rubik 0.1.5 → 0.2.0

data/lib/rubik/security/redactor.rb

@@ -23,6 +23,9 @@ module Rubik
       # PERF: Pre-compiled constants to avoid re-allocation inside hot loops
       URL_PATTERN = %r{(https?://[^:]+:)([^@]+)@}
       URL_MASK = "\\1#{MASK_STRING}@".freeze
+      STATIC_PATTERNS = PATTERNS.reject { |pattern| pattern == URL_PATTERN }.freeze
+      # Skip static replacement passes for assignment-only and URL-only inputs.
+      STATIC_PATTERNS_COMBINED_REGEX = Regexp.union(STATIC_PATTERNS).freeze
       QUICK_CHECK_REGEX = %r{sk-|AKIA|ghp_|github_pat_|AIza|bearer|PRIVATE KEY|://[^:]+:|password|passwd|api_key|secret|token}i
 
       # Anahtar-maskeleme desenleri (Session::Recorder#mask_payload ile aynı
@@ -46,13 +49,10 @@ module Rubik
         # ve desenler zaten bu metne uygulanıyordu, dolayısıyla eşdeğerdir.
         return result unless result.match?(QUICK_CHECK_REGEX)
 
-        PATTERNS.each do |pattern|
-          if pattern == URL_PATTERN
-            result.gsub!(pattern, URL_MASK)
-          else
-            result.gsub!(pattern, MASK_STRING)
-          end
-        end
+        # Keep replacement order: masking one credential can expose a word
+        # boundary needed to recognize the next (for example, a bearer token).
+        STATIC_PATTERNS.each { |pattern| result.gsub!(pattern, MASK_STRING) } if result.match?(STATIC_PATTERNS_COMBINED_REGEX)
+        result.gsub!(URL_PATTERN, URL_MASK)
 
         result.gsub!(ASSIGNMENT_KEY_REGEX) do
           "#{Regexp.last_match(1)}#{Regexp.last_match(2)}#{MASK_STRING}"

data/lib/rubik/storage/transcript_indexer.rb

@@ -26,23 +26,30 @@ module Rubik
         return unless store && inst
 
         file = inst.transcript_uri.to_s
+        result_ref = inst.respond_to?(:result_ref) ? inst.result_ref : nil
         # Gerçek upsert: alias üzerinden varsa mevcut id güncellenir — resume
         # sonrası ikinci tamamlanma yinelenen transcript varlığı yaratmaz.
         ref = Rubik::Uris.transcript_ref(inst.storage_id)
         existing = store.get(type: "transcript", id: ref)
+        links = {
+          "subagent_id" => inst.storage_id.to_s,
+          # The raw path is forensics-only (read_file denies it): the
+          # canonical read route rides in the entity itself so recall
+          # consumers land on show_file in one hop (issue #97 finding 5).
+          "canonical" => Rubik::Uris.subagent_transcript(inst.storage_id),
+          "transcript" => file
+        }
+        # Issue #122: the searchable summary also points at the paginated
+        # retained-result route. Availability is session-scoped (archive TTL),
+        # so this is a pointer with explicit expiration semantics, not a
+        # promise of unbounded retention.
+        links["result"] = result_ref if result_ref
         store.put(
           type: "transcript",
           title: "[#{inst.type_name}] #{inst.role} (#{inst.id}) — #{inst.state}",
-          body: entity_body(inst, file),
+          body: entity_body(inst, file, result_ref: result_ref),
           tags: [inst.type_name.to_s, inst.state.to_s].uniq,
-          links: {
-            "subagent_id" => inst.storage_id.to_s,
-            # The raw path is forensics-only (read_file denies it): the
-            # canonical read route rides in the entity itself so recall
-            # consumers land on show_file in one hop (issue #97 finding 5).
-            "canonical" => Rubik::Uris.subagent_transcript(inst.storage_id),
-            "transcript" => file
-          },
+          links: links,
           status: inst.state.to_s,
           id: existing&.[]("id"),
           ref: ref
@@ -59,7 +66,7 @@ module Rubik
       # gelmeyen her metin (prompt fallback, inst.result) HAM memory'den
       # gelir — kalıcı+aranabilir gövdeye girmeden Redactor'dan geçer
       # (dosya tarafının maskeleme paritesi; review bulgusu).
-      def entity_body(inst, file)
+      def entity_body(inst, file, result_ref: nil)
         task = first_user_task(file)
         task_part = if task
                       "[task] #{clip(task)}"
@@ -71,7 +78,10 @@ module Rubik
 
         result = inst.respond_to?(:result) ? redact(inst.result.to_s) : ""
         result_part = result.empty? ? "[state] #{inst.state} — no result recorded" : "[result] #{clip(result)}"
-        "#{task_part}\n#{result_part}"
+        body = "#{task_part}\n#{result_part}"
+        return body unless result_ref && inst.respond_to?(:state) && inst.state.to_s == "completed"
+
+        "#{body}\n[retrieve] #{result_ref} — full retained result, paginated (manage_subagents action 'result')"
       end
 
       def redact(text)

data/lib/rubik/tools/builtins/exec.rb

@@ -150,51 +150,99 @@ module Rubik
       def execute(args = {})
         cmd = (args["command"] || args[:command]).to_s.strip
         background = args["background"] || args[:background]
-        if background
-          task_mgr = @task_manager || (@runtime_context.respond_to?(:get) ? Rubik::Coeffects.get(@runtime_context, Rubik::Coeffects::TASK_MANAGER) : nil)
-          return ToolOutput.error("TaskManager is not available to run commands in background.") unless task_mgr
+        return execute_background(cmd) if background
 
-          @guard.verify_command_safety!(cmd)
-          task = task_mgr.start(cmd, chdir: @root_dir, ctx: @runtime_context)
-          return "Command dispatched to background task [#{task.id}] (PID #{task.pid}): #{cmd}\nUse `manage_task` with action 'status' or 'logs' to inspect."
+        timeout = effective_timeout(args)
+        @guard.verify_command_safety!(cmd)
+        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        res = @runner.run(cmd, timeout: timeout, chdir: @root_dir)
+        duration_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round(1)
+        command_result(cmd, res, duration_ms: duration_ms)
+      rescue Rubik::Security::BlockedWriteError => e
+        # Authorization denial (issue #127): nothing executed, so no process
+        # exit code is fabricated — the metadata says denied / not executed.
+        # The prefix stays first for display consumers (StepExecutor::ERROR_PREFIXES).
+        Rubik::Tools::Result.new(
+          tool_name: "run_command", status: :error,
+          output: Rubik::Tools::RunCommandTool.blocked_guidance(e),
+          error: "command denied by security policy (not executed)",
+          exit_code: nil, metadata: { "executed" => false, "denied" => "authorization" }
+        )
+      rescue StandardError => e
+        Rubik::Tools::Result.new(
+          tool_name: "run_command", status: :error,
+          output: "Command error: #{e.message}", error: e.message,
+          exit_code: nil, metadata: { "executed" => false }
+        )
+      end
+
+      # Stable public seam (RunCommandTool#execute, ManageTaskTool, tests and
+      # dev/review_fix_check call it). The renderer lives in the security
+      # domain next to the error it renders: Rubik::Security::BlockedGuidance
+      # — also keeps this file under the builtin line budget.
+      def self.blocked_guidance(err)
+        Rubik::Security::BlockedGuidance.render(err)
+      end
+
+      private
+
+      def execute_background(cmd)
+        task_mgr = @task_manager ||
+                   (@runtime_context.respond_to?(:get) ? Rubik::Coeffects.get(@runtime_context, Rubik::Coeffects::TASK_MANAGER) : nil)
+        if task_mgr.nil?
+          return Rubik::Tools::Result.new(tool_name: "run_command", status: :error,
+                                          output: "TaskManager is not available to run commands in background.",
+                                          error: "task manager unavailable",
+                                          metadata: { "executed" => false, "background" => true })
         end
 
+        @guard.verify_command_safety!(cmd)
+        task = task_mgr.start(cmd, chdir: @root_dir, ctx: @runtime_context)
+        text = "Command dispatched to background task [#{task.id}] (PID #{task.pid}): #{cmd}\n" \
+               "Use `manage_task` with action 'status' or 'logs' to inspect."
+        Rubik::Tools::Result.new(tool_name: "run_command", status: :ok, output: text, exit_code: nil,
+                                 metadata: { "executed" => true, "background" => true, "task_id" => task.id })
+      end
+
+      def effective_timeout(args)
         # Timeout contract: runners expose their config via a public `config`
         # reader (Sandbox::Runner does via attr_reader). Never reach into an
         # arbitrary object with instance_variable_get — that couples us to an
         # ivar name we do not own and silently falls back if it is ever renamed.
         cfg = @runner.config if @runner.respond_to?(:config)
         cfg_timeout = cfg&.fetch("tools.timeout_seconds", 30) || 30
-        timeout = (args["timeout"] || args[:timeout] || cfg_timeout).to_i.clamp(1, 600)
+        (args["timeout"] || args[:timeout] || cfg_timeout).to_i.clamp(1, 600)
+      end
 
-        @guard.verify_command_safety!(cmd)
-        res = @runner.run(cmd, timeout: timeout, chdir: @root_dir)
-        status = res[:ok] ? "OK" : "EXIT #{res[:exit_code]}"
-        # Shell tag (Plan 55 D-5) teaches the model which interpreter ran the
-        # command; drivers that resolve no shell simply omit it.
+      # The structured command outcome (issue #127): the display text keeps
+      # the historical [OK]/[EXIT n] prefix and diagnostics, while the machine
+      # fields (status / exit_code / truncated / metadata) ride the Result
+      # contract through BOTH dispatch paths — no display-text parsing.
+      def command_result(cmd, res, duration_ms:)
+        exit_code = res[:exit_code]
+        timed_out = exit_code.to_i == 124
+        status_text = res[:ok] ? "OK" : "EXIT #{exit_code}"
         shell_tag = res[:shell] ? " (#{res[:shell]})" : ""
-        out = "[#{status}]#{shell_tag} #{res[:output]}"
+        out = "[#{status_text}]#{shell_tag} #{res[:output]}"
         out += "\n#{res[:isolation]}" if res[:isolation]
 
+        diagnostic = nil
         unless res[:ok]
           require_relative "../../runtime/diagnostic_engine" unless defined?(Rubik::Runtime::DiagnosticEngine)
-          diag = Rubik::Runtime::DiagnosticEngine.analyze_process_result(res, cmd: cmd)
-          out += "\n\n#{diag.format_for_llm}" if diag
+          diagnostic = Rubik::Runtime::DiagnosticEngine.analyze_process_result(res, cmd: cmd)
+          out += "\n\n#{diagnostic.format_for_llm}" if diagnostic
         end
-        out
-      rescue Rubik::Security::BlockedWriteError => e
-        # Prefix stays first: StepExecutor::ERROR_PREFIXES classifies by start_with?.
-        ToolOutput.error(Rubik::Tools::RunCommandTool.blocked_guidance(e))
-      rescue StandardError => e
-        ToolOutput.error("Command error: #{e.message}")
-      end
 
-      # Stable public seam (RunCommandTool#execute, ManageTaskTool, tests and
-      # dev/review_fix_check call it). The renderer lives in the security
-      # domain next to the error it renders: Rubik::Security::BlockedGuidance
-      # — also keeps this file under the builtin line budget.
-      def self.blocked_guidance(err)
-        Rubik::Security::BlockedGuidance.render(err)
+        timeout_suffix = timed_out ? " (timed out)" : ""
+        error_message = res[:ok] ? nil : "command exited with status #{exit_code}#{timeout_suffix}"
+
+        Rubik::Tools::Result.new(
+          tool_name: "run_command", status: res[:ok] ? :ok : :error, output: out,
+          error: error_message, exit_code: exit_code, duration_ms: duration_ms,
+          metadata: { "executed" => true, "timed_out" => timed_out,
+                      "diagnostic_category" => diagnostic && diagnostic.category.to_s,
+                      "shell" => res[:shell].to_s, "driver" => res[:driver].to_s }.reject { |_k, v| v.nil? || v == "" }
+        )
       end
     end
 

data/lib/rubik/tools/builtins/files.rb

@@ -19,7 +19,12 @@ module Rubik
           type: "object",
           properties: {
             path: { type: "string", description: "File path, or virtual rubik:// URI: 'rubik://storage/<project>/<type>/<id>' " \
-                                                 "(browse from 'rubik://storage/index'), 'rubik://goal/state', 'rubik://subagent/<id>/transcript'" },
+                                                 "(browse from 'rubik://storage/index'), 'rubik://goal/state', " \
+                                                 "'rubik://subagent/<storage-id>/transcript' (the UNIQUE storage id from " \
+                                                 "manage_subagents status 'transcript_ref' or wait rows — live while running, " \
+                                                 "persisted after the first save; a display id like 'subagent-2' or a disk path " \
+                                                 "is NOT a transcript address), 'rubik://subagent/<storage-id>/result[/<run>]' " \
+                                                 "(retained completed results)" },
             offset: { type: "integer", description: "1-based line number to start reading from (optional)" },
             limit: { type: "integer", description: "Maximum number of lines to read (optional)" },
             from_disk: { type: "boolean", description: "Read current disk content without modifying in-memory buffer" },

data/lib/rubik/tools/builtins/lifecycle.rb

@@ -3,6 +3,8 @@
 require_relative "../base"
 require_relative "../output"
 require_relative "../../runtime"
+require_relative "../../runtime/repair_probe"
+require_relative "../../buffer/apply_contract"
 
 module Rubik
   module Tools
@@ -33,7 +35,9 @@ module Rubik
       def execute(args = {})
         return ToolOutput.error("Buffer manager is not connected.") unless @buffer_manager
 
-        if @shell&.config && @shell.config.fetch("buffer.model_can_apply", true) == false
+        shell_config = @shell.respond_to?(:config) ? @shell.config : nil
+        manager_config = @buffer_manager.respond_to?(:config) ? @buffer_manager.config : nil
+        unless Rubik::Buffer::ApplyContract.model_can_apply?(shell_config: shell_config, manager_config: manager_config)
           return ToolOutput.error("Model buffer application is disabled by configuration " \
                                   "(buffer.model_can_apply: false). The human operator will review and apply changes.")
         end
@@ -43,7 +47,15 @@ module Rubik
         policy = force ? "overwrite" : nil
 
         if @buffer_manager.dirty?
-          applied = @buffer_manager.apply!(policy: policy)
+          applied = nil
+          begin
+            applied = @buffer_manager.apply!(policy: policy)
+          rescue Rubik::Buffer::ApplyFailedError => e
+            # Partial apply: files in e.applied ARE on disk — sync the model's
+            # view for them and report the remainder honestly (issue #146).
+            lines = Rubik::Buffer::ApplyContract.failure_lines(e, sync: ->(paths) { @shell&.sync_context_and_ast(paths) })
+            return ToolOutput.error(lines.join("\n"))
+          end
           conflicts = @buffer_manager.last_conflicts || []
           @shell&.sync_context_and_ast(applied) unless applied.empty?
 
@@ -68,30 +80,16 @@ module Rubik
             messages.join("\n")
           end
         else
-          clean_buffer_message
+          Rubik::Buffer::ApplyContract.clean_buffer_message(@buffer_manager.last_applied, auto_apply_mode)
         end
       end
 
       private
 
-      # "Buffer is clean" alone reads as "nothing happened" when an earlier
-      # apply (apply_buffer itself or the auto-apply policy) already flushed
-      # the edits to disk. Surface the last successful apply so the model can
-      # verify against reality instead of re-editing or force-applying
-      # (issue #97 finding 6). When the mode cannot be read, the origin stays
-      # deliberately two-sided rather than inventing a specific cause.
-      def clean_buffer_message
-        last = @buffer_manager.last_applied
-        return "No unapplied buffer changes to write (buffer is clean)." unless last.is_a?(Hash) && Array(last[:paths]).any?
-
-        mode = @shell.respond_to?(:config) && @shell.config.respond_to?(:fetch) ? @shell.config.fetch("buffer.auto_apply", "manual") : nil
-        origin = if !mode.nil? && !mode.to_s.strip.empty? && mode.to_s.downcase != "manual"
-                   "the auto-apply policy (buffer.auto_apply: #{mode})"
-                 else
-                   "an earlier apply_buffer call or the auto-apply policy"
-                 end
-        "No unapplied buffer changes to write (buffer is clean): #{last[:paths].size} file(s) were already written to disk " \
-          "at #{last[:at].utc.iso8601} by #{origin}: #{last[:paths].join(', ')}."
+      def auto_apply_mode
+        return nil unless @shell.respond_to?(:config) && @shell.config.respond_to?(:fetch)
+
+        @shell.config.fetch("buffer.auto_apply", "manual")
       end
     end
 
@@ -117,6 +115,10 @@ module Rubik
               type: "string",
               description: "Replacement or custom command string (optional, probed automatically if auto_probe: true)"
             },
+            probe_args: {
+              type: "array", items: { type: "string" },
+              description: "Explicit non-mutating functional probe arguments appended to the exact proposed command; required for unknown executables"
+            },
             auto_probe: {
               type: "boolean",
               description: "Whether to automatically probe system binaries and candidate commands (default: true)"
@@ -187,7 +189,7 @@ module Rubik
         error_diagnostic = nil
 
         begin
-          verified, error_diagnostic = verify_binary(target, lang, proposed_cmd, sub_ctx)
+          verified, error_diagnostic = verify_binary(target, lang, proposed_cmd, sub_ctx, probe_args: args["probe_args"] || args[:probe_args])
         rescue StandardError => e
           error_diagnostic = Rubik::Runtime::DiagnosticEngine.diagnose(
             cmd: proposed_cmd,
@@ -200,66 +202,114 @@ module Rubik
 
         return ToolOutput.error("Verification failed for #{target} (#{lang}):\n#{error_diagnostic&.format_for_llm}") unless verified
 
-        # 3. Live Context Promotion & Subsystem Configuration (Zero-Downtime Hot Swapping)
-        case target
-        when "lsp"
-          cfg_key = "lsp.servers.#{lang}"
-          prev_cmd = @config&.fetch(cfg_key)
-          had_client = @lsp_manager ? !@lsp_manager.client_for(lang).nil? : false
-          @config&.set(cfg_key, proposed_cmd)
-          if @lsp_manager
-            @lsp_manager.stop_client(lang)
-            start_res = @lsp_manager.start_client(lang)
-            unless start_res.is_a?(Hash) && start_res[:ok] == true
-              # Failure Reversibility (AGENTS.md §1.A): roll back the in-memory
-              # state; disk stays clean because persist happens only after a
-              # verified start (atomic promotion).
-              @lsp_manager.stop_client(lang)
-              @config&.set(cfg_key, prev_cmd)
-              @lsp_manager.start_client(lang) if had_client
-              cause = start_res.is_a?(Hash) ? start_res[:error] : "unexpected start_client response"
-              return ToolOutput.error("Failed to start LSP server for #{lang} ('#{proposed_cmd}'); " \
-                                      "previous configuration restored. Cause: #{cause}")
+        # Live changes belong to a disposable transaction. Successful project
+        # persistence is an operator decision and outlives lifecycle cleanup.
+        promotion_ctx = root_ctx.extend
+        released = false
+        @repair_scopes ||= {}
+        cfg_key = { "lsp" => "lsp.servers", "test_runner" => "test.runners",
+                    "linter" => "linter.commands" }[target]
+        cfg_key = "#{cfg_key}.#{lang}" if cfg_key
+        prev_cmd = @config&.fetch(cfg_key) if cfg_key
+        service_key = "#{{ 'test_runner' => 'runner' }.fetch(target, target)}:#{lang}"
+        previous_services = root_ctx.services
+        phase = "Promotion"
+        begin
+          promotion_ctx.on_dispose do
+            next if released
+
+            @repair_scopes.delete([root_ctx, service_key]) if @repair_scopes[[root_ctx, service_key]].equal?(promotion_ctx)
+            unless root_ctx.disposed?
+              if previous_services.key?(service_key)
+                restored = target == "lsp" ? @lsp_manager&.clients&.[](lang) : nil
+                root_ctx.provide(service_key, restored || previous_services[service_key])
+              else
+                root_ctx.unprovide(service_key)
+              end
             end
-            active_client = @lsp_manager.client_for(lang)
-            root_ctx.provide("lsp:#{lang}", active_client || proposed_cmd)
-          else
-            root_ctx.provide("lsp:#{lang}", proposed_cmd)
           end
-          # Persist to project config only after the live promotion succeeded.
-          persist_res = @config&.set(cfg_key, proposed_cmd, persist: :project)
-        when "test_runner"
-          persist_res = @config&.set("test.runners.#{lang}", proposed_cmd, persist: :project)
-          if @adapter_registry
-            adapter = @adapter_registry.get(lang)
-            if adapter
-              adapter.config ||= @config
-              adapter.custom_test_cmd = proposed_cmd
-            else
-              require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
-              new_adapter = Rubik::Adapter::GenericAdapter.new(lang, test_cmd: proposed_cmd, guard: @guard)
-              new_adapter.config = @config
-              @adapter_registry.register(lang, new_adapter, ctx: root_ctx)
+          if cfg_key && @config
+            promotion_ctx.on_dispose do
+              next if released
+
+              prev_cmd.nil? ? @config.delete(cfg_key) : @config.set(cfg_key, prev_cmd)
             end
+            @config.set(cfg_key, proposed_cmd)
           end
-          root_ctx.provide("runner:#{lang}", proposed_cmd)
-        when "linter"
-          persist_res = @config&.set("linter.commands.#{lang}", proposed_cmd, persist: :project)
-          if @adapter_registry
-            adapter = @adapter_registry.get(lang)
-            if adapter
-              adapter.config ||= @config
-              adapter.custom_format_cmd = proposed_cmd
-            else
-              require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
-              new_adapter = Rubik::Adapter::GenericAdapter.new(lang, format_cmd: proposed_cmd, guard: @guard)
-              new_adapter.config = @config
-              @adapter_registry.register(lang, new_adapter, ctx: root_ctx)
+
+          case target
+          when "lsp"
+            raise "LSP manager and config are required for live activation" unless @lsp_manager && @config
+
+            had_client = !@lsp_manager.clients[lang].nil?
+            # The manager owns its client table. Restore the old configured
+            # client on rollback; probe clients never enter that table.
+            promotion_ctx.on_dispose do
+              next if released
+
+              @lsp_manager.stop_client(lang)
+              prev_cmd.nil? ? @config.delete(cfg_key) : @config.set(cfg_key, prev_cmd)
+              if had_client && !root_ctx.disposed?
+                restored = @lsp_manager.start_client(lang)
+                raise "Previous LSP client could not be restarted: #{restored}" unless restored[:ok]
+              end
+            end
+            @lsp_manager.stop_client(lang)
+            start_res = @lsp_manager.start_client(lang)
+            raise "Failed to start LSP server: #{start_res}" unless start_res.is_a?(Hash) && start_res[:ok]
+
+            service = @lsp_manager.clients[lang]
+            raise "LSP manager reported success without an active client" unless service
+          when "test_runner", "linter"
+            if @adapter_registry
+              adapter = @adapter_registry.get(lang)
+              if adapter
+                field = target == "test_runner" ? :custom_test_cmd : :custom_format_cmd
+                old_value = adapter.public_send(field)
+                old_config = adapter.config
+                promotion_ctx.on_dispose do
+                  next if released
+
+                  adapter.public_send("#{field}=", old_value)
+                  adapter.config = old_config
+                end
+                adapter.config ||= @config
+                adapter.public_send("#{field}=", proposed_cmd)
+              else
+                require_relative "../../adapter/generic" unless defined?(Rubik::Adapter::GenericAdapter)
+                options = target == "test_runner" ? { test_cmd: proposed_cmd } : { format_cmd: proposed_cmd }
+                adapter = Rubik::Adapter::GenericAdapter.new(lang, **options, guard: @guard)
+                adapter.config = @config
+                promotion_ctx.on_dispose do
+                  @adapter_registry.unregister(lang) if !released && @adapter_registry.get(lang).equal?(adapter)
+                end
+                @adapter_registry.register(lang, adapter)
+              end
             end
+            service = proposed_cmd
+          when "command"
+            service = proposed_cmd
           end
-          root_ctx.provide("linter:#{lang}", proposed_cmd)
-        when "command"
-          root_ctx.provide("command:#{lang}", proposed_cmd)
+
+          root_ctx.provide(service_key, service)
+          phase = "Persistence"
+          persist_res = @config.set(cfg_key, proposed_cmd, persist: :project) if cfg_key && @config
+          raise persist_res[:error].to_s if persist_res.is_a?(Hash) && !persist_res[:ok]
+        rescue StandardError => e
+          promotion_ctx.dispose
+          rollback_errors = promotion_ctx.last_dispose_errors
+          detail = rollback_errors.empty? ? "previous session state restored" : "rollback incomplete: #{rollback_errors}"
+          return ToolOutput.error("#{phase} failed for #{target} (#{lang}): #{e.message}; #{detail}")
+        end
+
+        # Keep one lifetime inverse per repaired key, preserving the original
+        # baseline across repeated repairs without retaining every transaction.
+        scope_key = [root_ctx, service_key]
+        if @repair_scopes.key?(scope_key)
+          released = true
+          promotion_ctx.dispose
+        else
+          @repair_scopes[scope_key] = promotion_ctx
         end
 
         if @config.nil? && ["lsp", "test_runner", "linter"].include?(target)
@@ -267,71 +317,14 @@ module Rubik
                  "so the command is active for this session only and was not saved."
         end
 
-        if persist_res.is_a?(Hash) && !persist_res[:ok]
-          return "⚠️ Promoted '#{proposed_cmd}' for #{target} (#{lang}) — active in this session, " \
-                 "but saving to the project config failed: #{persist_res[:error]}"
-        end
-
         "✨ Successfully verified and promoted runtime service for #{target} (#{lang}): '#{proposed_cmd}'. " \
-          "Service is now active and hot-swapped in the live context with zero downtime."
+          "Service is now active in the live context."
       end
 
       private
 
-      def verify_binary(target, lang, proposed_cmd, sub_ctx)
-        case target
-        when "lsp"
-          client = Rubik::LSP::Client.new(lang, root_dir: @root_dir, server_cmd: proposed_cmd)
-          if client.available?
-            sub_ctx.provide("lsp_probe:#{lang}", client)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: LSP binary '#{client.binary_name}' not available on system"
-            )]
-          end
-        when "test_runner"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("runner_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Test runner executable not found in PATH"
-            )]
-          end
-        when "linter"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("linter_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Linter/formatter executable not found in PATH"
-            )]
-          end
-        when "command"
-          if Rubik::Runtime::Discovery.binary_available?(proposed_cmd)
-            sub_ctx.provide("command_probe:#{lang}", proposed_cmd)
-            [true, nil]
-          else
-            [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-              cmd: proposed_cmd,
-              exit_code: 127,
-              stderr: "Pre-flight check failed: Command executable not found in PATH"
-            )]
-          end
-        else
-          [false, Rubik::Runtime::DiagnosticEngine.diagnose(
-            cmd: proposed_cmd,
-            exit_code: 1,
-            stderr: "Unknown target component type: #{target}"
-          )]
-        end
+      def verify_binary(target, lang, proposed_cmd, sub_ctx, probe_args: nil)
+        Rubik::Runtime::RepairProbe.new(root_dir: @root_dir).verify(target, lang, proposed_cmd, sub_ctx, probe_args: probe_args)
       end
     end