rubik 0.1.5 → 0.2.0

data/lib/rubik/orchestrator/subagent/journal.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+require "json"
+require "monitor"
+require "time"
+require "fileutils"
+require_relative "../../platform"
+require_relative "../../security/redactor"
+
+module Rubik
+  module Orchestrator
+    module Subagent
+      # Append-only, redacted execution journal (issue #124).
+      #
+      # The durable transcript is a CONVERSATION SNAPSHOT: save! rewrites it
+      # from the current mutable history, so once compaction replaces earlier
+      # steps with a summary marker the pre-compaction events are gone from it.
+      # This journal is the complementary artifact: every lifecycle,
+      # tool-call, tool-result and compaction event is appended BEFORE the
+      # history can be pruned, records are never rewritten, and a redeployed
+      # run continues the same file distinguished by its run sequence.
+      #
+      # Retention is bounded independently of the model context: at most
+      # `subagents.journal.max_bytes` per execution file. Once the cap is
+      # reached a final `journal_truncated` record marks the boundary and
+      # further events are not persisted (a cancellation outcome is recorded
+      # when the handler can still write one). Tool payloads are previewed
+      # (PREVIEW_CHARS) with explicit `output_chars` / `output_truncated`
+      # metadata plus an `artifact_ref` to the conversation snapshot, so replay
+      # can distinguish originals from summaries from clipped output.
+      #
+      # Every record passes through Redactor.mask_value before it reaches the
+      # file — credentials are redacted before persistence, never after. A
+      # crash mid-append can leave a partial last line; Journal.read skips
+      # malformed rows and reports them, so earlier valid records always stay
+      # readable. Write failures are observable through #last_error (surfaced
+      # in Instance#to_h), never raised into the run.
+      class Journal
+        FILENAME = "journal.jsonl"
+        DEFAULT_MAX_BYTES = 2_097_152
+        # Headroom kept free for the final truncation marker: accepted records
+        # never consume the last bytes, so the marker always fits inside the cap.
+        MARKER_RESERVE = 512
+        MIN_MAX_BYTES = 1024
+        PREVIEW_CHARS = 4000
+        ARGS_CHARS = 2000
+        PROMPT_CHARS = 400
+
+        Read = Struct.new(:records, :skipped, :truncated, :error, keyword_init: true)
+
+        attr_reader :path
+
+        def initialize(path:, config: nil)
+          @path = path.to_s
+          @monitor = Monitor.new
+          @max_bytes = [config_get(config, "subagents.journal.max_bytes", DEFAULT_MAX_BYTES).to_i, MIN_MAX_BYTES].max
+          @seq = self.class.read(@path).records.length
+          @bytes = File.exist?(@path) ? File.size(@path) : 0
+          @closed = false
+          @last_error = nil
+        end
+
+        # The generic append core: sequence, run, timestamp and type are the
+        # record envelope; the payload is masked HERE (single redaction gate).
+        def append(event, run: 1, data: {}, call_id: nil)
+          @monitor.synchronize do
+            return nil if @closed
+
+            @last_run = run.to_i
+            row = { "seq" => @seq + 1, "run" => @last_run, "ts" => Time.now.utc.iso8601(3),
+                    "event" => event.to_s, "data" => Rubik::Security::Redactor.mask_value(data) }
+            row["call_id"] = call_id.to_s if call_id
+            line = "#{Rubik::Platform.safe_json_generate(row)}\n"
+            if @bytes + line.bytesize + MARKER_RESERVE > @max_bytes
+              mark_truncated
+              return nil
+            end
+            return nil unless write!(line)
+
+            @seq += 1
+            @bytes += line.bytesize
+            row
+          end
+        end
+
+        # --- semantic record vocabulary (the only place event shapes live) ---
+
+        def record_run_started(run:, role:, type:, prompt:)
+          data = { "role" => role.to_s, "type" => type.to_s, "prompt_preview" => clip(prompt, PROMPT_CHARS) }
+          append("run_started", run: run, data: data)
+        end
+
+        def record_run_finished(run:, state:, result: nil, result_ref: nil)
+          text = result.to_s
+          data = { "state" => state.to_s, "result_chars" => text.length,
+                   "result_preview" => clip(text, PROMPT_CHARS), "result_ref" => result_ref }.compact
+          append("run_finished", run: run, data: data)
+        end
+
+        def record_cancelled(run:, reason: nil)
+          append("cancelled", run: run, data: { "reason" => reason.to_s })
+        end
+
+        def record_tool_call(run:, call_id:, tool:, args:)
+          json = Rubik::Platform.safe_json_generate(Rubik::Security::Redactor.mask_value(args))
+          data = { "tool" => tool.to_s, "args_chars" => json.length }
+          if json.length > ARGS_CHARS
+            data["args_truncated"] = true
+            data["args_preview"] = clip(json, ARGS_CHARS)
+          else
+            data["args"] = args
+          end
+          append("tool_call", run: run, call_id: call_id, data: data)
+        end
+
+        def record_tool_result(run:, call_id:, tool:, status:, duration_ms:, output:, artifact_ref: nil, exit_code: nil,
+                               truncated: false)
+          text = output.to_s
+          data = { "tool" => tool.to_s, "status" => status.to_s, "exit_code" => exit_code, "duration_ms" => duration_ms,
+                   "output_chars" => text.length, "output_truncated" => truncated || text.length > PREVIEW_CHARS,
+                   "output_preview" => clip(text, PREVIEW_CHARS), "artifact_ref" => artifact_ref }.compact
+          append("tool_result", run: run, call_id: call_id, data: data)
+        end
+
+        def record_compaction(run:, layer:, reason: nil, before: nil, after: nil)
+          data = { "layer" => layer.to_s, "reason" => reason.to_s.slice(0, 200),
+                   "history_before" => before, "history_after" => after }.compact
+          append("compaction", run: run, data: data)
+        end
+
+        # Tolerant reader: malformed rows (an interrupted final write included)
+        # are skipped and COUNTED — one partial line never hides valid history.
+        def self.read(path)
+          records = []
+          skipped = 0
+          return Read.new(records: records, skipped: skipped, truncated: false) unless File.exist?(path)
+
+          File.foreach(path, encoding: "UTF-8") do |line|
+            next if line.strip.empty?
+
+            row = begin
+              JSON.parse(line.scrub)
+            rescue JSON::ParserError
+              nil
+            end
+            if row.is_a?(Hash) && row["seq"]
+              records << row
+            else
+              skipped += 1
+            end
+          end
+          Read.new(records: records, skipped: skipped,
+                   truncated: records.any? { |r| r["event"] == "journal_truncated" })
+        rescue StandardError => e
+          Read.new(records: records, skipped: skipped + 1, truncated: false, error: e)
+        end
+
+        def read = self.class.read(@path)
+
+        # The last persistence failure (nil while healthy) — read under the
+        # journal lock so Instance#to_h never observes a half-written value.
+        def last_error = @monitor.synchronize { @last_error }
+
+        private
+
+        def mark_truncated
+          @closed = true
+          marker = { "seq" => @seq + 1, "run" => (@last_run || 1).to_i, "ts" => Time.now.utc.iso8601(3),
+                     "event" => "journal_truncated",
+                     "data" => { "max_bytes" => @max_bytes, "reason" => "retention cap reached; further events are not journaled" } }
+          line = "#{Rubik::Platform.safe_json_generate(marker)}\n"
+          return nil if @bytes + line.bytesize > @max_bytes || !write!(line)
+
+          @seq += 1
+          @bytes += line.bytesize
+          nil
+        end
+
+        def write!(line)
+          FileUtils.mkdir_p(File.dirname(@path))
+          File.write(@path, line, mode: "a")
+          true
+        rescue StandardError => e
+          @last_error = "#{e.class}: #{e.message}"
+          false
+        end
+
+        def clip(text, limit)
+          value = Rubik::Security::Redactor.redact(text.to_s)
+          value.length > limit ? "#{value[0, limit]}... [truncated #{value.length - limit} chars]" : value
+        end
+
+        def config_get(config, key, default)
+          return default if config.nil?
+
+          val = if config.is_a?(Hash)
+                  config[key] || config.dig(*key.split("."))
+                elsif config.respond_to?(:fetch)
+                  config.fetch(key, nil)
+                end
+          val.nil? ? default : val
+        end
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/subagent/narration.rb

@@ -74,6 +74,19 @@ module Rubik
           end
         end
 
+        # Wait-return narration (issue #126): WHY the wait returned, as the next
+        # actionable fact; nil for a settled wait (no story to tell).
+        WAIT_REASON_HINTS = {
+          deadline: "Deadline reached while subagent(s) remain ACTIVE — they keep running; wait again with a longer timeout or conclude your turn.",
+          paused: "Subagent(s) are paused and need an action (extend_budget / resume / answer their question) before the chain continues.",
+          queued: "Only dependency-queued work remains — it launches automatically once its predecessors settle; no action needed.",
+          unknown: "No such subagent id(s) — check the roster with manage_subagents(action: 'list')."
+        }.freeze
+
+        def wait_reason_hint(reason)
+          WAIT_REASON_HINTS[reason.to_sym]
+        end
+
         # The nil-provider fast path's terminal stub (a legitimate outcome:
         # no provider, no story beyond the echo of the task itself).
         def completed_stub_line(id, role, prompt)
@@ -93,6 +106,7 @@ module Rubik
           Action.new(canonical: "status", aliases: [], param: "conversation_id"),
           Action.new(canonical: "wait", aliases: [], param: "conversation_ids"),
           Action.new(canonical: "transcript", aliases: [], param: "conversation_id"),
+          Action.new(canonical: "result", aliases: [], param: "conversation_id"),
           Action.new(canonical: "extend_budget", aliases: ["grant_steps", "extend"], param: "conversation_id"),
           Action.new(canonical: "resume", aliases: ["retry"], param: "conversation_id"),
           Action.new(canonical: "redeploy", aliases: [], param: "conversation_id"),

data/lib/rubik/orchestrator/subagent/notices.rb

@@ -6,9 +6,8 @@ require_relative "budget"
 module Rubik
   module Orchestrator
     module Subagent
-      # THE single vocabulary home for subagent notices: event names and
-      # payloads enter, two channel renderings leave (user channel: REPL
-      # hints allowed; model channel: tool-oriented).
+      # THE single vocabulary home for subagent notices: event names and payloads
+      # enter, two channel renderings leave (user: REPL hints; model: tool-oriented).
       module Notices
         module_function
 
@@ -34,11 +33,8 @@ module Rubik
         # Sessizlik (§4.3): bu roller notice ÜRETMEZ, yalnız dmesg'e düşer (Distiller + Context Pruner).
         SILENT_ROLES = ["Vakanüvis Distiller", "Context Pruner"].freeze
 
-        # Dmesg-plane emission metadata (bug-llm-timeout-observability): every
-        # subagent-plane event lands in the ring under subsystem :subagent with
-        # an operational-weight severity, so dmesg(level:/subsystem:) surfaces
-        # a stalled subagent. MESSAGE_EVENT routes here too (a :message notice
-        # via handle_parent_message, not normalize).
+        # Dmesg-plane metadata (bug-llm-timeout-observability): subagent-plane events
+        # land in the ring under subsystem :subagent with an operational-weight severity.
         SUBSYSTEM = :subagent
 
         SEVERITIES = {
@@ -51,12 +47,11 @@ module Rubik
           MESSAGE_EVENT => :info
         }.freeze
 
-        # The one emission door: severity and subsystem are decided HERE,
-        # never re-derived at call sites. Nil bus = the old `&.emit` skip;
-        # a bus lacking #emit still raises loud; a legacy 2-arity emit gets
-        # a plain 2-arg call (severity metadata best-effort, delivery
-        # load-bearing). `fallback:` flips a raise into a stderr warn (the
-        # AutoApply.report_failure pattern) for load-bearing event sites.
+        # The one emission door: severity and subsystem are decided HERE, never
+        # re-derived at call sites. Nil bus = the old `&.emit` skip; a bus lacking
+        # #emit still raises loud; a legacy 2-arity emit gets a plain 2-arg call
+        # (severity metadata best-effort, delivery load-bearing). `fallback:`
+        # flips a raise into a stderr warn (AutoApply.report_failure pattern).
         def emit(bus, event_name, payload, fallback: nil)
           return if bus.nil?
 
@@ -92,11 +87,12 @@ module Rubik
             notice[:reason] = raw_err.to_s.slice(0, kind == :question ? 300 : 120)
           end
           notice[:timeout] = payload[:timeout] if kind == :question
+          # Kanonik referanslar (#122/#129): sonuç + transcript okuma adresleri bildirimle taşınır.
+          notice[:result_ref] = payload[:result_ref].to_s if payload[:result_ref]
+          notice[:transcript_ref] = payload[:transcript_ref].to_s if payload[:transcript_ref]
           # B11: grant/step markers make repeated pauses distinguishable.
-          if kind == :budget_exhausted
-            notice[:grants] = payload[:grants].to_i if payload[:grants].to_i.positive?
-            notice[:step] = payload[:step].to_i if payload[:step].to_i.positive?
-          end
+          notice[:grants] = payload[:grants].to_i if kind == :budget_exhausted && payload[:grants].to_i.positive?
+          notice[:step] = payload[:step].to_i if kind == :budget_exhausted && payload[:step].to_i.positive?
           notice
         end
 
@@ -109,8 +105,7 @@ module Rubik
             "⚠️ [Subagent Auto-Apply] [#{notice[:id]}] '#{notice[:role]}' could not auto-apply its buffer (#{notice[:reason]}). Changes remain unapplied."
           when :budget_exhausted
             grants = notice[:grants].to_i
-            step = notice[:step]
-            cyc = " again (after #{grants} grant(s) consumed#{", at step #{step}" if step})" if grants.positive?
+            cyc = " again (after #{grants} grant(s) consumed#{", at step #{notice[:step]}" if notice[:step]})" if grants.positive?
             "⚠️ [Subagent Paused] [#{notice[:id]}] '#{notice[:role]}' reached step budget#{cyc} " \
               "(#{notice[:max_steps]} steps). Run '!subagents extend #{notice[:id]}' to resume."
           when :error_paused
@@ -140,6 +135,8 @@ module Rubik
         def model_element(notice)
           attrs = { kind: notice[:kind], id: notice[:id], role: notice[:role], state: notice[:state] }
           attrs[:max_steps] = notice[:max_steps] if notice[:kind] == :budget_exhausted
+          attrs[:result_ref] = notice[:result_ref] if notice[:result_ref]
+          attrs[:transcript_ref] = notice[:transcript_ref] if notice[:transcript_ref]
           reason_kinds = [:context_compacted, :auto_apply_failed, :error_paused, :message, :task, :question]
           attrs[:reason] = notice[:reason] if reason_kinds.include?(notice[:kind]) && !notice[:reason].to_s.empty?
           attrs[:timeout] = notice[:timeout] if notice[:kind] == :question && notice[:timeout]
@@ -177,8 +174,10 @@ module Rubik
           else
             if notice[:state] == "budget_exhausted"
               budget_exhausted_line(notice[:max_steps])
+            elsif notice[:state] == "cancelled"
+              "The task was cancelled (^C): this execution will produce no result. Spawn a fresh subagent if the work is still needed."
             else
-              "Retrieve the full result with #{wait_hint(notice[:id])}."
+              "Retrieve the full result with #{notice[:result_ref].to_s.empty? ? wait_hint(notice[:id]) : "read_file(path: '#{notice[:result_ref]}')"}."
             end
           end
         end

data/lib/rubik/orchestrator/subagent/operation_tracker.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "monitor"
+require "time"
+
+module Rubik
+  module Orchestrator
+    module Subagent
+      # Operation-level telemetry (issue #126): what an execution is doing
+      # RIGHT NOW and how its time split between model waits and tool runs,
+      # measured with a monotonic clock (injectable for tests). Pure state —
+      # no IO, no notices, no locks shared with the instance; the status and
+      # wait surfaces read snapshots from here instead of guessing whether an
+      # execution is stalled.
+      class OperationTracker
+        MODEL = "model"
+        TOOL = "tool"
+        EMPTY_TIMINGS = { "model_seconds" => 0.0, "tool_seconds" => 0.0, "model_calls" => 0, "tool_calls" => 0 }.freeze
+
+        def initialize(clock: nil)
+          @clock = clock || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+          @monitor = Monitor.new
+          @current = nil
+          @timings = EMPTY_TIMINGS.dup
+          @last_progress_at = nil
+        end
+
+        # Marks the start of an in-flight operation. detail is already
+        # redacted/clipped by the caller (it is model-visible telemetry).
+        def start(kind, name: nil, detail: nil)
+          now = @clock.call
+          @monitor.synchronize do
+            @current = { kind: kind.to_s, name: name.to_s, detail: detail.to_s.empty? ? nil : detail.to_s,
+                         started_at: Time.now.utc.iso8601(3), started_monotonic: now }
+            @last_progress_at = now
+          end
+        end
+
+        # Ends the tracked operation and accumulates its duration into the
+        # matching model/tool bucket. Returns the elapsed seconds, or nil when
+        # the operation is not the one being tracked (e.g. after a reset).
+        def finish(kind)
+          @monitor.synchronize do
+            return nil unless @current && @current[:kind] == kind.to_s
+
+            elapsed = [@clock.call - @current[:started_monotonic], 0.0].max
+            bucket = kind.to_s == MODEL ? "model_seconds" : "tool_seconds"
+            counter = kind.to_s == MODEL ? "model_calls" : "tool_calls"
+            @timings[bucket] = (@timings[bucket] + elapsed).round(3)
+            @timings[counter] += 1
+            @current = nil
+            # Completing an operation is observable progress too.
+            @last_progress_at = @clock.call
+            elapsed
+          end
+        end
+
+        def progress!
+          now = @clock.call
+          @monitor.synchronize { @last_progress_at = now }
+        end
+
+        # A redeployed run is a new lineage: no stale operation, fresh buckets.
+        def reset!
+          @monitor.synchronize do
+            @current = nil
+            @timings = EMPTY_TIMINGS.dup
+            @last_progress_at = nil
+          end
+        end
+
+        # JSON-ready snapshot of the in-flight operation (nil when idle).
+        def current
+          @monitor.synchronize do
+            return nil unless @current
+
+            { kind: @current[:kind], name: @current[:name], detail: @current[:detail],
+              started_at: @current[:started_at],
+              elapsed_seconds: [@clock.call - @current[:started_monotonic], 0.0].max.round(3) }
+          end
+        end
+
+        def timings = @monitor.synchronize { @timings.dup }
+
+        def last_progress_seconds_ago
+          @monitor.synchronize do
+            @last_progress_at ? [@clock.call - @last_progress_at, 0.0].max.round(3) : nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/subagent/result_archive.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require "monitor"
+require_relative "../../security/redactor"
+require_relative "../../uris"
+
+module Rubik
+  module Orchestrator
+    module Subagent
+      # Bounded, redacted, paginated access to completed run results (issue #122).
+      #
+      # Every existing surface truncates: an Instance keeps only the latest
+      # run's result under the terminal-only contract, wait rows show a 1500-char
+      # preview, transcript rendering and storage summaries have their own caps.
+      # This archive is the ONE retrieval contract for the remainder: each
+      # settled run's result is retained under an execution-specific reference
+      # (unique storage id + run sequence — redeploy runs never overwrite an
+      # earlier one), redacted at retention time, and served back in bounded
+      # pages with stable cursors (`has_more` / `next_cursor`).
+      #
+      # Reads are pure memory: no model call, no spawn/redeploy, no execution
+      # state change, no filesystem access (so no workspace allowlisting is
+      # involved). Retention is session-scoped and bounded by
+      # `subagents.result_archive.*` — newest `max_runs_per_instance` runs per
+      # execution, `ttl_seconds` lifetime — and unknown, evicted, or expired
+      # references answer explicitly instead of silently serving another run.
+      class ResultArchive
+        Entry = Struct.new(:ref, :storage_id, :id, :run, :state, :body, :retained_at, :expires_at, keyword_init: true)
+
+        Page = Struct.new(:ref, :storage_id, :id, :run, :state, :body, :cursor, :next_cursor,
+                          :total_chars, :returned_chars, :has_more, :redacted,
+                          :retained_at, :expires_at, keyword_init: true) do
+          def ok? = true
+        end
+
+        Missing = Struct.new(:ref, :reason, :message, keyword_init: true) do
+          def ok? = false
+        end
+
+        DEFAULT_TTL_SECONDS = 3600
+        DEFAULT_MAX_RUNS = 8
+        DEFAULT_PAGE_CHARS = 4000
+        MAX_PAGE_CHARS = 40_000
+
+        def initialize(config: nil, clock: nil, ttl_seconds: nil, max_runs_per_instance: nil, page_chars: nil)
+          @clock = clock || -> { Time.now }
+          @ttl_seconds = (ttl_seconds || config_get(config, "subagents.result_archive.ttl_seconds", DEFAULT_TTL_SECONDS)).to_f
+          @max_runs = (max_runs_per_instance || config_get(config, "subagents.result_archive.max_runs_per_instance", DEFAULT_MAX_RUNS)).to_i
+          @page_chars = (page_chars || config_get(config, "subagents.result_archive.page_chars", DEFAULT_PAGE_CHARS)).to_i
+          @max_runs = [@max_runs, 0].max
+          @page_chars = @page_chars.clamp(1, MAX_PAGE_CHARS)
+          @entries = {} # storage_id => { run => Entry }
+          @monitor = Monitor.new
+        end
+
+        # Retains one settled run's result. Redaction happens HERE (the raw
+        # in-memory history keeps its wire-faithful copy), the body is never
+        # mutated afterwards, and the run sequence keys the entry so a
+        # redeployed run cannot overwrite its predecessor.
+        def retain(storage_id:, id:, run:, state:, body:)
+          sid = storage_id.to_s
+          seq = [run.to_i, 1].max
+          now = @clock.call
+          entry = Entry.new(ref: Rubik::Uris.subagent_result(sid, run: seq), storage_id: sid, id: id.to_s,
+                            run: seq, state: state.to_s, body: Rubik::Security::Redactor.redact(body.to_s),
+                            retained_at: now, expires_at: now + @ttl_seconds)
+          @monitor.synchronize do
+            sweep_expired!(now)
+            runs = (@entries[sid] ||= {})
+            runs[seq] = entry
+            runs.delete(runs.keys.min) while runs.size > @max_runs
+          end
+          entry
+        end
+
+        # Bounded read by run (nil = latest retained run). Returns a Page on
+        # success — with cursor/next_cursor/has_more and explicit truncation
+        # metadata — or a Missing result with an explicit reason.
+        def read(storage_id:, run: nil, cursor: 0, limit: nil)
+          sid = storage_id.to_s
+          now = @clock.call
+          @monitor.synchronize do
+            runs = @entries[sid]
+            return missing(Rubik::Uris.subagent_result(sid, run: run&.to_i), :unknown, unknown_message(sid)) if runs.nil? || runs.empty?
+
+            entry = run ? runs[run.to_i] : runs[runs.keys.max]
+            unless entry
+              return missing(Rubik::Uris.subagent_result(sid, run: run.to_i), :unknown,
+                             "No retained run #{run} for execution '#{sid}' — retained run(s): #{runs.keys.sort.join(', ')}. #{retention_note}")
+            end
+
+            if expired?(entry, now)
+              runs.delete(entry.run)
+              @entries.delete(sid) if runs.empty?
+              return missing(entry.ref, :expired,
+                             "Retained result #{entry.ref} expired at #{entry.expires_at.utc.iso8601} (retention: #{@ttl_seconds.round}s). #{retention_note}")
+            end
+
+            page_for(entry, cursor, limit)
+          end
+        end
+
+        # Any non-expired retained entry for this execution id? Lets callers
+        # accept a raw storage id after the instance itself was reaped.
+        def known?(storage_id)
+          sid = storage_id.to_s
+          now = @clock.call
+          @monitor.synchronize do
+            runs = @entries[sid]
+            next false unless runs
+
+            runs.delete_if { |_run, entry| expired?(entry, now) }
+            !runs.empty?
+          end
+        end
+
+        def latest_run(storage_id)
+          @monitor.synchronize { (@entries[storage_id.to_s] || {}).keys.max }
+        end
+
+        # THE page rendering (tool action + rubik:// read share it, so the two
+        # access paths cannot drift). The continuation is the paginated API
+        # call — the reference itself always identifies the exact run.
+        def self.render_page(page, id: nil)
+          who = id || page.id
+          lines = ["Retained result #{page.ref} (run #{page.run}, state #{page.state}, execution '#{who}')",
+                   "chars #{page.cursor}-#{page.cursor + page.returned_chars} of #{page.total_chars}; " \
+                   "credentials redacted; expires #{page.expires_at&.utc&.iso8601}",
+                   "---", page.body, "---"]
+          lines << if page.has_more
+                     "More content follows — next page: manage_subagents(action: 'result', conversation_id: '#{who}', " \
+                       "run: #{page.run}, cursor: #{page.next_cursor})"
+                   else
+                     "(complete result)"
+                   end
+          lines.join("\n")
+        end
+
+        private
+
+        def page_for(entry, cursor, limit)
+          body = entry.body
+          total = body.length
+          cur = [cursor.to_i, 0].max
+          return missing(entry.ref, :cursor, "Cursor #{cur} exceeds the retained result length (#{total} chars). Use cursor 0.") if cur > total
+
+          size = limit.to_i
+          size = @page_chars if size <= 0
+          size = [size, MAX_PAGE_CHARS].min
+          text = body[cur, size].to_s
+          nxt = cur + text.length
+          has_more = nxt < total
+          Page.new(ref: entry.ref, storage_id: entry.storage_id, id: entry.id, run: entry.run, state: entry.state,
+                   body: text, cursor: cur, next_cursor: has_more ? nxt : nil, total_chars: total,
+                   returned_chars: text.length, has_more: has_more, redacted: true,
+                   retained_at: entry.retained_at, expires_at: entry.expires_at)
+        end
+
+        def missing(ref, reason, message)
+          Missing.new(ref: ref, reason: reason, message: message)
+        end
+
+        def unknown_message(sid)
+          "No retained result for execution '#{sid}'. #{retention_note}"
+        end
+
+        def retention_note
+          "The archive keeps the newest #{@max_runs} run(s) per execution for #{@ttl_seconds.round}s in this session; " \
+            "durable history remains in the subagent transcript."
+        end
+
+        def expired?(entry, now)
+          @ttl_seconds.positive? && entry.expires_at && entry.expires_at <= now
+        end
+
+        def sweep_expired!(now)
+          @entries.each do |sid, runs|
+            runs.delete_if { |_run, entry| expired?(entry, now) }
+            @entries.delete(sid) if runs.empty?
+          end
+        end
+
+        def config_get(config, key, default)
+          return default if config.nil?
+
+          val = if config.is_a?(Hash)
+                  config[key] || config.dig(*key.split("."))
+                elsif config.respond_to?(:fetch)
+                  config.fetch(key, nil)
+                end
+          val.nil? ? default : val
+        end
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/subagent/reuse.rb

@@ -52,7 +52,7 @@ module Rubik
         # ve taze scoped registry bağlanır (eskisinin ask_question'ı
         # dispose'lu ctx'e rebind'lıydı). Yeni görev history'ye user
         # mesajı olarak eklenir; run cycle yalnız BOŞ history seed eder.
-        def redeploy_for!(prompt:, max_steps:, context:, tool_registry:)
+        def redeploy_for!(prompt:, max_steps:, context:, tool_registry:, owner_task: nil)
           @monitor.synchronize do
             return false unless redeployable?
 
@@ -65,6 +65,13 @@ module Rubik
             # the old run's wait fact must not narrate the new one.
             @result = @last_error = @ended_at = @transcript_path = nil
             @pause_facts = nil
+            # Task ownership (issue #125): the redeployed run belongs to the
+            # CURRENT task's token (or stays detached); a fresh lineage is not
+            # born "cancelled by operator". Operation telemetry (#126) starts
+            # clean with it — no stale operation survives a redeploy.
+            @owner_task = owner_task
+            @cancelled_by_operator = false
+            @operations.reset!
             @context = context
             @tool_registry = tool_registry
             @context_cleaned_up = false
@@ -81,7 +88,10 @@ module Rubik
       # imkânsız — bkz. activation.rb). provider/buffer/provider_gate/
       # storage_id/kimlik AYNEN KALIR (reuse'un kendisi bu).
       module RedeploySupervisor
-        def redeploy(id, prompt:, max_steps: nil)
+        # `owner: :keep` (the default) keeps the instance's existing task
+        # ownership; the tool plane passes the CURRENT turn's token so a
+        # redeploy issued in this turn is cancellable with it (issue #125).
+        def redeploy(id, prompt:, max_steps: nil, owner: :keep)
           prompt_str = prompt.to_s.strip
           raise ArgumentError, "Redeploy prompt cannot be empty" if prompt_str.empty?
 
@@ -90,15 +100,18 @@ module Rubik
             inst = @instances[key] || (@finished || {})[key]
             raise ArgumentError, redeploy_refusal(key, inst) unless inst&.redeployable?
 
+            eff_owner = owner == :keep ? inst.owner_task : owner
+            refute_cancelled_owner!(eff_owner)
             validate_concurrency!
             child_ctx = extend_root_context!(:redeploy)
             scoped_registry = build_scoped_registry(@type_registry.get(inst.type_name), child_ctx, inst.buffer_manager)
             return false unless inst.redeploy_for!(prompt: prompt_str, max_steps: (max_steps || @default_max_steps).to_i,
-                                                   context: child_ctx, tool_registry: scoped_registry)
+                                                   context: child_ctx, tool_registry: scoped_registry,
+                                                   owner_task: eff_owner)
 
             @finished&.delete(inst.id)
             @instances[inst.id] = inst
-            activate_instance!(inst, child_ctx: child_ctx)
+            activate_instance!(inst, child_ctx: child_ctx, owner_token: eff_owner)
           end
           # SS bırakma kancası: redeploy da bir başlangıçtır — taze :running
           # flip'i, bu id'yi SS ile bekleyen kuyruk spesifikasyonlarını