rubik 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15cadac070995d7b8d1ac155c6ddfe14c4e4418e596efe6b734af6cb9240f6b4
-  data.tar.gz: 21b3376be313a5133ca84180a36770b0c344495b12ed3c00390715d8dd1658eb
+  metadata.gz: 8907beb9d8441f6f497af9bd1b65a998c5dfa1d2857552943809ace7270e3759
+  data.tar.gz: a4b938aa55ff08037d63fc00d545a5039c06319c2ecee309e85d369d5d752621
 SHA512:
-  metadata.gz: d9edcdfa2830b03dc8d9a5345d8215a5204ba96d4aa5ef93ca0742633a02ff089f2dda9fab638d4a42a489f1b166f74c9a11ecc5f64b3f602b7cb1cbbdd09a5a
-  data.tar.gz: 2b478a0aa15376eaac5636c9d6e7f8d5dfac5534394153958d6417ecf3547dbb9ae654d7c59e5d92df6a84e2038d869145a3ba2b7c8dbdc62472106c7727c33d
+  metadata.gz: a034a02d012190d0f6fe02c1b7977628d60617fb0bca562c3b4799dd6512e5cb77809540d57ebe4eede099a0c8e724a679579cc75f4db85f9a8e59bd535d59ea
+  data.tar.gz: bc8162afcace2ab99fca16b749a5291abeac662e2255f5d798277931a7295a447bdc981bb5d9bc897afa80a15db8fe836771536c3441c110208546442b280622

data/CHANGELOG.md

@@ -6,6 +6,75 @@ commits, 2026-08-23 → 2026-10-09, see `git log`).
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.4.2] - 2026-10-29
+
+A reliability patch: plugin file loads become transactional with
+timing-safe integrity checks, MCP transport and handshake lifecycles
+shed their remaining deadlocks and wedged-boot races, buffer apply
+failures report faithfully, the repair loop can no longer return
+unverified code as success, and vakanüvis slugs stop colliding across
+scripts and long topics.
+
+### Fixed
+
+- **MCP transport lifecycle deadlocks closed (#308):** server stderr is
+  drained on a dedicated thread with a bounded diagnostic tail (also
+  attached to `TimeoutError` messages), a dead transport incarnation is
+  reaped on re-open instead of leaking its file descriptors and waiter,
+  and a fast async boot can no longer park a dead thread handle that
+  permanently wedged the sync-boot gate after `stop_all`.
+- **AST persistent cache no longer pins stale symbols (#308):** a failed
+  re-index is excluded from the cache snapshot so its protected stale
+  symbols are never validated under the current file's fresh digest;
+  per-entry extraction status is persisted and validated on load
+  (cache schema version 2, backward compatible with existing caches).
+- **Plugin file loads are transactional (#334):** `load_plugin_file`
+  prepares the replacement before touching the running plugin so a
+  failed re-add no longer bricks the live plugin; reloading a previously
+  `:active` plugin that lands in `:pending` rolls back to the last
+  working version; the manifest TOCTOU window is closed by evaluating
+  the in-memory verified content via `TOPLEVEL_BINDING.eval`; manifest
+  SHA-256 checks use timing-safe `secure_compare`; and directory
+  creation failures are always reported with `Rubik::Log.warn`.
+- **MCP handshake and boot races closed (#336):** the manager's
+  handshake lock is split so a slow connect no longer serializes
+  unrelated state reads; async boots carry epoch-tagged guards that
+  discard a superseded connection instead of adopting it; the stdio
+  transport gains a synchronized reaper and a bounded `stderr_tail`
+  diagnostic; and rollback paths log the client they stopped.
+- **Repair loop no longer reports unverified code as success (#335):**
+  a missing diagnostics adapter, an empty LLM proposal, or an exception
+  mid-repair now undoes the buffer snapshot and returns `ok: false`
+  (flagging `unverified:` when syntax could not be checked) instead of
+  writing broken code; LSP rollback only restores clients that are
+  alive and running.
+- **Buffer apply failures report faithfully (#333):** `apply!` commits
+  `last_applied` and `last_conflicts` in an `ensure` block so files
+  already written to disk before a failure are remembered and
+  `clean_buffer_message` no longer hides them; garbage-skipped edits
+  are tracked in `last_skipped`/`ApplyFailedError.skipped` and surfaced
+  in `ApplyContract.failure_lines` and tool outputs; and conflict event
+  payloads are frozen copies, closing the live-array aliasing mutation.
+- **Vakanüvis slugs no longer collide across scripts and topics
+  (#332):** slug generation Unicode-folds and transliterates Turkish
+  characters (ç, ğ, ı, ö, ş, ü) and appends a deterministic 6-character
+  SHA-256 suffix when normalization is lossy, when the topic exceeds the
+  40-char limit, or when punctuation-only input yields the untitled
+  fallback — distinct topics can no longer resolve to the same storage
+  key.
+- **UI capability detection unwraps capture streams (#331):**
+  `Capability.resolve_mode`, `color?`, and `spinner?` unwrap `TeeIO`
+  targets so a live terminal wrapped in a capture stream renders styled
+  dialogs and notices again; non-empty truthy `CLICOLOR_FORCE` values
+  (e.g. `true`, `yes`) now force ANSI color while `NO_COLOR` keeps
+  precedence.
+
+### Performance
+
+- **Prism `CallNode` filter lists hoisted to frozen Sets (#307):** the
+  Ruby extractor's hot walk no longer allocates two temporary Arrays per
+  call node (~140k fewer heap objects per 10k file extractions).
+
 ## [0.4.1] - 2026-10-29
 
 A hardening patch: CodeQL-driven fixes remove ReDoS-prone regular
@@ -892,6 +961,7 @@ installation section.
 - Context: serialized index mutations, snapshot-outside-lock reconcile,
   streaming-first truncation.
 
-[Unreleased]: https://github.com/ozgurulukir/rubik/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/ozgurulukir/rubik/compare/v0.4.2...HEAD
+[0.4.2]: https://github.com/ozgurulukir/rubik/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/ozgurulukir/rubik/compare/v0.4.0...v0.4.1
 [0.1.0]: https://github.com/ozgurulukir/rubik/releases/tag/v0.1.0

data/lib/rubik/ast/cache_store.rb

@@ -4,6 +4,7 @@ require "json"
 require "fileutils"
 require "digest"
 require_relative "symbol"
+require_relative "extraction_result"
 require_relative "../platform"
 
 module Rubik
@@ -44,9 +45,11 @@ module Rubik
         File.join(@home_dir, ".rubik", "cache", project_hash, "ast_index.json")
       end
 
-      def save(file_symbols_hash)
+      def save(file_symbols_hash, statuses: {})
         return false unless file_symbols_hash.is_a?(Hash)
 
+        statuses = {} unless statuses.is_a?(Hash)
+
         data = {
           "version" => SCHEMA_VERSION,
           "last_scan" => Time.now.to_i,
@@ -84,12 +87,17 @@ module Rubik
 
           # Bodies are intentionally NOT persisted: they dominate the cache
           # size and are re-extracted lazily from source via Symbol#body.
+          # `status` carries the issue-#147 extraction status so the
+          # loaded graph can keep telling "parsed clean" from "partial" —
+          # entries predating the field read as :ok, the only status they
+          # could ever have been saved under.
           data["files"][rel_path] = {
             "language" => lang,
             "mtime" => stat.mtime.to_i,
             "mtime_f" => stat.mtime.to_f,
             "size" => stat.size,
             "digest" => digest,
+            "status" => (statuses[file_path] || :ok).to_s,
             "symbols" => syms.map { |sym| sym.to_h(include_body: false) }
           }
         end
@@ -103,14 +111,22 @@ module Rubik
       end
 
       def load
+        load_with_statuses[0]
+      end
+
+      # Same entries as #load, paired with the persisted per-file extraction
+      # status keyed by the same expanded paths (issue #147 across the cache
+      # boundary: a cache-loaded file must not report "never attempted").
+      def load_with_statuses
         target_path = cache_path
-        return {} unless File.exist?(target_path)
+        return [{}, {}] unless File.exist?(target_path)
 
         content = File.read(target_path)
         data = JSON.parse(content)
-        return {} unless data.is_a?(Hash) && data["version"] == SCHEMA_VERSION && data["files"].is_a?(Hash)
+        return [{}, {}] unless data.is_a?(Hash) && data["version"] == SCHEMA_VERSION && data["files"].is_a?(Hash)
 
         result = {}
+        statuses = {}
         data["files"].each do |rel_path, cached_info|
           full_path = File.expand_path(rel_path, @root_dir)
           next unless valid_entry?(full_path, cached_info)
@@ -132,14 +148,29 @@ module Rubik
             )
           end
           result[full_path] = symbols
+          raw_status = cached_info["status"]
+          # Entries predating the field had exactly one possible status;
+          # anything else unreadable is corrupt data, not a status — warn
+          # and fall back instead of materializing an arbitrary symbol that
+          # the symbols tool would report and save_to_cache would honor.
+          statuses[full_path] = if raw_status.nil?
+                                  :ok
+                                else
+                                  status = raw_status.is_a?(String) ? raw_status.to_sym : nil
+                                  unless ExtractionResult::STATUSES.include?(status)
+                                    Rubik::Log.warn(:ast, "unknown cached extraction status #{raw_status.inspect} for #{rel_path}; treating as ok")
+                                    status = :ok
+                                  end
+                                  status
+                                end
         end
 
-        result
+        [result, statuses]
       rescue JSON::ParserError, Errno::ENOENT, Errno::EACCES, TypeError, NoMethodError
         # Corrupt-but-valid JSON shapes raise TypeError/NoMethodError inside
         # the entry loop; EACCES covers an unreadable cache file. All mean
         # "cache unusable" → rebuild from scratch.
-        {}
+        [{}, {}]
       end
 
       def valid_entry?(file_path, cached_info)

data/lib/rubik/ast/extraction_result.rb

@@ -33,5 +33,11 @@ module Rubik
         [:ok, :partial].include?(status)
       end
     end
+
+    class ExtractionResult
+      # The closed status vocabulary, shared with persistence seams: the AST
+      # cache persists it per entry and validates against it on load.
+      STATUSES = [:ok, :partial, :failed, :unavailable].freeze
+    end
   end
 end

data/lib/rubik/ast/graph.rb

@@ -89,7 +89,7 @@ module Rubik
       def load_from_cache(cache_store)
         return 0 unless cache_store
 
-        loaded_files = cache_store.load
+        loaded_files, statuses = cache_store.load_with_statuses
         return 0 if loaded_files.nil? || loaded_files.empty?
 
         @mutex.synchronize do
@@ -99,6 +99,7 @@ module Rubik
             lang = CacheStore::LANGUAGE_MAP[ext] || "code"
 
             @file_symbols[file_path] = syms.dup
+            @extraction_status[file_path] = statuses[file_path] || :ok
             syms.each do |sym|
               @symbols[sym.name] = sym
               q_key = "#{lang}:#{file_path}##{sym.name}"
@@ -113,12 +114,32 @@ module Rubik
       def save_to_cache(cache_store)
         return false unless cache_store
 
-        snapshot = @mutex.synchronize do
-          @file_symbols.each_with_object({}) do |(file_path, symbols), copy|
+        snapshot = nil
+        statuses = nil
+        skipped_failed = 0
+        @mutex.synchronize do
+          snapshot = @file_symbols.each_with_object({}) do |(file_path, symbols), copy|
+            # Failed-extraction honesty across the cache boundary: a :failed
+            # file's in-memory symbols are protected stale data or
+            # untrustworthy best-effort fallback. Persisting them would let
+            # CacheStore re-stat the CURRENT file and pin them under a fresh
+            # digest, making the staleness permanent — skip them and let the
+            # next boot re-extract.
+            if _get_extraction_status_unlocked(file_path) == :failed
+              skipped_failed += 1
+              next
+            end
+
             copy[file_path] = symbols.dup
           end
+          statuses = {}
+          snapshot.each_key do |file_path|
+            statuses[file_path] = _get_extraction_status_unlocked(file_path) || :ok
+          end
         end
-        cache_store.save(snapshot)
+        skipped = "cache snapshot excluded #{skipped_failed} file(s) with failed extractions; they re-extract on next boot"
+        Rubik::Log.warn(:ast, skipped) if skipped_failed.positive?
+        cache_store.save(snapshot, statuses: statuses)
       end
 
       def smart_context_for(symbol_name)
@@ -179,7 +200,6 @@ module Rubik
             Rubik::Log.warn(:ast, "extraction failed for #{file_path} (#{result.detail}); keeping previously indexed symbols")
             return existing
           end
-          Rubik::Log.warn(:ast, "extraction failed for #{file_path} (#{result.detail}); no symbols indexed")
         end
 
         _remove_file_unlocked(file_path)
@@ -188,6 +208,12 @@ module Rubik
         lang = CacheStore::LANGUAGE_MAP[ext] || "code"
 
         extracted = result.symbols
+        if result.status == :failed
+          # Truthful accounting: the fallback symbols ARE indexed when
+          # nothing pre-existing needed protection — even when there are
+          # none, the log must not claim otherwise.
+          Rubik::Log.warn(:ast, "extraction failed for #{file_path} (#{result.detail}); indexing #{extracted.length} best-effort fallback symbols")
+        end
         extracted.each do |sym|
           @symbols[sym.name] = sym
           q_key = "#{lang}:#{file_path}##{sym.name}"

data/lib/rubik/ast/ruby_extractor.rb

@@ -8,6 +8,10 @@ module Rubik
   module AST
     class RubyExtractor
       EXCLUDED_CALLS = Set.new(["def", "if", "unless", "case", "return", "raise", "puts", "p", "print", "require"]).freeze
+      # PERF: Hoist require and excluded call lists to frozen Sets to avoid per-node Array allocations in hot AST walks.
+      REQUIRE_CALLS = Set.new(["require", "require_relative"]).freeze
+      EXCLUDED_PRISM_CALLS = Set.new(["require", "require_relative", "raise", "puts", "p", "print"]).freeze
+
       begin
         require "prism"
         PRISM_AVAILABLE = true
@@ -119,7 +123,8 @@ module Rubik
 
         when Prism::CallNode
           name = node.name.to_s
-          if ["require", "require_relative"].include?(name)
+          # PERF: Fast Set lookup avoids Array allocation on every CallNode
+          if REQUIRE_CALLS.include?(name)
             line_num = node.location.start_line
             args_node = node.arguments&.arguments
             arg = args_node&.first&.slice.to_s
@@ -153,7 +158,8 @@ module Rubik
               operator = curr.call_operator || "."
               cname = "#{receiver}#{operator}#{cname}"
             end
-            calls << cname unless ["require", "require_relative", "raise", "puts", "p", "print"].include?(cname)
+            # PERF: Fast Set lookup avoids Array allocation per call site in method body
+            calls << cname unless EXCLUDED_PRISM_CALLS.include?(cname)
           end
           queue.concat(curr.compact_child_nodes) if curr.respond_to?(:compact_child_nodes)
         end

data/lib/rubik/buffer/apply_contract.rb

@@ -38,6 +38,12 @@ module Rubik
         lines << "  • Failed: #{failure.failed}#{cause ? " (#{cause.class}: #{cause.message})" : " (#{failure.kind})"}"
         lines << "  • Still dirty — a retry writes only these: #{failure.pending.join(', ')}" unless failure.pending.empty?
         lines << "  • Skipped conflicts (disk changed externally): #{failure.conflicts.join(', ')}" unless failure.conflicts.empty?
+        if failure.respond_to?(:skipped) && !failure.skipped.empty?
+          skipped_desc = failure.skipped.map do |s|
+            s.is_a?(Hash) ? "#{s[:path]} (#{s[:reason]})" : s.to_s
+          end.join(", ")
+          lines << "  • Skipped invalid paths (anti-injection/garbage): #{skipped_desc}"
+        end
         if sync
           annotation = sync_annotation(failure, sync)
           lines << annotation if annotation

data/lib/rubik/buffer/manager.rb

@@ -21,20 +21,22 @@ module Rubik
     # the underlying error. `pending` lists this run's entries that are
     # still dirty (a retry writes only those).
     class ApplyFailedError < StandardError
-      attr_reader :kind, :applied, :failed, :pending, :conflicts
+      attr_reader :kind, :applied, :failed, :pending, :conflicts, :skipped
 
-      def initialize(message, kind:, applied: [], failed: nil, pending: [], conflicts: [])
+      def initialize(message, kind:, applied: [], failed: nil, pending: [], conflicts: [], skipped: [])
         super(message)
         @kind = kind
         @applied = applied
         @failed = failed
         @pending = pending
         @conflicts = conflicts
+        @skipped = skipped
       end
     end
 
     class Manager
-      attr_reader :root_dir, :dirty_files, :additional_roots, :rw_roots, :allowed_external_dirs, :rw_allowed_dirs, :guard, :last_conflicts
+      attr_reader :root_dir, :dirty_files, :additional_roots, :rw_roots, :allowed_external_dirs, :rw_allowed_dirs,
+                  :guard, :last_conflicts, :last_skipped
       attr_accessor :allow_external_writes, :config
 
       def initialize(root_dir: Dir.pwd, additional_roots: [], allowed_external_dirs: [], allow_external_writes: false,
@@ -52,7 +54,8 @@ module Rubik
         @buffer = {}
         @dirty_files = {}
         @original_hashes = {}
-        @last_conflicts = []
+        @last_conflicts = [].freeze
+        @last_skipped = [].freeze
         @last_applied = nil
       end
 
@@ -317,25 +320,35 @@ module Rubik
         @monitor.synchronize do
           applied_paths = []
           conflicts = []
+          skipped = []
           keys_to_apply = determine_keys_to_apply(target_paths)
           effective_policy = (policy || external_modification_policy).to_s.downcase
 
-          keys_to_apply.each_with_index do |rel_path, index|
-            next unless @dirty_files.key?(rel_path)
-            next unless validate_and_clean_garbage(rel_path)
+          begin
+            keys_to_apply.each_with_index do |rel_path, index|
+              next unless @dirty_files.key?(rel_path)
 
-            if external_conflict?(rel_path) && effective_policy != "overwrite"
-              conflicts << rel_path
-              @event_bus&.emit(:buffer_apply_conflict, paths: conflicts, path: rel_path)
-              next
-            end
+              unless validate_and_clean_garbage(rel_path)
+                skipped << { path: rel_path, reason: :path_validator_rejected }
+                next
+              end
 
-            apply_single_entry(rel_path, index: index, keys_to_apply: keys_to_apply, applied_paths: applied_paths, conflicts: conflicts)
+              if external_conflict?(rel_path) && effective_policy != "overwrite"
+                conflicts << rel_path
+                @event_bus&.emit(:buffer_apply_conflict, paths: conflicts.dup.freeze, path: rel_path)
+                next
+              end
+
+              apply_single_entry(rel_path, index: index, keys_to_apply: keys_to_apply,
+                                           applied_paths: applied_paths, conflicts: conflicts, skipped: skipped)
+            end
+          ensure
+            @last_conflicts = conflicts.dup.freeze
+            @last_skipped = skipped.dup.freeze
+            @last_applied = { at: Time.now.utc, paths: applied_paths.dup.freeze } unless applied_paths.empty?
           end
 
-          @last_conflicts = conflicts
-          @last_applied = { at: Time.now.utc, paths: applied_paths.dup.freeze } unless applied_paths.empty?
-          @event_bus&.emit(:buffer_applied, paths: applied_paths) unless applied_paths.empty?
+          @event_bus&.emit(:buffer_applied, paths: applied_paths.dup.freeze) unless applied_paths.empty?
           applied_paths
         end
       end
@@ -353,7 +366,8 @@ module Rubik
           @buffer.clear
           @dirty_files.clear
           @original_hashes.clear
-          @last_conflicts.clear
+          @last_conflicts = [].freeze
+          @last_skipped = [].freeze
           @last_applied = nil
         end
       end
@@ -410,7 +424,7 @@ module Rubik
         end
       end
 
-      def apply_single_entry(rel_path, index:, keys_to_apply:, applied_paths:, conflicts:)
+      def apply_single_entry(rel_path, index:, keys_to_apply:, applied_paths:, conflicts:, skipped:)
         full_path = File.expand_path(rel_path, @root_dir)
 
         # TOCTOU close: re-verify containment immediately before the
@@ -422,15 +436,11 @@ module Rubik
         containment_kind, = containment_root(full_path)
         unless containment_kind
           @event_bus&.emit(:buffer_containment_blocked, path: rel_path)
-          # Commit what this run has seen so "apply! rewrites
-          # last_conflicts on every run" holds for readers (AutoApply's
-          # report_conflicts) even on the failure path.
-          @last_conflicts = conflicts
           raise apply_failure(
             "Write blocked: '#{rel_path}' resolves outside all allowed roots at apply time " \
             "(possible symlink swap since buffering). Re-verify the workspace and retry.",
             kind: :containment_blocked, applied: applied_paths, failed: rel_path,
-            pending: pending_after(keys_to_apply, index), conflicts: conflicts
+            pending: pending_after(keys_to_apply, index), conflicts: conflicts, skipped: skipped
           )
         end
 
@@ -439,13 +449,12 @@ module Rubik
         begin
           Rubik::Platform.atomic_write(full_path, content)
         rescue StandardError => e
-          @last_conflicts = conflicts
           raise apply_failure(
             "Apply failed for '#{rel_path}': #{e.class}: #{e.message}; " \
             "#{applied_paths.empty? ? 'no file was written' : "already written: #{applied_paths.join(', ')}"}; " \
             "#{pending_after(keys_to_apply, index).size} file(s) still dirty",
             kind: :write_failed, applied: applied_paths, failed: rel_path,
-            pending: pending_after(keys_to_apply, index), conflicts: conflicts
+            pending: pending_after(keys_to_apply, index), conflicts: conflicts, skipped: skipped
           ), cause: e
         end
 
@@ -494,11 +503,12 @@ module Rubik
 
       # Build the structured partial-apply error with frozen report copies —
       # a reader must see the state at raise time, not later mutations.
-      def apply_failure(message, kind:, applied:, failed:, pending:, conflicts:)
+      def apply_failure(message, kind:, applied:, failed:, pending:, conflicts:, skipped: [])
         ApplyFailedError.new(
           message, kind: kind,
                    applied: applied.dup.freeze, failed: failed,
-                   pending: pending.dup.freeze, conflicts: conflicts.dup.freeze
+                   pending: pending.dup.freeze, conflicts: conflicts.dup.freeze,
+                   skipped: skipped.dup.freeze
         )
       end
 

data/lib/rubik/mcp/client.rb

@@ -147,6 +147,10 @@ module Rubik
         @transport&.running? || false
       end
 
+      def stderr_tail
+        @transport.respond_to?(:stderr_tail) ? @transport.stderr_tail : []
+      end
+
       private
 
       def ensure_running!

data/lib/rubik/mcp/manager.rb

@@ -51,6 +51,7 @@ module Rubik
         # boot epoch that owns them (@boot_marks).
         @stopped = false
         @boot_thread = nil
+        @boot_slot = nil
         @boot_marks = {}
         @monitor = Monitor.new
       end
@@ -68,18 +69,13 @@ module Rubik
         name_str = name.to_s
         parsed_defn = defn.is_a?(Hash) ? defn.transform_keys(&:to_s) : {}
         persist_res = { ok: true }
-        tools_count = 0
 
         @monitor.synchronize do
           @servers[name_str] = parsed_defn
           @statuses[name_str] ||= :disabled
 
           if @config && persist && @config.persisting?(persist)
-            server_hash = {
-              "command" => parsed_defn["command"],
-              "args" => Array(parsed_defn["args"]),
-              "env" => parsed_defn["env"] || {}
-            }
+            server_hash = { "command" => parsed_defn["command"], "args" => Array(parsed_defn["args"]), "env" => parsed_defn["env"] || {} }
             # Per-server handshake override round-trips only when present,
             # so `!mcp add` output stays minimal (the knob is hand-written
             # config, not a CLI flag).
@@ -87,14 +83,12 @@ module Rubik
             persist_res = @config.set("mcp.servers.#{name_str}", server_hash, persist: persist)
           end
 
-          if auto_start && enabled?
-            enable_server(name_str)
-          else
-            transition_server!(name_str, :disabled)
-          end
-          tools_count = (@tools[name_str] || []).size
+          transition_server!(name_str, :disabled) unless auto_start && enabled?
         end
 
+        enable_server(name_str) if auto_start && enabled?
+
+        tools_count = @monitor.synchronize { (@tools[name_str] || []).size }
         persist_res.merge(tools: tools_count)
       end
 
@@ -219,30 +213,42 @@ module Rubik
           # Post-wiring failures stopped the client via the ctx drain above;
           # pre-wiring failures (stale-context dispose, ctx.extend) reach
           # only this line — idempotent Client#stop makes it exactly-once.
-          begin
-            client.stop
-          rescue StandardError
-            nil
-          end
+          safely_stop_rolled_back_client(client, name_str)
           raise e
         end
       end
 
       def enable_server(name)
         name_str = name.to_s
+        server_defn = nil
+        epoch = nil
         @monitor.synchronize do
           server_defn = @servers[name_str]
           raise Rubik::MCP::Error, "MCP server '#{name_str}' not found" unless server_defn
 
           return @clients[name_str] if @statuses[name_str] == :active && @clients[name_str]&.running?
 
-          connected = begin
-            connect_server(name_str, server_defn)
-          rescue StandardError
-            transition_server!(name_str, :failed)
-            raise
+          epoch = Object.new
+          transition_server!(name_str, :connecting)
+          @boot_marks[name_str] = epoch
+        end
+
+        connected = begin
+          connect_server(name_str, server_defn)
+        rescue StandardError => e
+          @monitor.synchronize { transition_server!(name_str, :failed, epoch: epoch) }
+          raise e
+        end
+
+        @monitor.synchronize do
+          if @stopped || @statuses[name_str] != :connecting || !@boot_marks[name_str].equal?(epoch)
+            safely_stop_rolled_back_client(connected[:client], name_str)
+            return @clients[name_str]
           end
+
           apply_connected_server(name_str, server_defn, **connected)
+          transition_server!(name_str, :active, epoch: epoch)
+          @clients[name_str]
         end
       end
 
@@ -301,18 +307,29 @@ module Rubik
         end
 
         join_boot_safely(2.0)
+        epoch = Object.new
         @monitor.synchronize { @stopped = false }
         thread = Thread.new do
           perform_load_from_config(cfg)
         rescue StandardError, Interrupt => e
           Rubik::Log.warn(:mcp, "background MCP boot failed (#{e.class}: #{e.message})")
         ensure
-          # Only clear OUR reference: a wedged boot A expiring past the drain
-          # bound must not clobber the handle to a newer boot B's thread.
-          @monitor.synchronize { @boot_thread = nil if @boot_thread.equal?(Thread.current) }
+          # Epoch-tagged clear: only clear OUR reference so a wedged boot A
+          # expiring past the drain bound cannot clobber a newer boot B's slot.
+          @monitor.synchronize do
+            @boot_slot = @boot_thread = nil if @boot_slot && @boot_slot[:epoch].equal?(epoch)
+          end
         end
         thread.name = "rubik-mcp-boot" if thread.respond_to?(:name=)
-        @boot_thread = thread
+        @monitor.synchronize do
+          if thread.alive?
+            @boot_slot = { thread: thread, epoch: epoch }
+            @boot_thread = thread
+          elsif @boot_slot && @boot_slot[:epoch].equal?(epoch)
+            @boot_slot = @boot_thread = nil
+          end
+        end
+        thread
       end
 
       private
@@ -509,7 +526,6 @@ module Rubik
             disable_server(name)
           rescue StandardError => e
             Rubik::Log.warn(:mcp, "failed to stop MCP server '#{name}' during teardown (#{e.class}: #{e.message})")
-            nil
           end
         end
       end
@@ -517,11 +533,7 @@ module Rubik
       alias dispose stop_all
 
       def status_summary
-        @monitor.synchronize do
-          @servers.map do |name, _defn|
-            server_status(name)
-          end.compact
-        end
+        @monitor.synchronize { @servers.keys.map { |name| server_status(name) }.compact }
       end
 
       def server_status(name)
@@ -602,9 +614,7 @@ module Rubik
       # falls through to the next source — a miswritten knob must never fail
       # the boot at the config boundary.
       def resolve_connect_timeout(server_defn, explicit)
-        sources = [explicit, server_defn["timeout"] || server_defn[:timeout]]
-        cfg_timeout = @config&.fetch("mcp.timeout", nil)
-        sources << cfg_timeout unless cfg_timeout.nil?
+        sources = [explicit, server_defn["timeout"] || server_defn[:timeout], @config&.fetch("mcp.timeout", nil)]
 
         sources.each do |candidate|
           return candidate if candidate.is_a?(Numeric) && candidate.positive?
@@ -614,6 +624,12 @@ module Rubik
         end
         Client::DEFAULT_TIMEOUT
       end
+
+      def safely_stop_rolled_back_client(client, name)
+        client&.stop
+      rescue StandardError => e
+        Rubik::Log.warn(:mcp, "failed to stop rolled-back MCP client '#{name}' (#{e.class}: #{e.message})")
+      end
     end
   end
 end