false
+      until @left_loop
+        running = @engine&.turn_running?
+        ended ||= running && @turn_ending
+        @engine.cancel_current_turn!(:signal) if running && !ended
+        break if @loop_started && Process.clock_gettime(Process::CLOCK_MONOTONIC) >= (ended ? hooks_deadline : deadline)
+
+        sleep(SIGNAL_RETRY)
+      end
+      signal_grace_expired(name) unless @left_loop
+    rescue StandardError => e
+      Log.warn(:worker, "signal_failed", signal: name, error: e.class.name, msg: e.message)
+    end
+
+    # The process ends SIGNAL_HARD_EXIT from now at the latest.
+    def signal_hard_exit
+      sleep(@signal_hard_exit)
+      @signals.hard_exit
+    end
+
+    # The turn didn't end in time (a tool that ignores the cancel, slow
+    # after_turn hooks): the session is saved as it is now (a turn that has
+    # ended: with it), and the signal raised in the loop's thread, so
+    # Worker#run's teardown and the lock's release still run. The process
+    # ends SIGNAL_HARD_EXIT later at the latest. Once, whatever the signals.
+    def signal_grace_expired(name)
+      expired = @signal_mutex.synchronize { !@grace_expired && !@left_loop && (@grace_expired = true) }
+      return unless expired
+
+      Log.warn(:worker, "signal_grace_expired", signal: name, turn_running: @engine&.turn_running? || false)
+      save_or_log(:signal) { save_session }
+      # Not once the loop has left (it may have, during the save).
+      @signal_mutex.synchronize { @run_thread&.raise(SignalException.new(name)) unless @left_loop }
+      signal_hard_exit
     end
   end
 end