@quolu/lattice 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Lattice — phase-aware TODO graph compiler and conflict-aware orchestration runtime",
   "type": "module",
   "license": "MIT",

package/src/seam-proposal-queries.mjs

@@ -129,13 +129,30 @@ function assertRuntimeQuerySet(querySet) {
   }
 }
 
+function assertConcernSymbols(concernSymbols) {
+  if (!Array.isArray(concernSymbols) || concernSymbols.length > QUERY_LIMIT) {
+    fail('SEAM_QUERY_CONCERN_SYMBOLS_INVALID', 'concern_symbols_not_bounded_array');
+  }
+  for (const symbol of concernSymbols) {
+    if (!boundedText(symbol, 1_024)) {
+      fail('SEAM_QUERY_CONCERN_SYMBOL_INVALID', 'concern_symbol_invalid');
+    }
+  }
+  return sortedUnique(concernSymbols);
+}
+
 /**
  * Build the schema-less `lattice.run_request.v1.sensor_query_set` vocabulary used by
  * todo-independence. The wrapper records non-code conflicts without putting their targets
  * on the sensor command line.
+ *
+ * `concernSymbols` are the symbol names declared through witness `concern_anchors`. They only
+ * need the `query` operation: the binder asks whether the declared name resolves to exactly one
+ * symbol, and where it lives. Graph expansion stays owned by the conflict resources.
  */
-export function buildSeamProposalQuerySet({ conflictResources } = {}) {
+export function buildSeamProposalQuerySet({ conflictResources, concernSymbols = [] } = {}) {
   const resources = assertConflictResources(conflictResources);
+  const concerns = assertConcernSymbols(concernSymbols);
   const queryById = new Map([[
     'seam-00-status',
     { id: 'seam-00-status', operation: 'status' },
@@ -168,6 +185,13 @@ export function buildSeamProposalQuerySet({ conflictResources } = {}) {
     }
   }
 
+  // 宣言concern symbolの解決query。conflict symbolと同名なら既存queryがそのまま答えになる。
+  for (const symbol of concerns) {
+    const id = queryId('query', 'symbol', symbol);
+    if (queryById.has(id)) continue;
+    queryById.set(id, { id, operation: 'query', target: symbol });
+  }
+
   const querySet = {
     queries: [...queryById.values()]
       .sort((left, right) => compareText(left.id, right.id)),

package/src/seam-proposal.mjs

@@ -755,6 +755,122 @@ export function verifyVirtualCompileReceipt({ verification, ...options } = {}) {
   };
 }
 
+/** 宣言されたconcern symbolを、`query` operationの解決receiptから探す。 */
+function resolvedSymbolPath(queries, name) {
+  const receipt = queries.find((query) => (
+    query.operation === 'query'
+      && query.target === name
+      && query.outcome === 'resolved'
+      && query.resolved_name === name
+      && typeof query.resolved_path === 'string'
+      && query.resolved_path.length > 0
+  ));
+  return receipt === undefined ? null : receipt.resolved_path;
+}
+
+function pathContains(resourcePath, symbolPath) {
+  return resourcePath.endsWith('/')
+    ? symbolPath.startsWith(resourcePath)
+    : symbolPath === resourcePath;
+}
+
+/**
+ * Resolve declared concern anchors against fresh sensor evidence.
+ *
+ * A declaration only becomes a binding anchor when the sensor resolves the exact name to exactly
+ * one path and that path lies inside the declared resource. Fuzzy resolution to a neighbouring
+ * symbol, an absent name, or a symbol living outside the contested resource yields a typed
+ * unknown instead — a wrong declaration must never widen what the binder believes it knows.
+ *
+ * Two ToDos claiming the same symbol is a contradiction in the declarations themselves, not a cut
+ * to be discovered: the anchor is dropped from both and reported, so neither side can be bound by
+ * a claim the other also makes.
+ */
+export function resolveConcernAnchors({ manualWitness, taskIds, evidence } = {}) {
+  if (!plainRecord(manualWitness) || !Array.isArray(taskIds) || !plainRecord(evidence)) {
+    fail('concern anchor resolution input shapeが不正');
+  }
+  // receiptが1件も無い証拠は「解決しなかった」であって、宣言を素通しさせる理由にはしない。
+  const queries = Array.isArray(evidence.queries) ? evidence.queries : [];
+  const anchorsByTask = new Map();
+  const unknowns = [];
+  for (const taskId of taskIds) {
+    const anchors = [];
+    for (const entry of manualWitness[taskId]?.concern_anchors ?? []) {
+      const resourcePath = entry.within.kind === 'path'
+        ? entry.within.target
+        : resolvedSymbolPath(queries, entry.within.target);
+      if (resourcePath === null) {
+        unknowns.push({
+          kind: 'concern_anchor_resource_unresolved',
+          ref: `${taskId}:${entry.within.kind}:${entry.within.target}`,
+        });
+        continue;
+      }
+      for (const symbol of entry.symbols) {
+        const symbolPath = resolvedSymbolPath(queries, symbol);
+        if (symbolPath === null) {
+          unknowns.push({ kind: 'concern_anchor_unresolved', ref: `${taskId}:${symbol}` });
+          continue;
+        }
+        if (!pathContains(resourcePath, symbolPath)) {
+          unknowns.push({
+            kind: 'concern_anchor_outside_resource',
+            ref: `${taskId}:${symbol}:${symbolPath}`,
+          });
+          continue;
+        }
+        anchors.push(`concern:${symbolPath}\0${symbol}`);
+      }
+    }
+    anchorsByTask.set(taskId, sortedUnique(anchors));
+  }
+
+  // 同じsymbolを2 task以上が担当と主張したら、どちらの束縛根拠にもしない。
+  const claimantsByAnchor = new Map();
+  for (const [taskId, anchors] of anchorsByTask) {
+    for (const anchor of anchors) {
+      if (!claimantsByAnchor.has(anchor)) claimantsByAnchor.set(anchor, []);
+      claimantsByAnchor.get(anchor).push(taskId);
+    }
+  }
+  const overlapping = new Set();
+  for (const [anchor, claimants] of claimantsByAnchor) {
+    if (claimants.length < 2) continue;
+    overlapping.add(anchor);
+    const [path, symbol] = anchor.slice('concern:'.length).split('\0');
+    unknowns.push({
+      kind: 'concern_anchor_overlap',
+      ref: `${[...claimants].sort(compareText).join(',')}:${path}:${symbol}`,
+    });
+  }
+  if (overlapping.size > 0) {
+    for (const [taskId, anchors] of anchorsByTask) {
+      anchorsByTask.set(taskId, anchors.filter((anchor) => !overlapping.has(anchor)));
+    }
+  }
+
+  return {
+    anchorsByTask,
+    unknowns: unknowns.sort((left, right) => compareText(
+      `${left.kind}\0${left.ref}`, `${right.kind}\0${right.ref}`,
+    )),
+  };
+}
+
+/** witness set全体から、sensorへ問い合わせるconcern symbol名を集める。 */
+export function declaredConcernSymbols(manualWitness) {
+  if (!plainRecord(manualWitness)) fail('manual witness shapeが不正');
+  const names = [];
+  for (const witness of Object.values(manualWitness)) {
+    for (const entry of witness?.concern_anchors ?? []) {
+      names.push(...entry.symbols);
+      if (entry.within.kind === 'symbol') names.push(entry.within.target);
+    }
+  }
+  return sortedUnique(names);
+}
+
 function uniqueIntentAnchors(manualWitness, taskIds) {
   const anchorsByTask = new Map();
   const counts = new Map();
@@ -1008,6 +1124,12 @@ function canonicalPartitions(partitions) {
 }
 
 function anchorMatchesNode(anchor, node) {
+  if (anchor.startsWith('concern:')) {
+    const separator = anchor.indexOf('\0');
+    return node.kind === 'symbol'
+      && node.path === anchor.slice('concern:'.length, separator)
+      && node.target === anchor.slice(separator + 1);
+  }
   if (anchor.startsWith('owns:symbol\0')) {
     return node.kind === 'symbol' && node.target === anchor.slice('owns:symbol\0'.length);
   }
@@ -1021,18 +1143,32 @@ function anchorMatchesNode(anchor, node) {
   return false;
 }
 
-function bindSkeleton({ skeleton, graph, intentAnchors, taskIds }) {
+/**
+ * Bind tasks to partitions.
+ *
+ * Declared concern anchors take precedence over the coarse owns/writes/test anchors within one
+ * skeleton: a ToDo that named the symbols it touches inside the contested resource has given
+ * strictly more specific evidence than "it owns some file". The coarse anchors stay as the
+ * fallback for skeletons the declaration says nothing about, so declaring a concern for one
+ * conflict never blinds the binder to another.
+ */
+function bindSkeleton({ skeleton, graph, intentAnchors, concernAnchors, taskIds }) {
   const nodeByKey = new Map(graph.nodes.map((node) => [graphNodeKey(node), node]));
   const taskBindings = [];
   const unknowns = [];
-  for (const taskId of taskIds) {
-    const matches = [];
+  const matchesFor = (anchors) => {
+    const matched = [];
     skeleton.partitions.forEach((partition, index) => {
-      const anchors = intentAnchors.get(taskId).filter((anchor) => (
+      const hits = anchors.filter((anchor) => (
         partition.some((key) => anchorMatchesNode(anchor, nodeByKey.get(key)))
       ));
-      if (anchors.length > 0) matches.push({ index, anchors: sortedUnique(anchors) });
+      if (hits.length > 0) matched.push({ index, anchors: sortedUnique(hits) });
     });
+    return matched;
+  };
+  for (const taskId of taskIds) {
+    const declared = matchesFor(concernAnchors.get(taskId) ?? []);
+    const matches = declared.length > 0 ? declared : matchesFor(intentAnchors.get(taskId));
     if (matches.length === 0) {
       unknowns.push({
         kind: 'semantic_owner_binding_missing',
@@ -1068,15 +1204,54 @@ function bindSkeleton({ skeleton, graph, intentAnchors, taskIds }) {
   };
 }
 
+/**
+ * Build a cut skeleton for a contested repo path out of the declared concern anchors alone.
+ *
+ * A path conflict has no call graph to partition — the sensor was only asked which tests the file
+ * affects. What the declarations do give is a partition of the file's symbols by owner, which is
+ * exactly the shape a cut needs. Every task in the component must have named at least one symbol
+ * inside the path; otherwise there is nothing to say about who owns which half and the caller
+ * keeps reporting the resource as unavailable rather than guessing.
+ */
+function declaredPartitionSkeleton({ conflict, concernAnchors, taskIds }) {
+  const rootPath = conflict.target;
+  const root = { kind: 'path', target: rootPath, path: rootPath };
+  const nodes = [root];
+  const partitions = [];
+  for (const taskId of taskIds) {
+    const owned = (concernAnchors.get(taskId) ?? [])
+      .map((anchor) => {
+        const separator = anchor.indexOf('\0');
+        return {
+          path: anchor.slice('concern:'.length, separator),
+          name: anchor.slice(separator + 1),
+        };
+      })
+      .filter(({ path }) => pathContains(rootPath, path));
+    if (owned.length === 0) return null;
+    for (const { path, name } of owned) nodes.push({ kind: 'symbol', target: name, path });
+    partitions.push(owned.map(({ path, name }) => graphNodeKey({
+      kind: 'symbol', target: name, path,
+    })));
+  }
+  return {
+    root,
+    nodes,
+    partitions: canonicalPartitions(partitions),
+  };
+}
+
 /**
  * Enumerate structural cut skeletons from the in-memory sensor outcomes. Graph edges only shape
- * SCC/closure/frontier partitions; task ownership is bound exclusively by unique witness anchors.
+ * SCC/closure/frontier partitions; task ownership is bound exclusively by unique witness anchors
+ * and by declared concern anchors, never by the edges themselves.
  */
 export function enumerateCutSkeletons({
   component,
   request,
   evidence,
   rawCollected,
+  concernAnchors = new Map(),
 } = {}) {
   if (!plainRecord(component)
     || !Array.isArray(component.task_ids)
@@ -1087,7 +1262,9 @@ export function enumerateCutSkeletons({
   }
   const taskIds = [...component.task_ids].sort(compareText);
   const intentAnchors = uniqueIntentAnchors(request.manual_witness, taskIds);
-  const missingIntent = taskIds.filter((taskId) => intentAnchors.get(taskId).length === 0);
+  const missingIntent = taskIds.filter((taskId) => (
+    intentAnchors.get(taskId).length === 0 && (concernAnchors.get(taskId) ?? []).length === 0
+  ));
   if (missingIntent.length > 0) {
     return {
       skeletons: [],
@@ -1102,6 +1279,26 @@ export function enumerateCutSkeletons({
   const skeletonByLayout = new Map();
   const unknowns = [];
   for (const conflict of component.conflicts) {
+    if (conflict.kind === 'path') {
+      const declared = declaredPartitionSkeleton({ conflict, concernAnchors, taskIds });
+      if (declared === null || declared.partitions.length < 2) {
+        unknowns.push({ kind: 'raw_graph_unavailable', ref: conflict.resource_id });
+        continue;
+      }
+      const layoutKey = digestArtifact({
+        conflict_resource_id: conflict.resource_id,
+        partitions: declared.partitions,
+      });
+      skeletonByLayout.set(layoutKey, {
+        skeleton_id: `cut-${sha16(layoutKey)}`,
+        conflict_resource_id: conflict.resource_id,
+        cut_kinds: ['declared_partition'],
+        root_surface: structuredClone(declared.root),
+        partitions: declared.partitions,
+        raw_graph: { nodes: structuredClone(declared.nodes), edges: [] },
+      });
+      continue;
+    }
     if (conflict.kind !== 'symbol') {
       unknowns.push({ kind: 'raw_graph_unavailable', ref: conflict.resource_id });
       continue;
@@ -1154,6 +1351,7 @@ export function enumerateCutSkeletons({
       skeleton,
       graph: skeleton.raw_graph,
       intentAnchors,
+      concernAnchors,
       taskIds,
     }));
   for (const skeleton of skeletons) unknowns.push(...skeleton.binding_unknowns);
@@ -1251,6 +1449,7 @@ export function evaluateSeamProposalCandidates({
   evidence,
   candidateSpecs,
   explorationComplete = false,
+  concernAnchors = new Map(),
 } = {}) {
   if (!plainRecord(component)
     || !Array.isArray(component.task_ids)
@@ -1265,7 +1464,9 @@ export function evaluateSeamProposalCandidates({
   }
   const taskSet = new Set(taskIds);
   const intentAnchors = uniqueIntentAnchors(request.manual_witness, taskIds);
-  const missingIntent = taskIds.filter((taskId) => intentAnchors.get(taskId).length === 0);
+  const missingIntent = taskIds.filter((taskId) => (
+    intentAnchors.get(taskId).length === 0 && (concernAnchors.get(taskId) ?? []).length === 0
+  ));
   if (missingIntent.length > 0) {
     return decisionUnknown(component, missingIntent.map((taskId) => ({
       kind: 'semantic_owner_binding_missing',
@@ -1556,15 +1757,20 @@ export function compileSeamProposalDecision({
   sensorEvidence,
   evidence,
   rawCollected,
+  concernAnchors = new Map(),
+  concernUnknowns = [],
 } = {}) {
   const enumeration = enumerateCutSkeletons({
     component,
     request,
     evidence,
     rawCollected,
+    concernAnchors,
   });
-  if (enumeration.unknowns.length > 0) {
-    return decisionUnknown(component, enumeration.unknowns);
+  // 宣言が解決しなかった事実は、束縛が成功したかに関わらず記録から消さない。
+  const unknowns = [...concernUnknowns, ...enumeration.unknowns];
+  if (unknowns.length > 0) {
+    return decisionUnknown(component, unknowns);
   }
   const candidateSpecs = enumeration.skeletons.map((skeleton) => (
     skeletonCandidateSpec({ skeleton, component, request, evidence })
@@ -1582,6 +1788,7 @@ export function compileSeamProposalDecision({
     evidence,
     candidateSpecs,
     explorationComplete: enumeration.exploration_complete,
+    concernAnchors,
   });
 }
 
@@ -1730,13 +1937,25 @@ export function compileSeamProposalArtifact({
     baseSha: independenceArtifact.base_sha,
     requestId: `seam-proposal-${independenceArtifact.result_digest.slice(0, 24)}`,
   });
-  const decisions = conflictComponents(independenceArtifact).map((component) => (
+  const components = conflictComponents(independenceArtifact);
+  const concern = resolveConcernAnchors({
+    manualWitness: witnessSet.manual_witness,
+    taskIds: [...new Set(components.flatMap(({ task_ids: ids }) => ids))].sort(compareText),
+    evidence,
+  });
+  const decisions = components.map((component) => (
     compileSeamProposalDecision({
       component,
       request,
       sensorEvidence,
       evidence,
       rawCollected,
+      concernAnchors: concern.anchorsByTask,
+      // このcomponentのtaskに関する解決失敗だけを持ち込む。
+      concernUnknowns: concern.unknowns.filter((unknown) => (
+        component.task_ids.some((taskId) => unknown.ref.startsWith(`${taskId}:`)
+          || unknown.ref.split(':')[0].split(',').includes(taskId))
+      )),
     })
   )).sort((left, right) => compareText(left.component_id, right.component_id));
   const artifact = {

package/src/todo-cli.mjs

@@ -83,7 +83,7 @@ import {
   SEAM_PROPOSAL_PROJECTION_SCHEMA,
   validateSeamProposalProjection,
 } from './seam-proposal-contracts.mjs';
-import { compileSeamProposalArtifact } from './seam-proposal.mjs';
+import { compileSeamProposalArtifact, declaredConcernSymbols } from './seam-proposal.mjs';
 import {
   parseTodoSourceRef, todoLegacyReconciliationDigest, validatePhaseTodoRevision,
   validateTodoRevision, validateTodoRevisionSet,
@@ -893,6 +893,7 @@ async function seamProposalCompile({ repoRoot, planKey }) {
 
   const { query_set: querySet } = buildSeamProposalQuerySet({
     conflictResources: independenceArtifact.conflict_resources,
+    concernSymbols: declaredConcernSymbols(witnessSet.manual_witness),
   });
   const [sensorEvidence, proposalEvidence] = await Promise.all([
     collectWitnessSensorEvidence({ cwd: repoRoot, witnessSet }),

package/src/todo-independence-contracts.mjs

@@ -13,7 +13,19 @@ import {
 } from './runtime-contracts.mjs';
 import { TODO_INDEPENDENCE_GUIDANCE_CODES } from './todo-independence-guidance.mjs';
 
-export const TODO_WITNESS_SET_SCHEMA = 'lattice.todo_witness_set.v1';
+export const TODO_WITNESS_SET_SCHEMA = 'lattice.todo_witness_set.v2';
+/**
+ * まだ受理する旧witness set契約。v1はconcern anchorを持てないだけで、境界宣言としては
+ * v2と同値である。既存宣言を書き換えさせないために読み口を残す。
+ */
+export const TODO_WITNESS_SET_LEGACY_SCHEMAS = Object.freeze(['lattice.todo_witness_set.v1']);
+export const TODO_WITNESS_SET_SCHEMAS = Object.freeze([
+  TODO_WITNESS_SET_SCHEMA,
+  ...TODO_WITNESS_SET_LEGACY_SCHEMAS,
+]);
+
+/** 1 taskが宣言できるconcern anchorの資源数と、資源あたりのsymbol数の上限。 */
+export const TODO_CONCERN_ANCHOR_LIMIT = 256;
 export const TODO_INDEPENDENCE_SCHEMA = 'lattice.todo_independence.v3';
 export const TODO_INDEPENDENCE_PROJECTION_SCHEMA = 'lattice.todo_independence_projection.v2';
 export const TODO_INDEPENDENCE_LEGACY_MARKER_SCHEMA = 'lattice.todo_independence_legacy_marker.v1';
@@ -97,6 +109,10 @@ function boundedText(value, maximumBytes = 4_096) {
  * manual witnessとsensor query setの判定正本は`explainRunRequest`だけが持つ（ADR 0123）。
  * ここで同じ規則を書き直すと契約が二箇所へ分裂するため、検証もcompileもこの合成を通す。
  * `requestId`はplan identityとwitness digestから導出され、run lifecycleへは登録されない。
+ *
+ * `concern_anchors`はここで落とす。並列可否の判定はこの合成requestだけを入力にするので、
+ * 落としておけばconcern宣言が判定へ影響しないことが構造で保証される（testの主張ではない）。
+ * 宣言はseam束縛の入力であり、witness setから直接読む。
  */
 export function synthesizeWitnessRunRequest(witnessSet, { baseSha, requestId }) {
   const taskIds = Object.keys(witnessSet.manual_witness).sort(compareText);
@@ -106,7 +122,10 @@ export function synthesizeWitnessRunRequest(witnessSet, { baseSha, requestId })
     repo: { base_sha: baseSha, root_kind: 'git' },
     capacity: witnessSet.capacity,
     todos: taskIds.map((taskId) => ({ todo_id: taskId })),
-    manual_witness: witnessSet.manual_witness,
+    manual_witness: Object.fromEntries(taskIds.map((taskId) => {
+      const { concern_anchors: _concernAnchors, ...boundary } = witnessSet.manual_witness[taskId];
+      return [taskId, boundary];
+    })),
     sensor_query_set: witnessSet.sensor_query_set,
     executor_capability: { adapters: ['todo-independence'] },
     claim_mode: RUN_REQUEST_CLAIM_MODE,
@@ -117,10 +136,57 @@ export function synthesizeWitnessRunRequest(witnessSet, { baseSha, requestId })
 }
 
 /**
- * `lattice.todo_witness_set.v1`を検証し、拒否理由とpathを返す。
+ * 1 taskのconcern anchor宣言を検査する。
+ *
+ * `within`はそのtask自身が`owns`で主張している資源に限る。所有していない資源の内側に
+ * 担当を主張させない。symbol名の実在・資源内包含・task間排他はsensorとcompile側が見る。
+ */
+function explainConcernAnchors(anchors, owns, at) {
+  const reject = (reason, path) => ({ valid: false, reason, path });
+  if (!Array.isArray(anchors) || anchors.length > TODO_CONCERN_ANCHOR_LIMIT) {
+    return reject('bounded_collection_violation', at);
+  }
+  const ownedKeys = new Set(owns.map((own) => `${own.kind}\0${own.target}`));
+  for (const [index, entry] of anchors.entries()) {
+    const entryAt = `${at}/${index}`;
+    if (!exactRecord(entry, ['within', 'symbols'])) {
+      return reject('unexpected_or_missing_keys', entryAt);
+    }
+    if (!exactRecord(entry.within, ['kind', 'target'])
+      || !['symbol', 'path'].includes(entry.within.kind)) {
+      return reject('invalid_concern_anchor_resource', `${entryAt}/within`);
+    }
+    const targetValid = entry.within.kind === 'path'
+      ? repoRelativeResourceTarget(entry.within.target)
+      : boundedText(entry.within.target, 1_024);
+    if (!targetValid) return reject('invalid_concern_anchor_resource', `${entryAt}/within`);
+    if (!ownedKeys.has(`${entry.within.kind}\0${entry.within.target}`)) {
+      return reject('concern_anchor_resource_not_owned', `${entryAt}/within`);
+    }
+    if (!Array.isArray(entry.symbols) || entry.symbols.length < 1
+      || entry.symbols.length > TODO_CONCERN_ANCHOR_LIMIT) {
+      return reject('bounded_collection_violation', `${entryAt}/symbols`);
+    }
+    if (!entry.symbols.every((symbol) => boundedText(symbol, 1_024))) {
+      return reject('invalid_concern_anchor_symbol', `${entryAt}/symbols`);
+    }
+    if (!strictlySorted(entry.symbols)) {
+      return reject('unsorted_or_duplicate_collection', `${entryAt}/symbols`);
+    }
+  }
+  if (!strictlySorted(anchors, (entry) => `${entry.within.kind}\0${entry.within.target}`)) {
+    return reject('unsorted_or_duplicate_collection', at);
+  }
+  return { valid: true };
+}
+
+/**
+ * `lattice.todo_witness_set.v2`（およびconcern anchorを持たない旧v1）を検証し、
+ * 拒否理由とpathを返す。
  *
  * 自分のshapeだけをここで見て、witness本体はprobe requestへ合成して
  * `explainRunRequest`へ委譲する。probeのbase_shaは検証専用の定数であり永続化しない。
+ * `concern_anchors`はprobeから落ちるので、ここだけが判定正本になる。
  */
 export function explainTodoWitnessSet(value) {
   const reject = (reason, at = '') => ({ valid: false, reason, path: at });
@@ -129,7 +195,7 @@ export function explainTodoWitnessSet(value) {
       'schema', 'project_id', 'plan_key', 'capacity', 'sensor_query_set',
       'manual_witness', 'witness_set_digest',
     ])) return reject('unexpected_or_missing_top_level_keys');
-    if (value.schema !== TODO_WITNESS_SET_SCHEMA) return reject('schema_mismatch', '/schema');
+    if (!TODO_WITNESS_SET_SCHEMAS.includes(value.schema)) return reject('schema_mismatch', '/schema');
     if (!isTodoIdentifier(value.project_id)) return reject('invalid_identifier', '/project_id');
     if (!isTodoIdentifier(value.plan_key)) return reject('invalid_identifier', '/plan_key');
     if (!plain(value.manual_witness)) return reject('not_an_object', '/manual_witness');
@@ -146,6 +212,16 @@ export function explainTodoWitnessSet(value) {
     });
     const explained = explainRunRequest(probe);
     if (!explained.valid) return reject(explained.reason, explained.path);
+    // concern anchorはprobeへ写していないので、ここが唯一の判定正本になる。
+    const legacy = TODO_WITNESS_SET_LEGACY_SCHEMAS.includes(value.schema);
+    for (const taskId of taskIds) {
+      const witness = value.manual_witness[taskId];
+      const at = `/manual_witness/${taskId}/concern_anchors`;
+      if (!Object.hasOwn(witness, 'concern_anchors')) continue;
+      if (legacy) return reject('concern_anchors_require_witness_set_v2', at);
+      const anchors = explainConcernAnchors(witness.concern_anchors, witness.owns, at);
+      if (!anchors.valid) return reject(anchors.reason, anchors.path);
+    }
     return { valid: true };
   } catch {
     return reject('non_canonical_witness_set_bytes');