rubik 0.1.6 → 0.2.0

data/lib/rubik/plugin/manager.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "logger"
+require_relative "requires_dag"
 
 module Rubik
   module Plugin
@@ -109,84 +110,161 @@ module Rubik
         end
       end
 
-      # Detects a cycle in the plugin requires: DAG seen so far.
-      # `requires_map` is a hash of plugin_name -> array of required coeffect names.
-      # Only edges where both endpoints are known plugins are considered (coeffects
-      # that are external services, not plugin names, are ignored for cycle detection).
-      def cyclic_requires?(requires_map)
-        # Build adjacency: plugin -> [plugin deps only]
-        known = requires_map.keys.to_set
-        adjacency = requires_map.transform_values { |reqs| reqs.select { |r| known.include?(r) } }
+      def load_plugin_file(plugin_meta, runtime_manager:)
+        name = plugin_meta[:name]
+        component_name = "plugin_#{name}"
 
-        visited = Set.new
-        stack = Set.new
+        unload_plugin(name, runtime_manager: runtime_manager) if runtime_manager.fibers.key?(component_name)
 
-        dfs = lambda do |node|
-          return true if stack.include?(node)
-          return false if visited.include?(node)
+        definition = prepare_plugin_definition(plugin_meta)
+        return false unless definition
 
-          stack.add(node)
-          (adjacency[node] || []).each do |neighbor|
-            return true if dfs.call(neighbor)
-          end
-          stack.delete(node)
-          visited.add(node)
+        fiber = register_plugin_component(name, definition, plugin_meta, runtime_manager: runtime_manager)
+        return false unless fiber
+
+        # Honest load result (issue #144): a failed activation (factory raised)
+        # is reported as failure, not as a successful load.
+        fiber.state != :failed
+      end
+
+      def unload_plugin(name, runtime_manager:)
+        component_name = "plugin_#{name}"
+        if runtime_manager.fibers.key?(component_name)
+          runtime_manager.unregister_component(component_name)
+          @registered_plugins.delete(name)
+          Rubik::Plugin::Registry.definitions.delete(name.to_s)
+          true
+        else
           false
         end
+      end
 
-        adjacency.each_key do |node|
-          return true if dfs.call(node)
+      # Reload is transactional (issue #144): discovery, whole-package
+      # integrity verification, and definition preparation all happen BEFORE
+      # the running component is touched, so a missing, tampered, legacy, or
+      # unparseable replacement leaves the old version running. An activation
+      # failure then rolls the swap back — ComponentFiber#activate! has
+      # already run the failed instance's partial inverses — and re-registers
+      # the previous definition so the plugin stays usable.
+      #
+      # In-flight work: this runtime serializes component lifecycle on the
+      # REPL turn boundary (single-threaded), so a reload never interleaves
+      # with a tool call; calls after a successful swap hit the new version
+      # only, calls after a failed reload hit the restored previous version
+      # only — no silent old/new mix.
+      def reload_plugin(name, storage:, runtime_manager:)
+        target = storage.discover_plugins.find { |p| p[:name] == name.to_s }
+        unless target
+          @logger.error("Reload of drop-in plugin '#{name}' failed: plugin not found in storage; previous version kept")
+          return false
         end
+
+        integrity = storage.verify_integrity(target[:path], scope: target[:scope])
+        if integrity == :rejected
+          @logger.error("Reload of drop-in plugin '#{name}' refused: integrity check failed; previous version kept")
+          return false
+        end
+
+        previous = Rubik::Plugin::Registry.get(name)
+        definition = prepare_plugin_definition(target)
+        unless definition
+          @logger.error("Reload of drop-in plugin '#{name}' failed during preparation; previous version kept")
+          return false
+        end
+
+        unload_plugin(name, runtime_manager: runtime_manager)
+        Rubik::Plugin::Registry.register(definition)
+        fiber = register_plugin_component(name, definition, target, runtime_manager: runtime_manager)
+        return true if fiber && fiber.state != :failed
+
+        @logger.error("Reload of drop-in plugin '#{name}' failed during activation; rolling back")
+        runtime_manager.unregister_component("plugin_#{name}")
+        restore_previous_plugin(name, previous, target, runtime_manager: runtime_manager)
         false
       end
 
-      def load_plugin_file(plugin_meta, runtime_manager:)
+      private
+
+      # Prepare phase (issue #144): load the plugin file and validate the
+      # definition WITHOUT touching any running component, so a rejected
+      # replacement can never cost the old version. Returns the new
+      # Definition on success; nil on failure, with the previous registry
+      # entry restored and the load-path claim released.
+      def prepare_plugin_definition(plugin_meta)
         name = plugin_meta[:name]
         path = plugin_meta[:path]
         load_path = plugin_meta[:load_path]
 
-        component_name = "plugin_#{name}"
-
-        unload_plugin(name, runtime_manager: runtime_manager) if runtime_manager.fibers.key?(component_name)
+        previous = Rubik::Plugin::Registry.get(name)
+        claim_load_path(load_path)
 
-        # Load the file to register the DSL
         begin
-          $LOAD_PATH.unshift(load_path) unless $LOAD_PATH.include?(load_path)
-          @load_path_refs[load_path] += 1
           load path
         rescue StandardError, ScriptError => e
           @logger.error("Failed to parse drop-in plugin '#{name}': #{e.message}")
+          rollback_prepared_definition(name, previous)
           release_load_path(load_path)
-          return false
+          return nil
         end
 
         definition = Rubik::Plugin::Registry.get(name)
-        unless definition
+        # Identity check: a re-load that did not run the DSL leaves the
+        # PREVIOUS definition parked in the registry — that is "no new
+        # definition", not a successful prepare.
+        if definition.nil? || definition.equal?(previous)
           @logger.warn("Drop-in plugin '#{name}' did not register via Rubik.plugin DSL.")
+          rollback_prepared_definition(name, previous)
           release_load_path(load_path)
-          return false
+          return nil
         end
 
         # Coeffect DAG validation (Plan 86 D-3): requires: cycles among known
         # plugins are rejected; external coeffect requirements resolve at runtime.
-        if definition.requires && !definition.requires.empty?
-          # Build the current requires map from all registered definitions
-          requires_map = {}
-          Rubik::Plugin::Registry.definitions.each do |plugin_name, plugin_def|
-            requires_map[plugin_name] = plugin_def.requires if plugin_def.requires && !plugin_def.requires.empty?
-          end
-          # Include the new plugin's requirements
-          requires_map[name] = definition.requires
+        if cyclic_definition?(name, definition)
+          @logger.error("Drop-in plugin '#{name}' has a cyclic requires: dependency: #{definition.requires.join(' -> ')}")
+          rollback_prepared_definition(name, previous)
+          release_load_path(load_path)
+          return nil
+        end
 
-          if cyclic_requires?(requires_map)
-            @logger.error("Drop-in plugin '#{name}' has a cyclic requires: dependency: #{definition.requires.join(' -> ')}")
-            Rubik::Plugin::Registry.definitions.delete(name.to_s) # sound rollback: the load leaves no trace
-            release_load_path(load_path)
-            return false
-          end
+        release_load_path(load_path)
+        definition
+      end
+
+      # Sound rollback of a failed prepare: the previous definition (when one
+      # existed) goes back into the registry; otherwise the failed load leaves
+      # no trace.
+      def rollback_prepared_definition(name, previous)
+        if previous
+          Rubik::Plugin::Registry.register(previous)
+        else
+          Rubik::Plugin::Registry.definitions.delete(name.to_s)
+        end
+      end
+
+      def cyclic_definition?(name, definition)
+        return false if definition.requires.nil? || definition.requires.empty?
+
+        # Build the current requires map from all registered definitions
+        requires_map = {}
+        Rubik::Plugin::Registry.definitions.each do |plugin_name, plugin_def|
+          requires_map[plugin_name] = plugin_def.requires if plugin_def.requires && !plugin_def.requires.empty?
         end
+        # Include the new plugin's requirements
+        requires_map[name] = definition.requires
+        RequiresDag.cyclic?(requires_map)
+      end
 
-        runtime_manager.register_component(component_name, inject: definition.inject, requires: definition.requires) do |ctx|
+      # Activation phase: register the definition as a runtime component. The
+      # Each activation owns its own load-path claim and paired inverse.
+      # Pending fibers own none, and reactivation acquires a fresh claim.
+      def register_plugin_component(name, definition, plugin_meta, runtime_manager:)
+        load_path = plugin_meta[:load_path]
+        runtime_manager.register_component(
+          "plugin_#{name}",
+          inject: definition.inject, requires: definition.requires
+        ) do |ctx|
+          claim_load_path(load_path)
           ctx.on_dispose do
             release_load_path(load_path)
             @registered_plugins.delete(name)
@@ -198,37 +276,36 @@ module Rubik
           @registered_plugins << name unless @registered_plugins.include?(name)
           true
         end
-
-        true
+      rescue StandardError => e
+        @logger.error("Failed to register drop-in plugin '#{name}': #{e.class}: #{e.message}")
+        nil
       end
 
-      def unload_plugin(name, runtime_manager:)
-        component_name = "plugin_#{name}"
-        if runtime_manager.fibers.key?(component_name)
-          runtime_manager.unregister_component(component_name)
-          @registered_plugins.delete(name)
-          Rubik::Plugin::Registry.definitions.delete(name.to_s)
-          true
-        else
-          false
+      # Roll back a failed activation swap: drop the failed replacement's
+      # definition, then re-register the previous definition (when one
+      # existed) so the plugin stays usable. The caller has already disposed
+      # the failed fiber, so the name is free to re-register.
+      def restore_previous_plugin(name, previous, plugin_meta, runtime_manager:)
+        Rubik::Plugin::Registry.definitions.delete(name.to_s)
+        return false unless previous
+
+        Rubik::Plugin::Registry.register(previous)
+        fiber = register_plugin_component(name, previous, plugin_meta, runtime_manager: runtime_manager)
+        unless fiber && fiber.state != :failed
+          @logger.error("Reload of drop-in plugin '#{name}': previous version could not be restored")
+          return false
         end
-      end
 
-      def reload_plugin(name, storage:, runtime_manager:)
-        unload_plugin(name, runtime_manager: runtime_manager)
-        plugins = storage.discover_plugins
-        target = plugins.find { |p| p[:name] == name.to_s }
-        if target
-          integrity = storage.verify_integrity(target[:path], scope: target[:scope])
-          if integrity != :rejected
-            load_plugin_file(target, runtime_manager: runtime_manager)
-            return true
-          end
-        end
-        false
+        @logger.warn("Reload of drop-in plugin '#{name}': previous version restored after failed activation")
+        true
       end
 
-      private
+      def claim_load_path(path)
+        return unless path
+
+        $LOAD_PATH.unshift(path) unless $LOAD_PATH.include?(path)
+        @load_path_refs[path] += 1
+      end
 
       # Decrement load_path reference count; only remove from $LOAD_PATH
       # when no plugin still holds a reference to prevent pulling the rug

data/lib/rubik/plugin/package_inventory.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Rubik
+  module Plugin
+    # Containment + inventory policy for directory plugin packages
+    # (issue #144). A package is the set of regular files under its root,
+    # each identified by a package-relative POSIX path and a SHA-256 of its
+    # content; that inventory is the consent snapshot recorded at `!plugin
+    # add` time and the thing verification compares against. Symlinks can
+    # escape the package and special files are not content, so both are
+    # violations — add and verify fail closed on them.
+    module PackageInventory
+      class Violation < StandardError; end
+
+      module_function
+
+      def inventory(dir)
+        files = {}
+        walk(dir) do |rel, full|
+          files[rel] = file_hash(full)
+        end
+        files
+      end
+
+      # nil when the tree is clean; a violation message otherwise (used to
+      # refuse an add before anything is copied).
+      def violation(dir)
+        walk(dir)
+        nil
+      rescue Violation => e
+        e.message
+      end
+
+      # Audits additions, deletions, and modifications: any drift means the
+      # package no longer matches the consented inventory.
+      def drift(expected, current)
+        added = current.keys - expected.keys
+        removed = expected.keys - current.keys
+        modified = (current.keys & expected.keys).reject { |f| current[f] == expected[f] }
+
+        parts = []
+        parts << "added: #{added.sort.join(', ')}" unless added.empty?
+        parts << "removed: #{removed.sort.join(', ')}" unless removed.empty?
+        parts << "modified: #{modified.sort.join(', ')}" unless modified.empty?
+        parts.join("; ")
+      end
+
+      def content_hash(content)
+        Digest::SHA256.hexdigest(content.to_s.delete("\r"))
+      end
+
+      def file_hash(path)
+        content_hash(File.binread(path))
+      end
+
+      # Recursive walk with the containment policy: only regular files and
+      # directories under `dir`; symlinks and special entries raise
+      # Violation so add and verify both fail closed on them.
+      def walk(dir)
+        base = File.expand_path(dir)
+        raise Violation, "symlink package root is not allowed: #{base}" if File.symlink?(base)
+
+        stack = [base]
+        until stack.empty?
+          current = stack.pop
+          Dir.children(current).sort.each do |child|
+            full = "#{current}#{File::SEPARATOR}#{child}"
+            rel = full.delete_prefix("#{base}#{File::SEPARATOR}").tr("\\", "/")
+            raise Violation, "symlink entry is not allowed: #{rel}" if File.symlink?(full)
+            raise Violation, "unsupported entry type: #{rel}" unless File.file?(full) || File.directory?(full)
+
+            if File.directory?(full)
+              stack << full
+            elsif block_given?
+              yield(rel, full)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/plugin/requires_dag.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Plugin
+    # Cycle detection for the `requires:` DAG (Plan 86 D-3), extracted from
+    # Manager so the coordinator stays a coordinator (issue #144). Only
+    # edges where both endpoints are known plugins are considered —
+    # coeffect requirements that name external services are ignored.
+    module RequiresDag
+      module_function
+
+      # `requires_map` is plugin_name -> array of required names.
+      def cyclic?(requires_map)
+        known = requires_map.keys.to_set
+        adjacency = requires_map.transform_values { |reqs| reqs.select { |r| known.include?(r) } }
+
+        visited = Set.new
+        stack = Set.new
+
+        dfs = lambda do |node|
+          return true if stack.include?(node)
+          return false if visited.include?(node)
+
+          stack.add(node)
+          (adjacency[node] || []).each do |neighbor|
+            return true if dfs.call(neighbor)
+          end
+          stack.delete(node)
+          visited.add(node)
+          false
+        end
+
+        adjacency.each_key do |node|
+          return true if dfs.call(node)
+        end
+        false
+      end
+    end
+  end
+end

data/lib/rubik/plugin/storage.rb

@@ -2,11 +2,11 @@
 
 require "fileutils"
 require "json"
-require "digest"
 require "time"
 # save_manifest atomik yazımı Platform.atomic_write kullanır; dosyanın tek başına
 # require edilmesi durumunda da çözümlenebilsin diye açık yüklenir.
 require_relative "../platform"
+require_relative "package_inventory"
 
 module Rubik
   module Plugin
@@ -54,19 +54,13 @@ module Rubik
         Platform.atomic_write(manifest_path(dir), JSON.pretty_generate(manifest))
       end
 
-      def normalize_content(raw)
-        raw.delete("\r")
-      end
-
       def record_hash(path, scope: :project)
         dir = scope.to_sym == :global ? global_plugins_dir : project_plugins_dir
         filename = File.basename(path)
-        content = File.binread(path)
-        hash = Digest::SHA256.hexdigest(normalize_content(content))
 
         manifest = load_manifest(dir)
         manifest[filename] = {
-          "sha256" => hash,
+          "sha256" => PackageInventory.file_hash(path),
           "scope" => scope.to_s,
           "created_at" => Time.now.iso8601
         }
@@ -77,11 +71,15 @@ module Rubik
         return :trusted if ENV["RUBIK_TRUST_OVERLAYS"] == "1"
 
         dir = scope.to_sym == :global ? global_plugins_dir : project_plugins_dir
+
+        package_dir = package_root_for(path, dir)
+        return verify_package_integrity(package_dir, scope: scope) if package_dir
+
         basename = File.basename(path)
         manifest = load_manifest(dir)
 
         current_content = File.exist?(path) ? File.binread(path) : ""
-        current_hash = Digest::SHA256.hexdigest(normalize_content(current_content))
+        current_hash = PackageInventory.content_hash(current_content)
 
         if manifest.key?(basename)
           expected_hash = manifest[basename]["sha256"]
@@ -97,6 +95,21 @@ module Rubik
         end
       end
 
+      # Records the operator's consent for a whole package: the inventory is
+      # the consent snapshot that verify_package_integrity later compares
+      # against. Keyed by plugin name (the package root's basename).
+      def record_package(plugin_dir, name, scope: :project)
+        target_dir = scope.to_sym == :global ? global_plugins_dir : project_plugins_dir
+        manifest = load_manifest(target_dir)
+        manifest[name.to_s] = {
+          "type" => "directory",
+          "scope" => scope.to_s,
+          "created_at" => Time.now.iso8601,
+          "files" => PackageInventory.inventory(plugin_dir)
+        }
+        save_manifest(target_dir, manifest)
+      end
+
       def discover_plugins(scope: nil)
         plugins = []
 
@@ -139,12 +152,35 @@ module Rubik
         if File.directory?(source_path)
           plugin_name = File.basename(source_path)
           dest_path = File.join(target_dir, plugin_name)
+
+          if (violation = PackageInventory.violation(source_path))
+            return { ok: false, error: "Plugin package rejected: #{violation}" }
+          end
+
+          source_entry = File.join(source_path, "#{plugin_name}.rb")
+          source_entry = File.join(source_path, "lib", "#{plugin_name}.rb") unless File.file?(source_entry)
+          return { ok: false, error: "Plugin package '#{plugin_name}' has no entry file (#{plugin_name}.rb)." } unless File.file?(source_entry)
+
+          # Re-consenting the installed package must not delete its source.
+          if File.identical?(source_path, dest_path)
+            record_package(dest_path, plugin_name, scope: scope)
+            return { ok: true, name: plugin_name, path: dest_path, type: :directory }
+          end
+
+          # Deterministic re-add (also the legacy-manifest re-consent path):
+          # replace any previous copy so stale helpers cannot survive into
+          # the newly consented package.
+          FileUtils.rm_rf(dest_path)
           FileUtils.cp_r(source_path, dest_path)
 
           entry_file = File.join(dest_path, "#{plugin_name}.rb")
           entry_file = File.join(dest_path, "lib", "#{plugin_name}.rb") unless File.exist?(entry_file)
+          unless File.exist?(entry_file)
+            FileUtils.rm_rf(dest_path)
+            return { ok: false, error: "Plugin package '#{plugin_name}' has no entry file (#{plugin_name}.rb)." }
+          end
 
-          record_hash(entry_file, scope: scope) if File.exist?(entry_file)
+          record_package(dest_path, plugin_name, scope: scope)
 
           { ok: true, name: plugin_name, path: dest_path, type: :directory }
         else
@@ -173,11 +209,9 @@ module Rubik
           save_manifest(target_dir, manifest)
           removed = true
         elsif Dir.exist?(dir_path)
-          entry_file_one = File.join(dir_path, "#{name}.rb")
-          entry_file_two = File.join(dir_path, "lib", "#{name}.rb")
-
           manifest = load_manifest(target_dir)
-          manifest.delete("#{name}.rb") if File.exist?(entry_file_one) || File.exist?(entry_file_two)
+          manifest.delete(name.to_s)         # package inventory (current format)
+          manifest.delete("#{name}.rb")      # legacy entry-file-only key
           save_manifest(target_dir, manifest)
 
           FileUtils.rm_rf(dir_path)
@@ -190,6 +224,58 @@ module Rubik
           { ok: false, error: "Plugin '#{name}' not found in #{scope} scope." }
         end
       end
+
+      private
+
+      # The package root for a path inside the plugins dir: plugins/<first
+      # segment> when that segment is a DIRECTORY (directory plugin); nil for
+      # a single-file plugin. A path outside the plugins dir is not a package.
+      def package_root_for(path, plugins_dir)
+        base = File.expand_path(plugins_dir)
+        prefix = "#{base}#{File::SEPARATOR}"
+        expanded = File.expand_path(path)
+        return nil unless expanded.start_with?(prefix)
+
+        first = expanded.delete_prefix(prefix).split(File::SEPARATOR, 2).first
+        return nil if first.nil? || first.empty? || first == ".."
+
+        candidate = "#{base}#{File::SEPARATOR}#{first}"
+        File.directory?(candidate) ? candidate : nil
+      rescue ArgumentError
+        nil
+      end
+
+      # Whole-package verification. A legacy (entry-file-only) manifest cannot
+      # vouch for helpers that were never consented to, so it is rejected with
+      # an explicit re-consent path: re-add the plugin, or opt into trust with
+      # RUBIK_TRUST_OVERLAYS=1.
+      def verify_package_integrity(package_dir, scope: :project)
+        dir = scope.to_sym == :global ? global_plugins_dir : project_plugins_dir
+        name = File.basename(package_dir)
+        entry = load_manifest(dir)[name]
+
+        unless entry.is_a?(Hash) && entry["type"] == "directory" && entry["files"].is_a?(Hash)
+          warn "[SECURITY] Directory plugin '#{name}' has no package inventory in the manifest " \
+               "(legacy manifest). Skipping; re-add it with '!plugin add' or set RUBIK_TRUST_OVERLAYS=1 to trust it."
+          return :rejected
+        end
+
+        current = nil
+        begin
+          current = PackageInventory.inventory(package_dir)
+        rescue PackageInventory::Violation => e
+          warn "[SECURITY] Integrity check failed for plugin package '#{name}': #{e.message}. " \
+               "Re-add it with '!plugin add' or set RUBIK_TRUST_OVERLAYS=1 to trust it."
+          return :rejected
+        end
+
+        drift = PackageInventory.drift(entry["files"], current)
+        return :verified if drift.empty?
+
+        warn "[SECURITY] Integrity check failed for plugin package '#{name}': #{drift}. " \
+             "Re-add it with '!plugin add' or set RUBIK_TRUST_OVERLAYS=1 to trust it."
+        :rejected
+      end
     end
   end
 end

data/lib/rubik/repl/commands/buffer.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "base"
+require_relative "../../buffer/apply_contract"
 
 module Rubik
   module REPL
@@ -51,27 +52,36 @@ module Rubik
 
           shell.register_command("apply", description: "Apply dirty buffer changes to disk") do |args, ctx|
             target_path = args.first
-            if target_path && !target_path.empty?
-              applied = ctx.buffer_manager.apply!(target_path)
-              conflicts = ctx.buffer_manager.last_conflicts || []
-              if applied.empty? && conflicts.empty?
-                ctx.out.puts "No unapplied buffer changes for '#{target_path}'."
+            begin
+              if target_path && !target_path.empty?
+                applied = ctx.buffer_manager.apply!(target_path)
+                conflicts = ctx.buffer_manager.last_conflicts || []
+                if applied.empty? && conflicts.empty?
+                  ctx.out.puts "No unapplied buffer changes for '#{target_path}'."
+                else
+                  ctx.sync_context_and_ast(applied) unless applied.empty?
+                  ctx.out.puts "Applied changes to file: #{applied.first}" unless applied.empty?
+                end
               else
-                ctx.sync_context_and_ast(applied) unless applied.empty?
-                ctx.out.puts "Applied changes to file: #{applied.first}" unless applied.empty?
+                applied = ctx.buffer_manager.apply!
+                conflicts = ctx.buffer_manager.last_conflicts || []
+                if applied.empty? && conflicts.empty?
+                  ctx.out.puts "No unapplied buffer changes."
+                else
+                  ctx.sync_context_and_ast(applied) unless applied.empty?
+                  ctx.out.puts "Applied changes to #{applied.size} file(s): #{applied.join(', ')}" unless applied.empty?
+                end
               end
-            else
-              applied = ctx.buffer_manager.apply!
-              conflicts = ctx.buffer_manager.last_conflicts || []
-              if applied.empty? && conflicts.empty?
-                ctx.out.puts "No unapplied buffer changes."
-              else
-                ctx.sync_context_and_ast(applied) unless applied.empty?
-                ctx.out.puts "Applied changes to #{applied.size} file(s): #{applied.join(', ')}" unless applied.empty?
+              conflicts.each do |c|
+                ctx.out.puts "[CONFLICT] #{c}: disk content changed since last read — skipped to prevent data loss. Re-read the file to resolve."
               end
-            end
-            conflicts.each do |c|
-              ctx.out.puts "[CONFLICT] #{c}: disk content changed since last read — skipped to prevent data loss. Re-read the file to resolve."
+            rescue Rubik::Buffer::ApplyFailedError => e
+              # Partial apply (issue #146): the report names what DID reach
+              # disk before the failure — a mixed outcome must not be
+              # presented as a plain success or a plain failure.
+              lines = Rubik::Buffer::ApplyContract.failure_lines(e, sync: ->(paths) { ctx.sync_context_and_ast(paths) })
+              ctx.out.puts "❌ #{lines.first}"
+              lines[1..].each { |line| ctx.out.puts line }
             end
           end