rubik 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0ec56cafd854c2e2999c68cdfdf787322ca4d7d2a2866fac4b4e8ce9f1efac7
-  data.tar.gz: ec584d8ac5ee2039423d71968cce852afb65fcb072cbdbb87325ef94693e6a5d
+  metadata.gz: a799e64cfe31504bbb5c2da2dff00070725c885e04abb896addfc32ed48d3f87
+  data.tar.gz: 8dbaabb4fba7e1dc076924b0be25527307700728bc6e21e2f9e842edc0b8987b
 SHA512:
-  metadata.gz: 3a535d5c0f45c74363387e7df47da8c87b1296be897fdd09adc17e4adfcc576b48555066cb0b3618d27f1eeeba052c53fe1ccb7a670598a43cad57bb8a4cc942
-  data.tar.gz: d75bb114c57fb2221f17f9d89a1a0fe1811b9e36ba52289337030b822210ef5373118e7d8438c4000da9dfca65fb4dadf3b5f85bdb8ad117ee50d56469c1a782
+  metadata.gz: bd0f68f48ddf4f8b35c4ac625abc97a8e8673162529cb21806b664fa7b5d6c718d45e299f91b9ef4bebf7437371b6282655fff2e02574c7ec16171259c00311f
+  data.tar.gz: fa4a485d719537c0bd40d56d32fb97794c9b9de8288bf2f0a0159c5290a02c1d2906071d70e75585dda0b2d677980047a899d94634270b03bc9d13559444955f

data/CHANGELOG.md

@@ -10,8 +10,66 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Nothing yet.
 
+## [0.1.4] - 2026-10-13
+
+The autonomy release: `!goal` becomes resumable across transient
+provider outages, and the maestro gets a leaner, more proactive
+contract for driving subagents unattended.
+
+### Added
+
+- **Resumable `!goal` (#107):** transient provider transport failures
+  (exhausted connect/DNS retries, exhausted 5xx, HTTP 429) suspend the
+  goal instead of failing terminally — the loop, its counters and the
+  Σ ledger survive. `!goal resume` continues in-process (same Loop
+  instance) or cross-process (Σ-stamp rehydration with an honest
+  continuity notice); schema-corrupt Σ bodies are refused at
+  `Ledger.load` and stale suspend stamps are stripped from rehydrated
+  links. Issue #106 Faz 1+2a (Faz 2b deferred).
+- **Lean maestro autonomy:** subagents carry a 4-part final-report
+  contract (research/coder), doctrine gains proactive budget guidance
+  and predecessor-transcript chaining, `agent.goal_auto_continue_limit`
+  grants unattended `!goal` runs up to 20 extra auto-extensions with an
+  honest `auto=true` notice, and `!goal --steps N` sizes the step
+  budget up front with usage-error validation.
+
+### Changed
+
+- **Scanner orders paths via NUL translation:** `order_like_walker`
+  keys paths with `String#tr("/", "\0")` instead of `Array#split` —
+  order-equivalent with fewer allocations.
+
+## [0.1.3] - 2026-10-12
+
+A robustness release straight from a field incident: the `!goal` loop
+no longer strands state when the provider fails mid-goal, and the
+redactor gets measurably cheaper on secret-free input.
+
+### Fixed
+
+- **`!goal` survives provider errors (#105):** an api read-timeout
+  `ClientError` escaped the goal handler (only `Interrupt` was
+  rescued), leaving `GoalState` stuck in `:running`, the ledger
+  unfinalized and the session silent while the batch spinner kept
+  cycling with the cursor hidden. One `fail_goal` channel now serves
+  the `:error` return plus `ClientError`/`StandardError` rescues
+  (`Interrupt` still means `:stopped`); both command-dispatch branches
+  kill the leaked spinner instead of masking the real failure; and
+  goal steps record their tool calls to the session like free-text
+  turns.
+
+### Changed
+
+- **Redactor short-circuits secret-free lines (#104):** pre-compiled
+  quick-check constants plus a trigger check before scrubbing cut
+  allocations by ~68% on a mixed redact workload (172,940 -> 54,864
+  objects per 20x2000-line pass) with byte-for-byte output parity;
+  invalid-UTF-8 input stays total (masked/scrubbed) instead of raising
+  ArgumentError.
+
 ## [0.1.2] - 2026-10-11
 
+
 The Anthropic correctness release: the provider now speaks the modern
 extended-thinking contract, so pinning any current Claude model works
 instead of failing with HTTP 400.

data/lib/rubik/coeffects.rb

@@ -41,11 +41,11 @@ module Rubik
     DMESG          = "dmesg"
     DISPATCHER     = "dispatcher"
     INIT           = "init"
-    # Live !goal run snapshot (Rubik::Orchestrator::GoalState), provided by
-    # the goal command and rendered to agents via read_file rubik://goal/state.
+    # Live !goal run snapshot (Rubik::Orchestrator::GoalState), provided by the goal command and rendered to agents via read_file rubik://goal/state.
     GOAL_STATE     = "goal_state"
     # Structured goal ledger (GoalLedger::Ledger), provided by !goal when goal.ledger.enabled; unsatisfied outside a running !goal.
     GOAL_LEDGER    = "goal_ledger"
+    GOAL_REGISTRY  = "goal_registry" # suspended-goal registry (GoalRegistry, issue #106)
     # Central rubik://storage store (Rubik::Storage::Store), provided by
     # Storage::Service at shell boot and resolved by the storage tool /
     # read_file rubik://storage routes / supervisor transcript indexing.

data/lib/rubik/config/defaults.rb

@@ -27,11 +27,9 @@ module Rubik
         },
         "providers" => {},
         "agent" => {
-          "max_steps" => 40,
-          "goal_max_steps" => 100,
-          "plan_max_steps" => 15,
-          "warn_at_ratio" => 0.75,
-          "ask_continue_on_limit" => true, "goal_wait_timeout" => 300
+          "max_steps" => 40, "goal_max_steps" => 100, "plan_max_steps" => 15,
+          "warn_at_ratio" => 0.75, "ask_continue_on_limit" => true,
+          "goal_auto_continue_limit" => 0, "goal_wait_timeout" => 300
         },
         # rubik://storage sanal FS-DB (Rubik::Storage): hedef/plan/bellek/wiki/transcript varlıkları
         # + worktree'yi temiz tutan artifact absorb'u. root "~" içerebilir; project nil ise slug türetilir.

data/lib/rubik/context/scanner.rb

@@ -367,8 +367,11 @@ module Rubik
       # element-wise compare of the component arrays ("a/x" before "a.txt",
       # since "a" < "a.txt" at the first component; "lib/deep/core.rb" before
       # "lib/util.rb" via "deep" < "util").
+      # PERF: replacing "/" with NUL byte ("\x00") is equivalent to array component
+      # comparison because NUL (0x00) is strictly less than any valid path byte,
+      # avoiding intermediate Array allocations per path (~8.4x faster, ~62.5% fewer allocations).
       def order_like_walker(paths)
-        paths.sort_by { |p| p.split("/") }
+        paths.sort_by { |p| p.tr("/", "\x00") }
       end
 
       def parse_gitignore(dir = @root_dir)

data/lib/rubik/llm/client.rb

@@ -8,18 +8,36 @@ require_relative "../platform"
 
 module Rubik
   module LLM
-    class ClientError < StandardError; end
+    # Transport failure classification (issue #106): the client raises
+    # message-string ClientErrors, so callers cannot read the message to
+    # tell a transient transport failure (DNS, connection reset, exhausted
+    # 5xx, rate limit) from a permanent one (4xx content/auth/moderation,
+    # read timeout, malformed response). The flag is decided AT THE RAISE
+    # POINT — precedent: RateLimitError's retry_after: kwarg. Default is
+    # permanent (false); only the raise sites that provably saw a
+    # transport-class failure opt into transient.
+    class ClientError < StandardError
+      attr_reader :transient
+
+      def initialize(message, transient: false)
+        super(message)
+        @transient = transient == true
+      end
+
+      def transient? = @transient
+    end
 
     # HTTP 429 (rate limited), carrying the parsed Retry-After hint when the
     # server advertised one. Subclass of ClientError so every existing
     # `rescue ClientError` site keeps working; the typed class lets callers
     # distinguish "provider throttled us" from every other failure without
-    # parsing message strings.
+    # parsing message strings. Rate limiting is transient by nature — the
+    # subclass answers transient? true without a kwarg at every raise site.
     class RateLimitError < ClientError
       attr_reader :retry_after
 
       def initialize(message, retry_after: nil)
-        super(message)
+        super(message, transient: true)
         @retry_after = retry_after
       end
     end
@@ -283,7 +301,13 @@ module Rubik
             # raw makes every ClientError message binary and the UTF-8 output
             # layer raises inside the REPL's rescue clause (masking the real
             # HTTP error as Encoding::CompatibilityError).
-            raise ClientError, "HTTP Request failed with code #{res.code}: #{Rubik::Platform.safe_utf8(res.body)}"
+            # Exhausted 5xx is transport-class (provider outage) → transient;
+            # a 4xx is content/auth/moderation → permanent. One raise point
+            # for both, the flag decided by status (issue #106).
+            raise ClientError.new(
+              "HTTP Request failed with code #{res.code}: #{Rubik::Platform.safe_utf8(res.body)}",
+              transient: status >= 500
+            )
           end
 
           begin
@@ -309,7 +333,10 @@ module Rubik
               next
             end
           end
-          raise ClientError, "Network error calling #{uri.host}: #{e.class} #{e.message} (gave up after #{retries} retr#{retries == 1 ? 'y' : 'ies'})"
+          raise ClientError.new(
+            "Network error calling #{uri.host}: #{e.class} #{e.message} (gave up after #{retries} retr#{retries == 1 ? 'y' : 'ies'})",
+            transient: true
+          )
         rescue StandardError => e
           raise ClientError, "Network error calling #{uri.host}: #{e.class} #{e.message}"
         end
@@ -466,7 +493,7 @@ module Rubik
           # socket manifests exactly like this.
           clean_retry = !state[:surfaced] && attempts < 2
           retry if clean_retry
-          raise ClientError, "Network error during stream from #{uri.host}: #{e.message}"
+          raise ClientError.new("Network error during stream from #{uri.host}: #{e.message}", transient: true)
         rescue StandardError => e
           # Everything else is wrapped once without retrying. That includes
           # Net::ReadTimeout — same policy as post_json: the server may
@@ -502,7 +529,12 @@ module Rubik
               # is a Net::ReadAdapter sink, not the bytes (fresh-eye R7).
               raise rate_limit_error(response, nil, body_chunks.join) if status_code == 429
 
-              raise ClientError, "HTTP Request failed with code #{status_code}: #{Rubik::Platform.safe_utf8(body_chunks.join)}"
+              # Same status-decided split as the batch path (issue #106):
+              # exhausted 5xx → transient, 4xx → permanent.
+              raise ClientError.new(
+                "HTTP Request failed with code #{status_code}: #{Rubik::Platform.safe_utf8(body_chunks.join)}",
+                transient: status_code >= 500
+              )
             end
 
             response.read_body do |chunk|

data/lib/rubik/orchestrator/goal_ledger/ledger.rb

@@ -5,6 +5,8 @@ require "json"
 require_relative "../../prompt/context_compactor"
 require_relative "../../prompt/conversation_rows"
 require_relative "../../uris"
+require_relative "suspend_lifecycle"
+require_relative "xml_render"
 
 module Rubik
   module Orchestrator
@@ -27,6 +29,13 @@ module Rubik
       class Ledger
         Result = Struct.new(:status, :reasons, :rev, :uri, keyword_init: true)
 
+        # Askı yaşam döngüsü (issue #106): suspend!/unsuspend! damgaları +
+        # restore_from_row! + suspend_meta — instance-method include ile
+        # private yardımcılara (row_title, canonical_json, final_result,
+        # log, degrade) doğal erişir. Σ XML render yüzeyi XmlRender'da.
+        include SuspendLifecycle
+        include XmlRender
+
         # A planı üretim şemasını SAHİPLENİR: goal skeleton örnek örneği
         # üretim yüzeyi olur (frozen; verify alanları optional+allow_null —
         # re-verification planı doldurur).
@@ -52,6 +61,7 @@ module Rubik
           @finalized = false
           @updated_at = nil
           @last_drift_note = nil
+          @suspend_meta = nil
           @doc = seed_doc(goal_text)
         end
 
@@ -82,6 +92,12 @@ module Rubik
             ledger
           end
 
+          # Çapraz-süreç resume fabrikası — gövde SuspendLifecycle'ta
+          # (satır cap'i disiplini; bozuk/askı-olmayan damga → dürüst nil).
+          def load(store:, storage_id:, config: nil, dmesg: nil, event_bus: nil)
+            SuspendLifecycle.load(store: store, storage_id: storage_id, config: config, dmesg: dmesg, event_bus: event_bus)
+          end
+
           def config_get(config, key, default)
             return default if config.nil?
 
@@ -214,58 +230,15 @@ module Rubik
           @monitor.synchronize { DriftNote.render(snap: deep_dup(@doc)) }
         end
 
-        def to_xml
-          @monitor.synchronize { render_xml }
-        end
-
-        # §4.1 render: GoalState#to_xml mold'u — tüm metin xml_escape'ten
-        # geçer; boş koleksiyonların etiketi HİÇ basılmaz ("yokluk, boşluk
-        # değil" kuralı); optional attribute'lar (storage_id, verify) yalnız
-        # set iken basılır.
-        def render_xml
-          esc = Rubik::Platform.method(:xml_escape)
-          attrs = %(rev="#{@doc['rev']}")
-          attrs += %( storage_id="#{esc.call(@storage_id)}") if @storage_id
-          attrs += %( updated_at="#{@updated_at.utc.iso8601}") if @updated_at
-          body = []
-          body << %(  <objective>#{esc.call(@doc['objective'].to_s)}</objective>)
-          tasks = @doc["tasks"].map do |task|
-            text = task["title"].to_s
-            text += " — notes: #{task['notes']}" if task["notes"]
-            attrs_t = %(id="#{esc.call(task['id'].to_s)}" status="#{esc.call(task['status'].to_s)}")
-            attrs_t += %( verify="#{esc.call(task['verify'].to_s)}") if task["verify"]
-            task["title"] || task["notes"] ? %(  <task #{attrs_t}>#{esc.call(text)}</task>) : %(  <task #{attrs_t} />)
-          end
-          body << "<tasks>\n#{tasks.join("\n")}\n  </tasks>" unless tasks.empty?
-          findings = @doc["findings"].map do |f|
-            %(  <finding id="#{esc.call(f['id'].to_s)}" source_step="#{f['source_step']}">#{esc.call(f['text'].to_s)}</finding>)
-          end
-          body << "<findings>\n#{findings.join("\n")}\n  </findings>" unless findings.empty?
-          decisions = @doc["decisions"].map do |dec|
-            attrs_d = %(id="#{esc.call(dec['id'].to_s)}")
-            attrs_d += %( rationale="#{esc.call(dec['rationale'].to_s)}") if dec["rationale"]
-            %(  <decision #{attrs_d}>#{esc.call(dec['text'].to_s)}</decision>)
-          end
-          body << "<decisions>\n#{decisions.join("\n")}\n  </decisions>" unless decisions.empty?
-          questions = @doc["open_questions"].map { |q| %(  <question>#{esc.call(q.to_s)}</question>) }
-          body << "<open_questions>\n#{questions.join("\n")}\n  </open_questions>" unless questions.empty?
-          notes = @doc["environment_notes"].map do |note|
-            attrs_n = %(id="#{esc.call(note['id'].to_s)}")
-            attrs_n += %( verify="#{esc.call(note['verify'].to_s)}") if note["verify"]
-            %(  <note #{attrs_n}>#{esc.call(note['text'].to_s)}</note>)
-          end
-          body << "<environment_notes>\n#{notes.join("\n")}\n  </environment_notes>" unless notes.empty?
-          <<~XML.strip
-            <goal_ledger #{attrs}>
-            #{body.join("\n")}
-            </goal_ledger>
-          XML
-        end
+        # (Σ XML render yüzeyi — to_xml / render_xml — XmlRender sayfası.)
 
         def snapshot
           @monitor.synchronize do
             { rev: @doc["rev"], objective: @doc["objective"], storage_id: @storage_id,
-              updated_at: @updated_at, finalized: @finalized, tasks: @doc["tasks"].size,
+              updated_at: @updated_at, finalized: @finalized,
+              suspended: @suspend_meta.is_a?(Hash) && !@finalized,
+              suspend_meta: @suspend_meta ? deep_dup(@suspend_meta) : nil,
+              tasks: @doc["tasks"].size,
               findings: @doc["findings"].size, decisions: @doc["decisions"].size,
               open_questions: @doc["open_questions"].size, environment_notes: @doc["environment_notes"].size }
           end

data/lib/rubik/orchestrator/goal_ledger/suspend_lifecycle.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Rubik
+  module Orchestrator
+    module GoalLedger
+      # Askı yaşam döngüsü (issue #106): Σ'nın suspend/resume yarısı —
+      # Ledger'a include edilir (instance-method mixin; Ledger'ın private
+      # yardımcılarına ve @monitor'una doğal erişim, satır cap'i disiplini).
+      #
+      # Suspend damgası, finalize! deseninin birebir aynısıdır: son
+      # revizyon satırına satır-adresli put (id korunur, version++, gövde
+      # değişmez); yalnızca storage status → "suspended" ve links'e sayaç
+      # meta'sı {goal_id, steps, max_steps, extensions, tokens, reason,
+      # suspended_at, attempt} (JSON dizesi — normalize_links değerleri
+      # dizgeleştirir) yazılır. Askı TERMINAL DEĞİLDİR: @finalized
+      # dokunulmaz, sonraki finalize! damganın üzerine yazar. Store yoksa
+      # degrade sözleşmesi: tek dürüst warn, bellek-içi resume çalışır,
+      # çapraz-süreç resume dürüstçe reddedilir — asla çökmez.
+      module SuspendLifecycle
+        # Σ çalışma gövdesinin zorunlu koleksiyonları (Ledger.seed_doc moldu).
+        SIGMA_COLLECTIONS = ["tasks", "findings", "decisions", "open_questions", "environment_notes"].freeze
+
+        # Askı damgası meta'sı (load yolunda satırdan, suspend! yolunda
+        # parametreden): yukarıdaki şema; yoksa nil.
+        attr_reader :suspend_meta
+
+        def suspend!(meta)
+          @monitor.synchronize do
+            return nil if @finalized
+
+            @suspend_meta = deep_dup(meta.to_h.transform_keys(&:to_s))
+            if @store && @storage_id
+              links = @last_links.merge("suspended" => Rubik::Platform.safe_json_generate(@suspend_meta))
+              row = @store.put(type: "goal", id: @storage_id, title: row_title, body: canonical_json,
+                               tags: ["goal-ledger"], links: links, status: "suspended")
+              @storage_id = row["id"]
+            else
+              degrade_storage_once
+            end
+            log(:suspended, "goal ledger suspended at rev #{@doc['rev']} (attempt #{@suspend_meta['attempt']})")
+            final_result
+          end
+        rescue StandardError => e
+          degrade("suspend stamp", e)
+          @monitor.synchronize { final_result }
+        end
+
+        # Damganın temizlenmesi (resume anı): satır tekrar "active" olur —
+        # aksi halde koşan bir goal !goal list'te askı görünürdür. version++
+        # tek maliyet; ilk kabul zaten yeni satır açar. finalize! ile aynı
+        # idempotent guard; bellek-içi meta temizlenir (artık askı yok).
+        def unsuspend!
+          @monitor.synchronize do
+            return nil if @finalized
+            return nil unless @store && @storage_id
+
+            row = @store.put(type: "goal", id: @storage_id, title: row_title, body: canonical_json,
+                             tags: ["goal-ledger"], links: @last_links, status: "active")
+            @storage_id = row["id"]
+            @suspend_meta = nil
+            log(:unsuspended, "goal ledger resume at rev #{@doc['rev']}")
+            final_result
+          end
+        rescue StandardError => e
+          degrade("unsuspend stamp", e)
+          @monitor.synchronize { final_result }
+        end
+
+        # Ledger.load'un kurulum adımı: satır + JSON gövdeden çalışma
+        # durumunu geri yükler — YAZMA YOKTUR. @last_links zincir için
+        # korunur AMA bayat "suspended" damgası düşülür: aksi halde resume
+        # sonrası hiç ΔΣ kabulü olmadan gelen bir unsuspend!/finalize! ölü
+        # damgayı satır links'ine geri yazar (status "active"/"failed"
+        # iken links'te askı meta'sı). Taze damga suspend!'ın kendi
+        # merge'ünden gelir — restore'dan değil.
+        def restore_from_row!(row:, doc:)
+          @monitor.synchronize do
+            @doc = deep_dup(doc)
+            @storage_id = row["id"]
+            @last_links = deep_dup(row["links"].to_h.transform_keys(&:to_s))
+            @last_links.delete("suspended")
+            @suspend_meta = parse_suspend_meta(row)
+            @rejections = 0
+          end
+          self
+        end
+
+        class << self
+          # Çapraz-süreç resume fabrikası: askı damgası taşıyan Σ satırından
+          # defteri yeniden kurar (gövde JSON'u → @doc, links → @last_links,
+          # damga meta'sı → suspend_meta). YAZMA YOKTUR — load saf
+          # kurulumdur; ilk kabul yeni satır açar. Dürüst red: store /
+          # storage_id yok, satır yok, status "suspended" değil ya da gövde
+          # bozuksa / Σ şeması eksikse nil — resume handler'ı tek cümlelik
+          # ret basar. Şema red'i SAHİLENDİĞİNDE olmalı: eksik koleksiyonlu
+          # bir gövde geçse resume render'da NoMethodError ile ölür, oysa
+          # unsuspend! damgayı çoktan tüketmiş olurdu.
+          def load(store:, storage_id:, config: nil, dmesg: nil, event_bus: nil)
+            return nil unless store && storage_id
+
+            row = store.get(type: "goal", id: storage_id.to_s)
+            return nil unless row.is_a?(Hash) && row["status"] == "suspended"
+
+            doc = JSON.parse(row["body"].to_s)
+            return nil unless doc.is_a?(Hash) && doc["rev"].is_a?(Integer) &&
+                              doc["objective"] && SIGMA_COLLECTIONS.all? { |key| doc[key].is_a?(Array) }
+
+            ledger = Ledger.new(goal_text: doc["objective"].to_s,
+                                max_retries: Ledger.max_patch_retries(config),
+                                store: store, dmesg: dmesg, event_bus: event_bus)
+            ledger.restore_from_row!(row: row, doc: doc)
+            ledger
+          rescue StandardError => e
+            Rubik::Log.warn(:goal_ledger, "goal ledger load from suspend stamp failed " \
+                                          "(#{e.class}: #{e.message}); cross-process resume refused")
+            nil
+          end
+        end
+
+        private
+
+        # Satır links'indeki askı damgası meta'sını çözer (bozuk JSON →
+        # nil: load dürüst devam eder, yalnız sayaç geri yüklenemez).
+        def parse_suspend_meta(row)
+          raw = row.dig("links", "suspended")
+          parsed = JSON.parse(raw.to_s)
+          parsed.is_a?(Hash) ? parsed : nil
+        rescue StandardError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/goal_ledger/xml_render.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Orchestrator
+    module GoalLedger
+      # Σ XML render sayfası: rubik://goal/ledger read_file gövdesi.
+      # Ledger'a include edilir — SAF render'dır (durum sahibi Ledger'da
+      # kalır; bu sayfa yalnız @monitor altında okur), sayfa disiplini
+      # (hygiene satır cap'leri) altındaki Ledger'ı rahatlatır.
+      module XmlRender
+        def to_xml
+          @monitor.synchronize { render_xml }
+        end
+
+        # §4.1 render: GoalState#to_xml mold'u — tüm metin xml_escape'ten
+        # geçer; boş koleksiyonların etiketi HİÇ basılmaz ("yokluk, boşluk
+        # değil" kuralı); optional attribute'lar (storage_id, verify) yalnız
+        # set iken basılır.
+        def render_xml
+          esc = Rubik::Platform.method(:xml_escape)
+          attrs = %(rev="#{@doc['rev']}")
+          attrs += %( storage_id="#{esc.call(@storage_id)}") if @storage_id
+          attrs += %( updated_at="#{@updated_at.utc.iso8601}") if @updated_at
+          body = []
+          body << %(  <objective>#{esc.call(@doc['objective'].to_s)}</objective>)
+          tasks = @doc["tasks"].map do |task|
+            text = task["title"].to_s
+            text += " — notes: #{task['notes']}" if task["notes"]
+            attrs_t = %(id="#{esc.call(task['id'].to_s)}" status="#{esc.call(task['status'].to_s)}")
+            attrs_t += %( verify="#{esc.call(task['verify'].to_s)}") if task["verify"]
+            task["title"] || task["notes"] ? %(  <task #{attrs_t}>#{esc.call(text)}</task>) : %(  <task #{attrs_t} />)
+          end
+          body << "<tasks>\n#{tasks.join("\n")}\n  </tasks>" unless tasks.empty?
+          findings = @doc["findings"].map do |f|
+            %(  <finding id="#{esc.call(f['id'].to_s)}" source_step="#{f['source_step']}">#{esc.call(f['text'].to_s)}</finding>)
+          end
+          body << "<findings>\n#{findings.join("\n")}\n  </findings>" unless findings.empty?
+          decisions = @doc["decisions"].map do |dec|
+            attrs_d = %(id="#{esc.call(dec['id'].to_s)}")
+            attrs_d += %( rationale="#{esc.call(dec['rationale'].to_s)}") if dec["rationale"]
+            %(  <decision #{attrs_d}>#{esc.call(dec['text'].to_s)}</decision>)
+          end
+          body << "<decisions>\n#{decisions.join("\n")}\n  </decisions>" unless decisions.empty?
+          questions = @doc["open_questions"].map { |q| %(  <question>#{esc.call(q.to_s)}</question>) }
+          body << "<open_questions>\n#{questions.join("\n")}\n  </open_questions>" unless questions.empty?
+          notes = @doc["environment_notes"].map do |note|
+            attrs_n = %(id="#{esc.call(note['id'].to_s)}")
+            attrs_n += %( verify="#{esc.call(note['verify'].to_s)}") if note["verify"]
+            %(  <note #{attrs_n}>#{esc.call(note['text'].to_s)}</note>)
+          end
+          body << "<environment_notes>\n#{notes.join("\n")}\n  </environment_notes>" unless notes.empty?
+          <<~XML.strip
+            <goal_ledger #{attrs}>
+            #{body.join("\n")}
+            </goal_ledger>
+          XML
+        end
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/goal_registry.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "monitor"
+
+module Rubik
+  module Orchestrator
+    # Oturum düzeyi askı kaydı (issue #106 Faz 1): süreç içinde hayatta
+    # kalan askılı !goal koşularının canlı parçalarını (Loop, GoalState,
+    # Ledger) goal_id başına TEK girdide tutar. !goal resume en güncel
+    # girdiyi canlandırır; terminal yollar girdiyi siler.
+    #
+    # Zero-restart sözleşmesi: register aynı goal_id ile 1000 kez çağrılsa
+    # tek girdi kalır (swap, yığma yok — Context#provide inverse
+    # disiplininin aynısı) ve silinmiş girdi sözlüğü büyümez. Coeffect
+    # olarak sağlanır (Coeffects::GOAL_REGISTRY): ilk askıda provide
+    # edilir, sonraki provide'lar değer swap'idir, oturum dispose'u tek
+    # delete-inverse ile temizler.
+    class GoalRegistry
+      # Askılı koşunun canlandırılabilir parçaları. loop: hayatta kalan
+      # Loop örneği (history prefix'i sağlam); ledger: nil olabilir
+      # (goal.ledger.enabled=false koşuları — süreç içi resume çalışır,
+      # çapraz-süreç resume dürüstçe reddedilir).
+      Entry = Struct.new(:goal_id, :goal_text, :loop, :goal_state, :ledger,
+                         :reason, :suspended_at, :attempt, keyword_init: true)
+
+      def initialize
+        @monitor = Monitor.new
+        @entries = {}
+      end
+
+      # goal_id başına tek girdi: aynı id tekrar askıya alınırsa (resume →
+      # yeniden askı) girdi güncellenir, yenisi eklenmez. delete+set bilinçli
+      # bir çift işlemdir: girdiyi Hash'in sonuna taşır — böylece ekleme
+      # sırası askı recency'sine eşit olur (eski koşu yeniden askıya düşünce
+      # !goal resume EN SON askılaşanı canlandırmaya devam eder).
+      def register(entry)
+        @monitor.synchronize do
+          @entries.delete(entry.goal_id)
+          @entries[entry.goal_id] = entry
+        end
+        self
+      end
+
+      def fetch(goal_id)
+        @monitor.synchronize { @entries[goal_id] }
+      end
+
+      # En güncel askı: register'ın delete+set'i sayesinde Hash ekleme
+      # sırası = askı recency'si.
+      def latest
+        @monitor.synchronize { @entries.values.last }
+      end
+
+      def delete(goal_id)
+        @monitor.synchronize { @entries.delete(goal_id) }
+      end
+
+      def size
+        @monitor.synchronize { @entries.size }
+      end
+
+      def empty?
+        @monitor.synchronize { @entries.empty? }
+      end
+    end
+  end
+end