samagotchi 0.91.0 → 0.93.0

data/lib/samagotchi/bundles/cost-cap/plugin.rb

@@ -15,6 +15,9 @@
 #   default: 5.00   USD cap for a session with none set; absent/0/off: none
 #   child: 2.00     for delegate children (ctx.delegate?); absent: default
 #   warn_at: 0.8    the share of the cap that warns; 0/off: no warning
+# A cap reads as a number (3, .5, 1e1, "$2" as text too); one that doesn't
+# (cap: five) warns the user once and the next key is used, so a typo is
+# never a silent "no cap".
 #
 # State: <data_dir>/sessions/<session id>.json, {"cap": 3.0, "step": 3.0},
 # written by /cap and by Continue; "cap": null (or false) is off for the
@@ -32,12 +35,15 @@ class Plugin
   # spends more, Stop denies; under hard a parent may only Stop.
   EFFECTS = { "Continue" => :spend, "Stop" => :deny }.freeze
   WARN_AT = 0.8
+  # A cap as text: 3, 2.5, .5, 1e1, -1 (a negative is none), after a "$".
+  NUMBER = /\A-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[-+]?\d+)?\z/i
 
   def initialize(_settings)
     @mutex = Mutex.new
     @resolved = nil        # {session:, cap:, step:}
     @warned = nil          # [session id, cap] the share warning was given for
     @unknown_warned = nil  # the session id the "can't be enforced" notice was given for
+    @unread_warned = nil   # the session id the "isn't a number" notice was given for
   end
 
   def register(chi)
@@ -50,13 +56,39 @@ class Plugin
     end
   end
 
-  # The cap in USD (a positive Float) or nil (none, 0, off, false).
+  # The cap in USD (a positive Float) or nil (none, 0, off, false, or a
+  # value that isn't a number: .readable? tells them apart).
   def self.amount(value)
+    number = number(value)
+    number&.positive? ? number : nil
+  end
+
+  # +value+ as a finite Float (a number, or text NUMBER reads after a "$"),
+  # else nil. "5." gets its 0 first (.float_text: Ruby 3.3's Float wants
+  # one); 1e400 (Infinity) is no cap anyone reaches.
+  def self.number(value)
     number = case value
              when Numeric then value.to_f
-             when String then value.strip.delete_prefix("$").then { |s| s.match?(/\A\d+(\.\d+)?\z/) ? s.to_f : nil }
+             when String
+               text = value.strip.delete_prefix("$")
+               Float(float_text(text)) if text.match?(NUMBER)
              end
-    number&.positive? ? number : nil
+    number if number&.finite?
+  end
+
+  # A NUMBER as Float reads it on every Ruby: a bare point ("5.", "5.e1")
+  # gets a 0 after it.
+  def self.float_text(text) = text.sub(/\.(?=e|\z)/i, ".0")
+
+  # Whether +value+ reads as a cap or as none: a number (text too), off,
+  # false or nil; not "five", true or a list.
+  def self.readable?(value)
+    case value
+    when false, nil then true
+    when Numeric then value.finite?
+    when String then value.strip.casecmp?("off") || !number(value).nil?
+    else false
+    end
   end
 
   # Cents, or up to four decimals under $0.10, so a small cap (/cap 0.003)
@@ -71,6 +103,7 @@ class Plugin
 
   def check(ctx)
     resolved = resolve(ctx)
+    unreadable(ctx, resolved)
     cap = resolved[:cap]
     return unless cap
 
@@ -101,6 +134,16 @@ class Plugin
                level: :warn)
   end
 
+  # Once per session: the settings whose cap didn't read, and what is used.
+  def unreadable(ctx, resolved)
+    bad = resolved[:unreadable]
+    return if bad.nil? || bad.empty? || !first_time?(:@unread_warned, resolved[:session])
+
+    named = bad.map { |key, value| "#{key}: #{value.inspect}" }.join(" and ")
+    used = resolved[:cap] ? "using #{resolved[:key]}: (#{money(resolved[:cap])})" : "no cap"
+    ctx.notify("cost-cap: #{named} #{bad.size == 1 ? "isn't" : "aren't"} a number or off; #{used}", level: :warn)
+  end
+
   def at_cap(ctx, resolved, cost)
     cap = resolved[:cap]
     raised = raised_cap(cap, resolved[:step] || cap, cost.total)
@@ -148,12 +191,13 @@ class Plugin
       save(ctx, session, "cap" => nil)
       return "cost-cap: no cap for this session"
     end
-    value = arg.match?(/\A\$?\d+(\.\d+)?\z/) ? self.class.amount(arg) : nil
+    value = self.class.amount(arg)
     return USAGE unless value
 
     save(ctx, session, "cap" => value, "step" => value)
     "cost-cap: cap set to #{money(value)} (#{money(ctx.cost.total)} spent)"
   rescue StandardError => e
+    ctx.log.warn(:cap_command_failed, error: "#{e.class}: #{e.message}")
     "cost-cap: #{e.message}"
   end
 
@@ -194,16 +238,17 @@ class Plugin
     nil
   end
 
+  # The first of cap:, child: (a delegate's) and default: that is set and
+  # reads (.readable?); the ones set that don't read are kept for the
+  # notice (#unreadable).
   def configured(ctx)
     settings = ctx.settings
-    return { cap: nil, step: nil } unless %w[cap default child].any? { |key| settings.key?(key) }
-
-    key = if settings.key?("cap") then "cap"
-          elsif settings.key?("child") && ctx.delegate? then "child"
-          else "default"
-          end
-    cap = self.class.amount(settings[key])
-    { cap: cap, step: cap }
+    keys = %w[cap child default].select { |key| settings.key?(key) }
+    keys.delete("child") if keys.include?("child") && !ctx.delegate?
+    bad = keys.reject { |key| self.class.readable?(settings[key]) }
+    key = (keys - bad).first
+    cap = key && self.class.amount(settings[key])
+    { cap: cap, step: cap, key: key, unreadable: bad.to_h { |name| [name, settings[name]] } }
   end
 
   def warn_share(ctx)

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.91.0
+version: 0.93.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_env.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "installed_gem"
+require_relative "installed_versions"
+
+module Samagotchi
+  # What a chi process another chi starts must not take from its spawner's
+  # environment, in one place: a session's worker (SessionManager's
+  # spawn_options) and `chi bundle try`'s sandboxed child
+  # (BundleCommand::Try::Sandbox) both scrub these. Each adds its own policy
+  # on top (the worker passes the CLI settings and the log file; try drops
+  # the user's config sections too).
+  module ChildEnv
+    # The spawner's guardrails settings: never a child's (docs/guardrails.md).
+    GUARDRAILS_PREFIX = "SAMAGOTCHI_GUARDRAILS_"
+    # A worker's own markers (SessionManager::WORKER_PROCESS_ENV, ...).
+    WORKER_PREFIX = "SAMAGOTCHI_WORKER_"
+    # The markers a session's execute and tasks export
+    # (Tools::Builtins.parent_env): that session's, not a child chi's.
+    SESSION_MARKERS = %w[SAMAGOTCHI_PARENT_SESSION SAMAGOTCHI_SESSION_MODEL SAMAGOTCHI_SESSION_THINKING
+                         SAMAGOTCHI_SESSION_REASONING_HISTORY].freeze
+
+    module_function
+
+    # The keys of +env+ a child chi must not inherit: the guardrails
+    # settings, the session markers and a smoke's fake "newest installed"
+    # (InstalledVersions::ENV_KEY, for the spawner's notices only).
+    # @return [Array<String>]
+    def spawner_keys(env = ENV)
+      env.each_key.select { |key| key.start_with?(GUARDRAILS_PREFIX) } + SESSION_MARKERS + [InstalledVersions::ENV_KEY]
+    end
+
+    # #spawner_keys mapped to nil: Process.spawn unsets a key mapped to nil.
+    # @return [Hash{String=>nil}]
+    def unset(env = ENV) = spawner_keys(env).to_h { |key| [key, nil] }
+
+    # +env+ without #spawner_keys (a copy).
+    # @param env [Hash]
+    # @return [Hash]
+    def scrub(env) = env.except(*spawner_keys(env))
+
+    # In gem mode, what Bundler changed in +env+ mapped back
+    # (InstalledGem.unbundled_env_changes): a child activates the installed
+    # gem itself rather than inherit this app's bundle. {} in a checkout.
+    # @return [Hash{String=>String, nil}]
+    def unbundled(env = ENV.to_h)
+      InstalledGem.spec ? InstalledGem.unbundled_env_changes(env) : {}
+    end
+  end
+end

data/lib/samagotchi/child_reports.rb

@@ -194,12 +194,10 @@ module Samagotchi
     def commit
       @taken.each_value do |report|
         Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-          next cursor unless cursor.report_claim&.fetch("id", nil) == report.claim_id
+          next cursor unless cursor.report_claim&.id == report.claim_id
 
-          before = report.before.with(report_claim: nil)
-          after = report.after.with(report_claim: nil)
-          current = cursor.with(report_claim: nil)
-          current == before ? after : current
+          current = cursor.without_claim
+          current == report.before.without_claim ? report.after.without_claim : current
         end
         delete_rings(report.rings)
       rescue StandardError => e
@@ -212,7 +210,7 @@ module Samagotchi
     def release
       @taken.each_value do |report|
         Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-          cursor.report_claim&.fetch("id", nil) == report.claim_id ? cursor.with(report_claim: nil) : cursor
+          cursor.report_claim&.id == report.claim_id ? cursor.without_claim : cursor
         end
       end
       @taken = {}
@@ -234,11 +232,11 @@ module Samagotchi
       return report.with(relay: nil) unless relay
 
       question = report.relay
-      what = question.header.to_s.empty? ? question.hook.to_s : question.header.to_s
+      label = Tools::DelegateRelay.label(question)
       line = if Session.load(report.child_id, state_dir: @state_dir).pending_question&.id.to_s != question.id.to_s
-               Tools::DelegateRelay.line(what, "answered on the child", hook: true)
+               Tools::DelegateRelay.line(label, "answered on the child")
              elsif relay.relay_desk.settled?(report.child_id, question.id)
-               Tools::DelegateRelay.line(what, "answered on a relay already; it waits for the user on the child", hook: true)
+               Tools::DelegateRelay.line(label, "answered on a relay already; it waits for the user on the child")
              else
                outcome = Tools::DelegateRelay.call(report.child_id, question, relay: relay, state_dir: @state_dir)
                return hold_back(report) if outcome.stopped
@@ -286,7 +284,7 @@ module Samagotchi
     def release_report(report)
       @taken.delete(report.child_id)
       Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-        cursor.report_claim&.fetch("id", nil) == report.claim_id ? cursor.with(report_claim: nil) : cursor
+        cursor.report_claim&.id == report.claim_id ? cursor.without_claim : cursor
       end
       nil
     end
@@ -330,11 +328,11 @@ module Samagotchi
                                       timeout: 0, turn: before.turn)
       return nil unless reportable?(wait)
 
-      claim_id = before.report_claim&.fetch("id", nil) || SecureRandom.hex(16)
-      after = before.with(reply_file: wait.status == :done ? wait.file : before.reply_file,
-                          turn: wait.status == :waiting_for_answer ? before.turn : nil, report_claim: nil)
+      claim_id = before.report_claim&.id || SecureRandom.hex(16)
+      after = before.without_claim.with(reply_file: wait.status == :done ? wait.file : before.reply_file,
+                                        turn: wait.status == :waiting_for_answer ? before.turn : nil)
                     .with_baseline(ReplyWait.baseline_of(wait.session))
-      claim = { "id" => claim_id, "file" => wait.file, "cursor" => after.to_json_hash }
+      claim = Tools::ReportClaim.new(id: claim_id, file: wait.file, cursor: after)
       return nil unless Tools::DelegateCursors.claim_report(@session_id, child_id, expected: before, claim: claim,
                                                             state_dir: @state_dir)
 

data/lib/samagotchi/client_id.rb

@@ -46,8 +46,26 @@ module Samagotchi
     # (#interactive?): a web tab, an attached chi TUI.
     INTERACTIVE_PREFIXES = [WEB_PREFIX, TUI_PREFIX].freeze
 
+    # A turn's origin by its sender (#origin, LastTurn#origin): the ids chi
+    # runs turns for on its own, by prefix; system:reminder is "reminder",
+    # anything else "client".
+    ORIGIN_PREFIXES = { DELEGATE_PREFIX => "delegate", CHILD_PREFIX => "delegate_report",
+                        CONTEXT_PREFIX => "context", TASK_PREFIX => "task" }.freeze
+
     module_function
 
+    # What sent a turn: "delegate" (a delegating parent), "delegate_report"
+    # (a child's report), "context" (a context wake), "task" (a task finish
+    # wake), "reminder", else "client" (a person, chi send, a plugin, nil).
+    # @return [String]
+    def origin(client_id)
+      id = client_id.to_s
+      return "reminder" if id == REMINDER
+
+      ORIGIN_PREFIXES.each { |prefix, origin| return origin if id.start_with?(prefix) }
+      "client"
+    end
+
     # Whether +client_id+ is a web tab or a chi TUI, which see a command's
     # reply and can send the line it asks for (CacheConfirm); chi send, a
     # delegate, a plugin, chi itself and nil are not.

data/lib/samagotchi/config/restart_watch.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module Config
+    # Tells a worker or chi web when config.yml changes a setting it only
+    # reads at its start (Config::Entry#lifecycle: worker_start or web_start,
+    # and process_start): "server.port changed — applies after a worker
+    # restart". ConfigFile.watch_restart_settings! adds a Watcher;
+    # ConfigFile.read_yaml reports each new read of the file (#notify) or a
+    # file that doesn't parse (#unreadable), which tells nothing and warns
+    # once, instead of every start-only key reading as changed.
+    #
+    # Thread-safe: the watchers list sits behind one mutex; callbacks run
+    # outside it.
+    module RestartWatch
+      @mutex = Mutex.new
+      @watchers = []
+
+      # One process's start-only settings and their start values.
+      class Watcher
+        LIFECYCLES = {
+          worker: %i[worker_start process_start],
+          web: %i[web_start process_start]
+        }.freeze
+
+        attr_reader :path
+
+        # @param data [Hash, nil] config.yml as the process read it at start
+        # @param file_key [Array, nil] that read's [mtime, size]
+        def initialize(process:, path:, data:, file_key:, on_change:)
+          lifecycles = LIFECYCLES.fetch(process) { raise ArgumentError, "unknown config process #{process.inspect}" }
+          raise ArgumentError, "a config change callback is required" unless on_change
+
+          @process = process
+          @path = path
+          @entries = Config::ENTRIES.select { |entry| entry.config_exposed? && lifecycles.include?(entry.lifecycle) }
+          @values = @entries.to_h { |entry| [entry.key, Config.resolve(entry.key, file_data: data, env: {})] }
+          @noticed = {}
+          @file_key = file_key
+          @on_change = on_change
+        end
+
+        # [callback, message] for each start-only setting the file read now
+        # (+data+, under +file_key+) changes: once per key per new value,
+        # none for a value back at its start value. Empty for a read already
+        # seen. Caller holds RestartWatch's mutex.
+        def changes(file_key, data)
+          return [] unless seen!(file_key)
+
+          @entries.filter_map do |entry|
+            value = Config.resolve(entry.key, file_data: data, env: {})
+            if @values[entry.key] == value
+              @noticed.delete(entry.key)
+              next
+            end
+            # Already told for this value: a later edit of another key.
+            next if @noticed.key?(entry.key) && @noticed[entry.key] == value
+
+            @noticed[entry.key] = value
+            [@on_change, "#{entry.key} changed — applies after #{restart}"]
+          end
+        end
+
+        # Notes +file_key+ as read; false when it already was. Caller holds
+        # RestartWatch's mutex.
+        def seen!(file_key)
+          return false if @file_key == file_key
+
+          @file_key = file_key
+          true
+        end
+
+        private
+
+        def restart = @process == :worker ? "a worker restart" : "restarting chi web"
+      end
+
+      module_function
+
+      # Adds a Watcher for +process+ (:worker or :web).
+      # @return [Proc] unsubscribes
+      def watch(process:, path:, data:, file_key:, &on_change)
+        watcher = Watcher.new(process: process, path: path, data: data, file_key: file_key, on_change: on_change)
+        @mutex.synchronize { @watchers << watcher }
+        -> { @mutex.synchronize { @watchers.delete(watcher) } }
+      end
+
+      # Tells each watcher of +path+ which of its start-only settings the file
+      # read now (+data+, under +file_key+; nil for a missing file) changes.
+      def notify(path, file_key, data)
+        notices = @mutex.synchronize do
+          @watchers.select { |watcher| watcher.path == path }.flat_map { |watcher| watcher.changes(file_key, data) }
+        end
+        notices.each { |callback, message| callback.call(message) }
+      end
+
+      # The file at +path+ (under +file_key+) doesn't parse as a mapping
+      # (+problem+ says why): no watcher is told anything (its settings stay
+      # compared with the next read that parses), and a process watching it
+      # warns once per problem.
+      def unreadable(path, file_key, problem)
+        watched = @mutex.synchronize do
+          @watchers.select { |watcher| watcher.path == path }.each { |watcher| watcher.seen!(file_key) }.any?
+        end
+        return unless watched
+
+        ConfigFile.warn_once("config: #{path} doesn't parse (#{problem}); " \
+                             "start-only settings are checked again when it does")
+      end
+    end
+  end
+end

data/lib/samagotchi/config.rb

@@ -10,6 +10,7 @@ require_relative "model_ref"
 require_relative "paths"
 require_relative "llm_context_strategy"
 require_relative "host_model"
+require_relative "config/restart_watch"
 
 module Samagotchi
   # Parses the thinking: levels of host and model entries (it needs Config).
@@ -556,10 +557,6 @@ module Samagotchi
         resolve_with_origin(entry.key, file_data: file_data, env: ENV, cli_overrides: cli_overrides)
       end
 
-      def set_cli_overrides(overrides)
-        reload!(cli_overrides: overrides)
-      end
-
       # Problems with the keys of a parsed config.yml, one message per key the
       # code doesn't read (with a "did you mean" when a known key is close).
       # Every config-exposed entry in ENTRIES is known as written; names under
@@ -750,7 +747,7 @@ module Samagotchi
       cache = @yaml_cache ||= {}
       unless File.file?(path)
         cache.delete(path)
-        notify_restart_settings(path, nil, nil)
+        Config::RestartWatch.notify(path, nil, nil)
         return nil
       end
       stat = File.stat(path)
@@ -758,75 +755,37 @@ module Samagotchi
       hit = cache[path]
       return hit[1] if hit && hit[0] == key
 
+      problem = nil
       data = begin
         YAML.safe_load_file(path, permitted_classes: [], aliases: false)
-      rescue StandardError
+      rescue StandardError => e
+        problem = "#{e.class}: #{e.message.lines.first.to_s.strip[0, 200]}"
         nil
       end
+      problem ||= "its top level isn't a mapping" unless data.nil? || data.is_a?(Hash)
       data = nil unless data.is_a?(Hash)
       cache[path] = [key, data]
-      notify_restart_settings(path, key, data)
+      if problem
+        Config::RestartWatch.unreadable(path, key, problem)
+      else
+        Config::RestartWatch.notify(path, key, data)
+      end
       data
     end
 
     # Calls +on_change+ with one line ("server.port changed — applies after a
     # worker restart") when config.yml changes a setting this process only
-    # reads at its start (Config::Entry#lifecycle: worker_start or web_start,
-    # and process_start). Checked when the file is read again (#read_yaml),
-    # once per key per new value: none at start, none for a value back at its
-    # start value.
+    # reads at its start (Config::RestartWatch). Checked when the file is
+    # read again (#read_yaml), once per key per new value: none at start,
+    # none for a value back at its start value, none while the file doesn't
+    # parse (that warns once).
     # @param process [Symbol] :worker or :web
     # @return [Proc] unsubscribes
-    def watch_restart_settings!(process:, env: ENV, &on_change)
-      lifecycles = case process
-                   when :worker then %i[worker_start process_start]
-                   when :web then %i[web_start process_start]
-                   else raise ArgumentError, "unknown config process #{process.inspect}"
-                   end
-      raise ArgumentError, "a config change callback is required" unless on_change
-
+    def watch_restart_settings!(process:, env: ENV, &)
       path = global_path(env: env)
       data = read_yaml(env: env, path: path)
-      entries = Config::ENTRIES.select { |entry| entry.config_exposed? && lifecycles.include?(entry.lifecycle) }
-      watcher = {
-        path: path, process: process, entries: entries,
-        values: entries.to_h { |entry| [entry.key, Config.resolve(entry.key, file_data: data, env: {})] },
-        noticed: {},
-        file_key: File.file?(path) ? [File.stat(path).mtime.to_r, File.size(path)] : nil,
-        on_change: on_change
-      }
-      restart_watchers_mutex.synchronize { (@restart_watchers ||= []) << watcher }
-      -> { restart_watchers_mutex.synchronize { @restart_watchers&.delete(watcher) } }
-    end
-
-    # Tells each watcher of +path+ which of its start-only settings the file
-    # read now (+data+, under +file_key+) changes.
-    def notify_restart_settings(path, file_key, data)
-      notices = restart_watchers_mutex.synchronize do
-        Array(@restart_watchers).flat_map do |watcher|
-          next [] unless watcher[:path] == path && watcher[:file_key] != file_key
-
-          watcher[:file_key] = file_key
-          watcher[:entries].filter_map do |entry|
-            value = Config.resolve(entry.key, file_data: data, env: {})
-            if watcher[:values][entry.key] == value
-              watcher[:noticed].delete(entry.key)
-              next
-            end
-            # Already told for this value: a later edit of another key.
-            next if watcher[:noticed].key?(entry.key) && watcher[:noticed][entry.key] == value
-
-            watcher[:noticed][entry.key] = value
-            restart = watcher[:process] == :worker ? "a worker restart" : "restarting chi web"
-            [watcher[:on_change], "#{entry.key} changed — applies after #{restart}"]
-          end
-        end
-      end
-      notices.each { |callback, message| callback.call(message) }
-    end
-
-    def restart_watchers_mutex
-      @restart_watchers_mutex ||= Mutex.new
+      file_key = File.file?(path) ? [File.stat(path).mtime.to_r, File.size(path)] : nil
+      Config::RestartWatch.watch(process: process, path: path, data: data, file_key: file_key, &)
     end
 
     # Print +message+ to stderr unless this process already did. The config

data/lib/samagotchi/engine.rb

@@ -1402,14 +1402,7 @@ module Samagotchi
     #   answer the continue offer says so (ReplyWait, ParentReport "limit")
     # @param event [Hash] the turn's end event (#stop_facts)
     def record_last_turn(session, outcome, seconds, origin, event, limit: nil)
-      client_id = origin.is_a?(Hash) ? origin[:client_id].to_s : ""
-      source = if client_id.start_with?(ClientId::DELEGATE_PREFIX) then "delegate"
-               elsif client_id.start_with?(ClientId::CHILD_PREFIX) then "delegate_report"
-               elsif client_id.start_with?(ClientId::CONTEXT_PREFIX) then "context"
-               elsif client_id.start_with?(ClientId::TASK_PREFIX) then "task"
-               elsif client_id == ClientId::REMINDER then "reminder"
-               else "client"
-               end
+      source = ClientId.origin(origin.is_a?(Hash) ? origin[:client_id] : nil)
       enqueued_id = origin.is_a?(Hash) ? origin[:enqueued_id] : nil
       session.last_turn = LastTurn.new(outcome: outcome, ended_at: Time.now.iso8601(3), seconds: seconds.round(1),
                                        origin: source, exhausted: limit ? true : nil, limit: limit,
@@ -1523,10 +1516,9 @@ module Samagotchi
     def guardrail_notify(message) = @hook_routes.guardrail_notify(message)
     private :guardrail_notify
 
+    # @param question [HookQuestion]
     # @return [Hash, nil] {selected:, freeform:, selected_indices:}
-    def hook_ask_user(question, options, header, allow_freeform, hook, effects: nil)
-      @hook_routes.ask_user(question, options, header, allow_freeform, hook, effects: effects)
-    end
+    def hook_ask_user(question) = @hook_routes.ask_user(question)
     private :hook_ask_user
 
     # @return [Boolean] true when a running turn was cancelled now
@@ -1828,8 +1820,9 @@ module Samagotchi
     #   that put the turn's first message in the session already (a context
     #   wake's note) names it with this id
     #
-    # An Interrupt (SIGINT) cancels the turn: the pre-turn conversation plus
-    # the prompt is kept in the session and :turn_canceled is emitted, then the
+    # An Interrupt (SIGINT) cancels the turn: what it got to is kept in the
+    # session as after a Stop (the prompt, the loop's finished tool
+    # iterations, a cancel note) and :turn_canceled is emitted, then the
     # Interrupt is re-raised so the caller still decides whether to exit. One
     # after the turn's end event (in its after_turn/session_end hooks) is
     # only re-raised: the turn already ended; so is any error there. Any
@@ -1856,14 +1849,14 @@ module Samagotchi
         complete_turn(turn, result)
         warm_up_next_turn(turn, result)
         result
-      rescue Interrupt
+      rescue Interrupt => e
         # After the end event (in the after_turn/session_end hooks) the
         # turn is over: no second ending, the answer stays.
         raise if turn.ended
 
         turn.controller.cancel!(:ctrl_c)
         end_turn(turn, "canceled") do |seconds|
-          [ctrl_c_messages(turn, seconds), { type: :turn_canceled, cancellation_reason: :ctrl_c, duration_ms: (seconds * 1000).round }]
+          [ctrl_c_messages(turn, e, seconds), { type: :turn_canceled, cancellation_reason: :ctrl_c, duration_ms: (seconds * 1000).round }]
         end
         raise
       rescue StandardError => e
@@ -2263,17 +2256,26 @@ module Samagotchi
     end
     private :kept_messages
 
-    # A Ctrl-C keeps the turn's messages so far with a cancel note (nil
-    # before there are any). Only the pre-turn messages survive here, so
-    # tasks this turn started are missed (plan wait-stop §6).
-    def ctrl_c_messages(turn, seconds)
-      return nil unless turn.messages
+    # A Ctrl-C keeps the loop's conversation so far, as a Stop does (its
+    # finished tool iterations, every call answered: ToolResponse.run_batch),
+    # else the turn's messages so far (it came before the loop), with a
+    # cancel note naming the tasks still running; nil before there are any.
+    def ctrl_c_messages(turn, interrupt, seconds)
+      kept = loop_conversation(interrupt) || turn.messages
+      return nil unless kept
 
-      note = TurnNote.cancelled(:ctrl_c, seconds: seconds, running_tasks: Tools::TaskRuntime.running_created_in(turn.messages))
-      TurnNote.replace_trailing(turn.messages, note)
+      note = TurnNote.cancelled(:ctrl_c, seconds: seconds, running_tasks: Tools::TaskRuntime.running_created_in(kept))
+      TurnNote.replace_trailing(kept, note)
     end
     private :ctrl_c_messages
 
+    # The conversation the loop had built when +error+ ended the turn
+    # (LLM::FailedTurn), or nil.
+    def loop_conversation(error)
+      error.partial_conversation if error.respond_to?(:partial_conversation) && error.partial_conversation.is_a?(Array)
+    end
+    private :loop_conversation
+
     # A failure keeps the loop's partial conversation (else the turn's
     # messages so far) with a failed note; nil when the turn never reached
     # the model. The model reads why on its next turn. A turn that got to
@@ -2283,7 +2285,7 @@ module Samagotchi
     # turn (TurnFlow#prompt_turn_failed), and roll back the others, with a
     # note of their own; -p --non-interactive keeps what this keeps.
     def failed_messages(turn, error)
-      kept = error.respond_to?(:partial_conversation) && error.partial_conversation.is_a?(Array) ? error.partial_conversation : turn.messages
+      kept = loop_conversation(error) || turn.messages
       return nil unless kept
 
       steps = LLM::FailedTurn.progress(turn.session.messages, kept)
@@ -2559,9 +2561,7 @@ module Samagotchi
         messages: -> { plugin_messages },
         messages_partial: -> { turn_running? && @running_turn_messages.nil? },
         notify: ->(text, level, label, fallback_for: nil) { hook_notify(text, level, label, fallback_for: fallback_for) },
-        ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
-          hook_ask_user(question, options, header, allow_freeform, hook, effects: effects)
-        },
+        ask_user: ->(question) { hook_ask_user(question) },
         # An init task's is its own (a Ctrl-C ends a turn, not the task).
         cancelled: lambda {
           (task = current_init_task) ? task.cancelled? : active_cancel_controller&.cancelled?