@quolu/lattice 0.50.1 → 0.52.0

package/src/runtime-cli.mjs

@@ -32,6 +32,11 @@ import {
   compileRuntimePlanV1,
   evidenceFromCollectedOutcomes,
 } from './runtime-front-end.mjs';
+import {
+  explainTodoWitnessSet,
+  isGitSha,
+  synthesizeWitnessRunRequest,
+} from './todo-independence-contracts.mjs';
 import {
   explainRunRequest,
   validateRunRequest,
@@ -73,15 +78,44 @@ import {
   isManagedRunFrozen,
   readCommittedEpochStore,
   recordRuntimeFinding,
+  rejectFutureRuntimeStoreSchema,
   stageSuccessorEpoch,
   validateRuntimeEpochBundle,
   validateRuntimeFindingCandidate,
   validateRuntimeFindingRecord,
 } from './runtime-multi-epoch-store.mjs';
-import { createRuntimeControlRequest, validateRuntimeControlResponse } from './runtime-controller-protocol.mjs';
+import {
+  acceptsHostDrivenEpoch,
+  createRuntimeControlRequest,
+  validateRuntimeControlResponse,
+} from './runtime-controller-protocol.mjs';
 import { createRuntimeControlStore } from './runtime-control-store.mjs';
 import { createRuntimeGateStore } from './runtime-gate-store.mjs';
-import { acquireRuntimeLifecycleLock } from './runtime-lifecycle-lock.mjs';
+import {
+  RuntimeLifecycleLockError,
+  acquireRuntimeLifecycleLock,
+} from './runtime-lifecycle-lock.mjs';
+import {
+  PullRunError,
+  acceptPullTask,
+  attachPullWorker,
+  closePullRun,
+  inspectRunMode as inspectPullRunMode,
+  intakePullTask,
+  interventionPullTask,
+  landingPullRun,
+  listPullRunEntry,
+  observePullRun,
+  releasePullTask,
+  startPullRun,
+  statusPullRun,
+} from './runtime-pull-intake.mjs';
+import {
+  RuntimeDriverStateError,
+  readRuntimeDriverState,
+  replaceRuntimeDriverState,
+} from './runtime-driver-state.mjs';
+
 import {
   AdapterRegistryError,
   listRuntimeAdapters,
@@ -93,9 +127,29 @@ import {
   observeManagedProcessStartIdentity,
   prepareManagedSupervisorRestart,
   resolveActiveRuntimePaths,
-  sendRuntimeActivationRequest,
+  sendRuntimeActivationRequestUntilSettled,
   sendRuntimeControlRequest,
 } from './runtime-managed-supervisor.mjs';
+import { TodoStoreError } from './todo-store.mjs';
+
+async function inspectRunMode(runDir) {
+  try {
+    return await inspectPullRunMode(runDir);
+  } catch (error) {
+    if (error instanceof PullRunError && error.code === 'UNSUPPORTED_RUN_STORE_SCHEMA') {
+      rejectFutureRuntimeStoreSchema(error.detail?.schema, {
+        artifact: 'run_meta', family: 'lattice.run_meta', expectedVersion: 2,
+      });
+    }
+    throw error;
+  }
+}
+
+async function requireLegacyRunMode(runDir, operation) {
+  if ((await inspectRunMode(runDir)).mode !== 'legacy') {
+    throw new PullRunError('RUN_MODE_MISMATCH', `pull runはlegacy専用${operation}を受け付けない`);
+  }
+}
 
 /**
  * RC3-D CLI surface（ADR 0044 Decision 8）。
@@ -103,11 +157,13 @@ import {
  *   lattice plan compile --request <run-request.json>
  *   lattice plan verify  --request <run-request.json> --plan <plan.json>
  *   lattice run start    --request <run-request.json> --executor <adapter>
+ *   lattice run request synthesize --witness <witness-set.json> --base-sha <sha> --id <request-id>
  *   lattice run adapter register --input <descriptor.json>
  *   lattice run adapter list --json
  *   lattice run observe  --run .lattice/runs/<run-id>
  *   lattice run status   --run .lattice/runs/<run-id>
  *   lattice run resume   --run .lattice/runs/<run-id>
+ *   lattice run landing  --run .lattice/runs/<run-id>
  *   lattice run close    --run .lattice/runs/<run-id>
  *   lattice run abandon  --run .lattice/runs/<run-id> --reason <reason>
  *   lattice event verify --run .lattice/runs/<run-id>
@@ -130,7 +186,9 @@ const CLI_ERROR_SCHEMA = 'lattice.cli_error.v2';
 // 現役run storeは対象Git repo内のLattice-owned・ignored rootへ限定する。
 const RUN_STORE_ROOT = ['.lattice', 'runs'];
 const RUN_REF = /^\.lattice\/runs\/([0-9A-Za-z](?:[0-9A-Za-z._-]{0,127}))$/u;
-const KNOWN_ADAPTERS = Object.freeze(['scripted', 'isolated-worktree', 'actual-agent']);
+const KNOWN_ADAPTERS = Object.freeze([
+  'scripted', 'isolated-worktree', 'actual-agent', 'work-order',
+]);
 /**
  * 自動escalationがlifecycle lockを待つ上限（ADR 0143）。
  *
@@ -154,8 +212,7 @@ function ownedResourceId(kind, target) {
 function ownedPathResourceId(pathValue) {
   return ownedResourceId('path', pathValue);
 }
-/** 走行中workerの完了を待つ上限と間隔。待てないと走行中の観測が成立しない。 */
-const SCRIPTED_OBSERVE_TIMEOUT_MS = 120_000;
+/** 走行中workerの完了を観測する間隔。待てないと走行中の観測が成立しない。 */
 const SCRIPTED_OBSERVE_POLL_MS = 20;
 
 class CliContractError extends Error {
@@ -312,11 +369,11 @@ async function runRequestSchema({ stdout }) {
 /** 公開登録入力を推測させないため、配布物に同梱したJSON Schemaをそのまま返す（ADR 0125）。 */
 async function runAdapterRegisterSchema({ stdout }) {
   const schemaUrl = new URL(
-    '../docs/schemas/lattice.runtime_adapter_registration_input.v1.schema.json',
+    '../docs/schemas/lattice.runtime_adapter_registration_input.v2.schema.json',
     import.meta.url,
   );
   const schema = JSON.parse(await readFile(schemaUrl, 'utf8'));
-  if (schema?.title !== 'lattice.runtime_adapter_registration_input.v1') {
+  if (schema?.title !== 'lattice.runtime_adapter_registration_input.v2') {
     throw new CliContractError('CONTRACT_VIOLATION', '同梱adapter registration input schemaが不正');
   }
   stdout.write(`${JSON.stringify(schema)}\n`);
@@ -346,6 +403,47 @@ async function runAdapterRegister({ cwd, inputPath, stdout }) {
   }
 }
 
+/**
+ * witness setから`run start`へ渡せるrun requestを組み立てて返す（read-only）。
+ *
+ * **推測しない面である。** base shaもrequest idもCLIが決めず、呼び手が渡す——どのbaseへ
+ * 対する計画なのかは装置が知らないし、HEADを黙って採ると「撮ったつもりのbaseと違う木」で
+ * runが始まる。witness setの検査は`explainTodoWitnessSet`が単一の正本なので、ここでは
+ * 判定を持たず理由とpathをそのまま返す。
+ *
+ * request idの旗が`--id`なのは、`--request-id`が末尾2引数のときrun mutationの
+ * idempotency keyとして先に横取りされるためである（同じ綴りで別の意味を持たせない）。
+ */
+async function runRequestSynthesize({ cwd, witnessPath, baseSha, requestId, stdout }) {
+  if (!isGitSha(baseSha)) {
+    throw new CliContractError('INVALID_BASE_SHA', '--base-shaが40桁のgit shaでない', {
+      base_sha: baseSha,
+    });
+  }
+  if (!/^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$/u.test(requestId)) {
+    throw new CliContractError('INVALID_REQUEST_ID', '--idは128文字以下の識別子でなければならない', {
+      request_id: requestId,
+    });
+  }
+  const witnessSet = await readBoundedJson(path.resolve(cwd, witnessPath), 'witness set');
+  const verdict = explainTodoWitnessSet(witnessSet);
+  if (!verdict.valid) {
+    throw new CliContractError('WITNESS_SET_INVALID', 'witness setが契約を満たさない', {
+      path: witnessPath, reason: verdict.reason, pointer: verdict.path ?? null,
+    });
+  }
+  const request = synthesizeWitnessRunRequest(witnessSet, { baseSha, requestId });
+  const explained = explainRunRequest(request);
+  if (!explained.valid) {
+    // 生成物が自分の契約を満たさないなら、それは装置の不具合である。黙って出さない
+    throw new CliContractError('CONTRACT_VIOLATION', '生成したrun requestがrun_request契約を満たさない', {
+      reason: explained.reason, pointer: explained.path ?? null,
+    });
+  }
+  stdout.write(`${JSON.stringify(request)}\n`);
+  return 0;
+}
+
 async function runAdapterList({ cwd, stdout }) {
   try {
     const repoRoot = await resolveRepoRoot(cwd);
@@ -523,6 +621,9 @@ async function readRunStore(runDir) {
     throw new CliContractError('INVALID_RUN_STORE', 'events.jsonがarrayではない');
   }
   const meta = await readBoundedJson(path.join(runDir, 'run-meta.json'), 'run meta');
+  rejectFutureRuntimeStoreSchema(meta?.schema, {
+    artifact: 'run_meta', family: 'lattice.run_meta', expectedVersion: 2,
+  });
   const compileArtifact = await readBoundedJson(
     path.join(runDir, 'plan-compile-result.json'), 'plan compile result',
   );
@@ -536,9 +637,11 @@ async function readRunStore(runDir) {
     && meta.run_id === request.request_id
     && KNOWN_ADAPTERS.includes(meta.executor_adapter)
     && compileArtifact?.plan?.plan_digest === meta.plan_digest;
-  const managed = meta?.schema === 'lattice.run_meta.v2'
-    ? await readCommittedEpochStore(runDir)
-    : null;
+  // v1だけがlegacy alias。その他はmulti-epoch readerへ渡し、既知familyの
+  // 将来世代を破損storeへ潰さずtyped診断する。
+  const managed = meta?.schema === 'lattice.run_meta.v1'
+    ? null
+    : await readCommittedEpochStore(runDir);
   const managedMetaValid = managed !== null
     && managed.meta.run_id === request.request_id
     && KNOWN_ADAPTERS.includes(managed.meta.executor_adapter)
@@ -806,6 +909,7 @@ async function driveScriptedManagedEpoch({
   drainEscalations = null,
   escalateTerminalConflict = null,
   preactivated = null,
+  reportDriverState = null,
 }) {
   let events = [...initialEvents];
   const { plan, manifests, executor_packets: packets } = committed.bundle;
@@ -819,6 +923,7 @@ async function driveScriptedManagedEpoch({
   for (;;) {
     const frontier = computeReadyFrontier({ plan, events }).dispatchable;
     if (frontier.length === 0) break;
+    await reportDriverState?.({ kind: 'frontier_dispatch', todo_ids: [...frontier].sort() });
     const alreadyRunning = projectRuntimeState({ events }).running;
     const issuedControlDigest = controlEvents().at(-1)?.event_digest;
     if (typeof issuedControlDigest !== 'string') {
@@ -936,9 +1041,11 @@ async function driveScriptedManagedEpoch({
             process_group_id: response.worker_process.process_group_id,
             process_start_identity:
               structuredClone(response.worker_process.process_start_identity),
-            // workerはさらに子を持たない。空配列は「子が居ない」という主張であり、
-            // 直接OS観測は実測と突き合わせて未記録のchildが居ないことまで確かめる。
+            // 省略は従来adapterのstatic child集合。外部長寿命workerはroot identityと
+            // PGIDだけを不変にし、barrier時点の全group member静止を検証する。
             process_children: [],
+            process_membership_policy:
+              response.worker_process.process_membership ?? 'static',
             // TODOごとの木を指す。ここがrepo rootだった頃、帰属はrootから決まらなかった。
             worktree_path: worktreeByTodo.get(packet.todo_id),
             worktree_realpath: worktreeByTodo.get(packet.todo_id),
@@ -1012,8 +1119,10 @@ async function driveScriptedManagedEpoch({
     // 回し、その合間に早期警報のescalationを捌く。捌くのは`replaceEventsAtomically`の
     // 直後だけ——そこでしかdiskとメモリのeventsが一致していない。
     const awaiting = new Set([...dispatched.dispatched, ...alreadyRunning]);
+    if (awaiting.size > 0) {
+      await reportDriverState?.({ kind: 'executor_completion', todo_ids: [...awaiting].sort() });
+    }
     const completedReceiptIds = new Set();
-    const observeDeadline = Date.now() + SCRIPTED_OBSERVE_TIMEOUT_MS;
     let frozen = false;
     while (awaiting.size > 0) {
       const drained = await drainEscalations?.(events) ?? null;
@@ -1088,7 +1197,9 @@ async function driveScriptedManagedEpoch({
               paths: peerCheckpoint.payload.diff.entries.map((entry) => entry.path) });
           }
           const actionable = classifyObservedDiff({ plan, manifests, observations,
-            relevantTodoIds }).findings.filter((finding) => finding.kind === 'observed_write_conflict'
+            relevantTodoIds }).findings.filter((finding) => [
+            'observed_write_conflict', 'observed_line_change',
+          ].includes(finding.kind)
               && finding.todo_ids.includes(todoId));
           if (actionable.length > 0) {
             if (typeof escalateTerminalConflict !== 'function') {
@@ -1107,17 +1218,18 @@ async function driveScriptedManagedEpoch({
             && event.subject?.kind === 'todo' && event.subject.ref === id)
             ?.payload?.direct_os_observation_binding?.worktree_path });
         awaiting.delete(todoId);
+        if (awaiting.size > 0) {
+          await reportDriverState?.({ kind: 'executor_completion', todo_ids: [...awaiting].sort() });
+        }
         progressed = true;
         if (frozen) break;
       }
       if (frozen) break;
       if (awaiting.size === 0) break;
-      if (Date.now() >= observeDeadline) {
-        throw new ManagedRuntimeError(
-          'ADAPTER_CONTROLLER_UNAVAILABLE',
-          `scripted workerが時間内に終わらない: ${[...awaiting].join(',')}`,
-        );
-      }
+      // 長寿命workerの正常な作業時間を固定期限でcontroller障害へ変換しない。
+      // controllerとのroute自体が失敗した時だけtyped errorになり、running応答中は
+      // durable supervisorが観測を継続する。CLIはoutcome unknownで先に戻り得るが、
+      // run resumeは同じstoreをread-only投影し、leaseを再認可しない。
       if (!progressed) {
         await new Promise((resolve) => { setTimeout(resolve, SCRIPTED_OBSERVE_POLL_MS); });
       }
@@ -1147,8 +1259,14 @@ async function driveScriptedManagedEpoch({
   return events;
 }
 
-function isDistributedScriptedControllerActivation(activation) {
-  return activation?.controllerDescriptor?.adapter_kind === 'scripted'
+function isHostDrivenEpochActivation(activation) {
+  const controllerCapabilities = activation?.controllerDescriptor?.capabilities;
+  if (acceptsHostDrivenEpoch(controllerCapabilities)) {
+    return activation?.launchDescriptor?.capabilities_digest
+      === controllerCapabilities.capabilities_digest;
+  }
+  return controllerCapabilities?.schema === 'lattice.runtime_adapter_capabilities.v1'
+    && activation?.controllerDescriptor?.adapter_kind === 'scripted'
     && activation?.launchDescriptor?.launch_kind === 'host_binary'
     && activation.launchDescriptor.argv.some((argument) => (
       path.basename(argument) === 'lattice-scripted-adapter.mjs'
@@ -1238,6 +1356,19 @@ async function runStart({ requestPath, executorAdapter, cwd, stdout }) {
   return 0;
 }
 
+async function runPullStart({ runId, planKey, equipment, cwd, stdout }) {
+  const repoRoot = await resolveRepoRoot(cwd);
+  await requireSafeRunAncestors(repoRoot);
+  await requireIgnoredRunStore(repoRoot);
+  const runDir = runStorePath(repoRoot, runId);
+  await mkdir(path.dirname(runDir), { recursive: true });
+  const output = await startPullRun({ repoRoot, runDir, runId, planKey, equipment });
+  output.run_dir = path.relative(repoRoot, runDir);
+  output.result_digest = digestArtifact(output);
+  stdout.write(`${JSON.stringify(output)}\n`);
+  return 0;
+}
+
 /**
  * 記録済み競合findingを、実際の変換で解消する（請求項8・ADR 0137〜0141）。
  *
@@ -1341,7 +1472,54 @@ async function runSeamProfile({ runDir, repoRoot, findingDigest, inputPath, stdo
   return 0;
 }
 
+const stoppedDriverProjection = () => ({ driver_state: 'stopped', waiting_on: null });
+
+async function runtimeDriverProjection(runDir) {
+  const state = await readRuntimeDriverState({ runDir });
+  if (state === null || state.driver_state === 'stopped') return stoppedDriverProjection();
+  const descriptorPath = path.join(runDir, ...state.supervisor_descriptor_ref.split('/'));
+  let descriptor;
+  try {
+    descriptor = await readBoundedJson(descriptorPath, 'runtime supervisor descriptor');
+  } catch (error) {
+    if (error instanceof CliContractError && error.code === 'INPUT_UNREADABLE') {
+      return stoppedDriverProjection();
+    }
+    throw error;
+  }
+  if (descriptor?.descriptor_digest !== state.supervisor_descriptor_digest
+    || descriptor?.process_start_identity?.identity_digest
+      !== state.supervisor_process_start_identity_digest) {
+    throw new RuntimeDriverStateError('INVALID_RUN_STORE', 'driver stateがsupervisor descriptorへbindしない');
+  }
+  let observedIdentity;
+  try {
+    observedIdentity = await observeManagedProcessStartIdentity(descriptor.pid);
+  } catch (error) {
+    if (error instanceof ManagedRuntimeError && error.code === 'ADAPTER_CONTROLLER_UNAVAILABLE') {
+      return stoppedDriverProjection();
+    }
+    throw error;
+  }
+  if (observedIdentity.identity_digest !== state.supervisor_process_start_identity_digest) {
+    return stoppedDriverProjection();
+  }
+  return { driver_state: 'driving', waiting_on: structuredClone(state.waiting_on) };
+}
+
+async function withRuntimeDriverProjection(output, runDir) {
+  const projected = { ...output, ...await runtimeDriverProjection(runDir) };
+  delete projected.result_digest;
+  projected.result_digest = digestArtifact(projected);
+  return projected;
+}
+
 async function runObserve({ runDir, stdout }) {
+  if ((await inspectRunMode(runDir)).mode === 'pull') {
+    const output = await withRuntimeDriverProjection(await observePullRun(runDir), runDir);
+    stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+  }
   const { events } = await readRunStore(runDir);
   const chain = verifyRunEventChain({ events });
   if (!chain.valid) {
@@ -1359,6 +1537,7 @@ async function runObserve({ runDir, stdout }) {
     closed: state.closed,
     event_count: events.length,
     events_digest: digestArtifact(events.map(({ event_digest: digest }) => digest)),
+    ...await runtimeDriverProjection(runDir),
   };
   output.result_digest = digestArtifact(output);
   stdout.write(`${JSON.stringify(output)}\n`);
@@ -1366,6 +1545,11 @@ async function runObserve({ runDir, stdout }) {
 }
 
 async function runStatus({ runDir, stdout }) {
+  if ((await inspectRunMode(runDir)).mode === 'pull') {
+    const output = await withRuntimeDriverProjection(await statusPullRun(runDir), runDir);
+    stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+  }
   const { events, meta, compileArtifact, managed } = await readRunStore(runDir);
   const chain = verifyRunEventChain({ events });
   if (!chain.valid) {
@@ -1386,6 +1570,7 @@ async function runStatus({ runDir, stdout }) {
     freeze_active: state.freeze !== null,
     closed: state.closed,
     event_count: events.length,
+    ...await runtimeDriverProjection(runDir),
   };
   if (managed !== null) {
     output.schema = 'lattice.managed_run_status.v1';
@@ -1425,6 +1610,14 @@ async function runList({ cwd, stdout }) {
       throw new CliContractError('INVALID_RUN_STORE', `不正なrun store entry: ${entry.name}`);
     }
     const runDir = path.join(root, entry.name);
+    const mode = await inspectRunMode(runDir);
+    if (mode.mode === 'pull') {
+      const pull = await listPullRunEntry(runDir);
+      if (!pull.closed) activeRuns.push({
+        ...pull.entry, run_ref: `.lattice/runs/${entry.name}`,
+      });
+      continue;
+    }
     const { events, meta, request } = await readRunStore(runDir);
     requireValidEventChain(events);
     if (!projectRuntimeState({ events }).closed) {
@@ -1457,8 +1650,9 @@ async function runResume({ runDir, repoRoot, stdout }) {
     throw new CliContractError('RUN_CLOSED', 'closed runはresumeできない');
   }
   await resolveRepoBinding(repoRoot, request);
-  // managed write gateの完全検証とdispatchはsupervisorだけが所有する。read-only
-  // resumeがCLIからleaseを再認可しないよう、managed runでは常に空frontierを返す。
+  // managed write gateの完全検証とdispatch・長寿命workerの観測継続はsupervisorだけが
+  // 所有する。read-only resumeがCLIからleaseを再認可しないよう、managed runでは
+  // 常に空frontierを返し、生きたsupervisorが更新するstoreの現在地だけを返す。
   const managedFrozen = managed === null ? false : await isManagedRunFrozen(runDir, events);
   const frontier = managedFrozen
     ? { dispatchable: [] }
@@ -1478,7 +1672,140 @@ async function runResume({ runDir, repoRoot, stdout }) {
   return 0;
 }
 
+/**
+ * accepted receiptが束縛したworktree HEADの、remote既定branchへの着地状態を投影する。
+ *
+ * receipt本体はhead_shaを持たない。裁定時にexact bindされたcheckpoint_digestから、
+ * 同じTODOのcheckpoint_observed.diff.head_shaへ辿る。git refsとrun storeを読むだけで、
+ * branchもevent列も動かさない。未着地・upstream無しは判断結果であり失敗ではない。
+ */
+async function buildRunLandingReport({ runDir, repoRoot, events: providedEvents = null,
+  runId: providedRunId = null }) {
+  let events = providedEvents;
+  let runId = providedRunId;
+  if (events === null || runId === null) {
+    const stored = await readRunStore(runDir);
+    events = stored.events;
+    runId = stored.meta.run_id;
+  }
+  requireValidEventChain(events);
+  const state = projectRuntimeState({ events });
+
+  const push = await runGit(['rev-parse', '--symbolic-full-name', '@{push}'], repoRoot);
+  let pushState = 'no_upstream';
+  let pushRef = null;
+  let unpushedCommits = null;
+  let remoteName = null;
+  if (push.code === 0 && push.stdout.trim().length > 0) {
+    pushRef = push.stdout.trim();
+    const remoteMatch = /^refs\/remotes\/([^/]+)\/.+$/u.exec(pushRef);
+    remoteName = remoteMatch?.[1] ?? null;
+    const count = await runGit(['rev-list', '--count', `${pushRef}..HEAD`], repoRoot);
+    if (count.code !== 0 || !/^\d+$/u.test(count.stdout.trim())) {
+      throw new CliContractError('LANDING_GIT_UNRESOLVED',
+        `push差分を読めない: ${count.stderr.trim() || count.stdout.trim()}`);
+    }
+    pushState = 'tracked';
+    unpushedCommits = Number(count.stdout.trim());
+  }
+
+  if (remoteName === null) {
+    const remotes = await runGit(['remote'], repoRoot);
+    if (remotes.code !== 0) {
+      throw new CliContractError('LANDING_GIT_UNRESOLVED',
+        `remote一覧を読めない: ${remotes.stderr.trim()}`);
+    }
+    const names = remotes.stdout.split('\n').map((name) => name.trim()).filter(Boolean);
+    if (names.length === 1) [remoteName] = names;
+  }
+  let defaultBranchState = 'unresolved';
+  let defaultBranchRef = null;
+  if (remoteName !== null) {
+    const symbolic = await runGit(
+      ['symbolic-ref', '--quiet', `refs/remotes/${remoteName}/HEAD`], repoRoot,
+    );
+    const candidate = symbolic.stdout.trim();
+    if (symbolic.code === 0
+      && candidate.startsWith(`refs/remotes/${remoteName}/`)
+      && candidate !== `refs/remotes/${remoteName}/HEAD`) {
+      defaultBranchState = 'resolved';
+      defaultBranchRef = candidate;
+    }
+  }
+
+  const acceptedReceipts = [];
+  const accepted = state.receipts
+    .filter((receipt) => receipt.accepted_sequence !== null)
+    .sort((left, right) => left.todo_id.localeCompare(right.todo_id)
+      || left.receipt_id.localeCompare(right.receipt_id));
+  for (const receipt of accepted) {
+    const checkpointDigest = receipt.payload?.checkpoint_digest;
+    const checkpoint = state.checkpoints.findLast((entry) => (
+      entry.todo_id === receipt.todo_id
+      && entry.sequence < receipt.accepted_sequence
+      && entry.payload?.checkpoint_digest === checkpointDigest
+    ));
+    const candidateHead = checkpoint?.payload?.diff?.head_sha;
+    const headSha = typeof candidateHead === 'string' && /^[0-9a-f]{40}$/u.test(candidateHead)
+      ? candidateHead : null;
+    let landingState = 'head_unavailable';
+    let landed = false;
+    if (headSha !== null && defaultBranchRef === null) {
+      landingState = 'default_branch_unresolved';
+    } else if (headSha !== null) {
+      const ancestry = await runGit(
+        ['merge-base', '--is-ancestor', headSha, defaultBranchRef], repoRoot,
+      );
+      if (ancestry.code === 0) {
+        landingState = 'landed';
+        landed = true;
+      } else if (ancestry.code === 1) {
+        landingState = 'not_landed';
+      } else {
+        throw new CliContractError('LANDING_GIT_UNRESOLVED',
+          `receipt HEADの祖先性を読めない: ${ancestry.stderr.trim()}`);
+      }
+    }
+    acceptedReceipts.push({
+      todo_id: receipt.todo_id,
+      receipt_id: receipt.receipt_id,
+      head_sha: headSha,
+      landing_state: landingState,
+      landed,
+    });
+  }
+
+  const output = {
+    schema: 'lattice.run_landing_report.v1',
+    run_id: runId,
+    landed: acceptedReceipts.length > 0 && acceptedReceipts.every((receipt) => receipt.landed),
+    accepted_receipts: acceptedReceipts,
+    repository: {
+      default_branch_state: defaultBranchState,
+      default_branch_ref: defaultBranchRef,
+      push_state: pushState,
+      push_ref: pushRef,
+      unpushed_commits: unpushedCommits,
+    },
+  };
+  output.result_digest = digestArtifact(output);
+  return output;
+}
+
+async function runLanding({ runDir, repoRoot, stdout }) {
+  const output = (await inspectRunMode(runDir)).mode === 'pull'
+    ? await landingPullRun({ runDir, repoRoot })
+    : await buildRunLandingReport({ runDir, repoRoot });
+  stdout.write(`${JSON.stringify(output)}\n`);
+  return 0;
+}
+
 async function runClose({ runDir, repoRoot, stdout, requestId = null }) {
+  if ((await inspectRunMode(runDir)).mode === 'pull') {
+    const output = await closePullRun({ runDir, repoRoot });
+    stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+  }
   return withLifecycleLock(runDir, async () => {
     const { events, meta, compileArtifact, request, managed } = await readRunStore(runDir);
     requireValidEventChain(events);
@@ -1489,7 +1816,6 @@ async function runClose({ runDir, repoRoot, stdout, requestId = null }) {
     if (alreadyClosed && existingClose?.payload?.outcome === 'abandoned') {
       throw new CliContractError('RUN_ABANDONED', 'abandoned runは正常closeへ変更できない');
     }
-    await resolveRepoBinding(repoRoot, request);
     if (!alreadyClosed) {
       const closed = closeRunIfComplete({
         runId: meta.run_id,
@@ -1521,6 +1847,9 @@ async function runClose({ runDir, repoRoot, stdout, requestId = null }) {
       already_closed: alreadyClosed,
       event_count: next.length,
       events_digest: digestArtifact(next.map(({ event_digest: digest }) => digest)),
+      landing: await buildRunLandingReport({
+        runDir, repoRoot, events: next, runId: meta.run_id,
+      }),
     };
     output.result_digest = digestArtifact(output);
     stdout.write(`${JSON.stringify(output)}\n`);
@@ -1909,7 +2238,7 @@ async function runActivate({ runDir, runRef, repoRoot, stdout, requestId = null
   let ambiguous = false;
   for (let attempt = 0; attempt < 100; attempt += 1) {
     try {
-      response = await sendRuntimeActivationRequest({
+      response = await sendRuntimeActivationRequestUntilSettled({
         socketPath: launched.socketPath, request, expectedPid: launched.pid,
         expectedProcessStartIdentity: launched.processStartIdentity,
       });
@@ -2294,12 +2623,13 @@ export async function runManagedSupervisorDaemon({
 
   const escalateTerminalConflict = async ({ finding, checkpointDigest }) => {
     const activeEpoch = await readCommittedEpochStore(runDir);
+    const resourceFinding = finding.kind === 'observed_line_change';
     const candidate = {
       schema: 'lattice.runtime_finding_candidate.v1',
       proposed_kind: finding.kind,
       todo_ids: [...finding.todo_ids].sort(),
-      path: finding.path,
-      resource_id: null,
+      path: resourceFinding ? null : finding.path,
+      resource_id: resourceFinding ? finding.resource_id : null,
       evidence_digests: [checkpointDigest],
       candidate_digest: '',
     };
@@ -2457,7 +2787,7 @@ export async function runManagedSupervisorDaemon({
         for (const extra of additionalActivations) {
           await extra.registerWithManagedSupervisor(managedSupervisor);
         }
-        if (!restarting && isDistributedScriptedControllerActivation(activation)) {
+        if (!restarting && isHostDrivenEpochActivation(activation)) {
           sentinel = createRunSentinel({
             packets: committed.bundle.executor_packets,
             onWarning: (warning) => {
@@ -2472,6 +2802,19 @@ export async function runManagedSupervisorDaemon({
               return settled;
             },
           });
+          const reportDriverState = (waitingOn) => replaceRuntimeDriverState({
+            runDir,
+            runId: request.request_id,
+            supervisorDescriptorRef: restarting
+              ? `supervisor/restart-candidates/${path.basename(candidateDir)}/descriptor.json`
+              : 'supervisor/descriptor.json',
+            supervisorDescriptorDigest: activation.supervisorDescriptor.descriptor_digest,
+            supervisorProcessStartIdentityDigest:
+              activation.supervisorDescriptor.process_start_identity.identity_digest,
+            driverState: 'driving',
+            waitingOn,
+            updatedAt: canonicalNow(),
+          });
           epochDriveActive = true;
           try {
             await driveScriptedManagedEpoch({
@@ -2487,9 +2830,23 @@ export async function runManagedSupervisorDaemon({
               preDispatchBindings,
               drainEscalations: drainPendingEscalations,
               escalateTerminalConflict,
+              reportDriverState,
             });
           } finally {
             epochDriveActive = false;
+            await replaceRuntimeDriverState({
+              runDir,
+              runId: request.request_id,
+              supervisorDescriptorRef: restarting
+                ? `supervisor/restart-candidates/${path.basename(candidateDir)}/descriptor.json`
+                : 'supervisor/descriptor.json',
+              supervisorDescriptorDigest: activation.supervisorDescriptor.descriptor_digest,
+              supervisorProcessStartIdentityDigest:
+                activation.supervisorDescriptor.process_start_identity.identity_digest,
+              driverState: 'stopped',
+              waitingOn: null,
+              updatedAt: canonicalNow(),
+            });
           }
         }
         if (restarting) {
@@ -2590,6 +2947,7 @@ export async function runManagedSupervisorDaemon({
         if (candidate.path !== null) {
           const producer = detectCheckpointFindings({ todoId: observed.subject.ref,
             checkpoint: observed.payload, packets: active.bundle.executor_packets,
+            manifests: fresh.manifests,
             runningTodoIds: projectRuntimeState({ events }).running }).findings;
           const match = producer.find((findingValue) => findingValue.kind === candidate.proposed_kind
             && findingValue.path === candidate.path
@@ -3199,7 +3557,7 @@ export async function runManagedSupervisorDaemon({
           event_digest: events.at(-1).event_digest,
         });
         if (recompileRequest.mode === 'intentional_serial'
-          && isDistributedScriptedControllerActivation(activation)) {
+          && isHostDrivenEpochActivation(activation)) {
           epochDriveActive = true;
           try {
             events = await driveScriptedManagedEpoch({
@@ -3965,6 +4323,14 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[0] === 'run' && argv[1] === 'adapter' && argv[2] === 'register'
     && argv[3] === '--schema' && argv[4] === '--json') {
     action = () => runAdapterRegisterSchema({ stdout });
+  } else if (argv.length === 9
+    && argv[0] === 'run' && argv[1] === 'request' && argv[2] === 'synthesize'
+    && argv[3] === '--witness' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--base-sha' && typeof argv[6] === 'string' && argv[6].length > 0
+    && argv[7] === '--id' && typeof argv[8] === 'string' && argv[8].length > 0) {
+    action = () => runRequestSynthesize({
+      cwd, witnessPath: argv[4], baseSha: argv[6], requestId: argv[8], stdout,
+    });
   } else if (argv.length === 5
     && argv[0] === 'run' && argv[1] === 'adapter' && argv[2] === 'register'
     && argv[3] === '--input' && typeof argv[4] === 'string' && argv[4].length > 0) {
@@ -4005,21 +4371,84 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
       cwd,
       stdout,
     });
+  } else if (argv.length === 10
+    && argv[0] === 'run' && argv[1] === 'start'
+    && argv[2] === '--selection' && argv[3] === 'pull'
+    && argv[4] === '--id' && typeof argv[5] === 'string' && argv[5].length > 0
+    && argv[6] === '--plan' && typeof argv[7] === 'string' && argv[7].length > 0
+    && argv[8] === '--equipment' && argv[9] === 'detached-worktree') {
+    action = () => runPullStart({
+      runId: argv[5], planKey: argv[7], equipment: argv[9], cwd, stdout,
+    });
+  } else if (argv.length === 6
+    && argv[0] === 'run' && argv[1] === 'intake'
+    && argv[2] === '--run' && typeof argv[3] === 'string' && argv[3].length > 0
+    && argv[4] === '--task' && typeof argv[5] === 'string' && argv[5].length > 0) {
+    action = async () => {
+      const { repoRoot, runDir } = await resolveRunStore(cwd, argv[3]);
+      const output = await intakePullTask({ repoRoot, runDir, taskId: argv[5] });
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
+  } else if (argv.length === 7
+    && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'accept'
+    && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--task' && typeof argv[6] === 'string' && argv[6].length > 0) {
+    action = async () => {
+      const { repoRoot, runDir } = await resolveRunStore(cwd, argv[4]);
+      const output = await acceptPullTask({ repoRoot, runDir, taskId: argv[6] });
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
+  } else if (argv.length === 7
+    && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'release'
+    && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--task' && typeof argv[6] === 'string' && argv[6].length > 0) {
+    action = async () => {
+      const { runDir } = await resolveRunStore(cwd, argv[4]);
+      const output = await releasePullTask({ runDir, taskId: argv[6] });
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
+  } else if (argv.length === 9
+    && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'attach'
+    && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--task' && typeof argv[6] === 'string' && argv[6].length > 0
+    && argv[7] === '--input' && typeof argv[8] === 'string' && argv[8].length > 0) {
+    action = async () => {
+      const { runDir } = await resolveRunStore(cwd, argv[4]);
+      const input = await readBoundedJson(path.resolve(cwd, argv[8]), 'pull worker attach input');
+      const output = await attachPullWorker({ runDir, taskId: argv[6], input });
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
+  } else if (argv.length === 7
+    && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'intervention'
+    && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--task' && typeof argv[6] === 'string' && argv[6].length > 0) {
+    action = async () => {
+      const { runDir } = await resolveRunStore(cwd, argv[4]);
+      const output = await interventionPullTask(runDir, argv[6]);
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
   } else if (argv.length === 4
     && argv[0] === 'run' && argv[1] === 'activate'
     && argv[2] === '--run' && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = async () => {
       const { repoRoot, runDir, runRef } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, 'activate');
       return runActivate({ runDir, runRef, repoRoot, stdout, requestId: requestIdOverride });
     };
   } else if (argv.length === 4
-    && argv[0] === 'run' && ['observe', 'status', 'resume', 'close'].includes(argv[1])
+    && argv[0] === 'run' && ['observe', 'status', 'resume', 'landing', 'close'].includes(argv[1])
     && argv[2] === '--run' && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = async () => {
       const { repoRoot, runDir } = await resolveRunStore(cwd, argv[3]);
       if (argv[1] === 'observe') return runObserve({ runDir, stdout });
       if (argv[1] === 'status') return runStatus({ runDir, stdout });
-      if (argv[1] === 'resume') return runResume({ runDir, repoRoot, stdout });
+      if (argv[1] === 'resume') {
+        if ((await inspectRunMode(runDir)).mode === 'pull') {
+          throw new PullRunError('RUN_MODE_MISMATCH', 'pull runはresumeでleaseを再認可しない');
+        }
+        return runResume({ runDir, repoRoot, stdout });
+      }
+      if (argv[1] === 'landing') return runLanding({ runDir, repoRoot, stdout });
       return runClose({ runDir, repoRoot, stdout, requestId: requestIdOverride });
     };
   } else if (argv.length === 6
@@ -4028,6 +4457,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[4] === '--reason' && typeof argv[5] === 'string') {
     action = async () => {
       const { runDir } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, 'abandon');
       return runAbandon({ runDir, runRef: argv[3], reason: argv[5], stdout,
         requestId: requestIdOverride });
     };
@@ -4037,6 +4467,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[4] === '--finding' && /^[0-9a-f]{64}$/u.test(argv[5])) {
     action = async () => {
       const { runDir, runRef } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, 'conflict');
       return runManagedControl({
         runDir, runRef, operation: 'conflict', artifactDigest: argv[5], stdout,
         requestId: requestIdOverride,
@@ -4049,6 +4480,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[7] === '--input' && typeof argv[8] === 'string' && argv[8].length > 0) {
     action = async () => {
       const { repoRoot, runDir } = await resolveRunStore(cwd, argv[4]);
+      await requireLegacyRunMode(runDir, 'seam profile');
       return runSeamProfile({ runDir, repoRoot, findingDigest: argv[6],
         inputPath: path.resolve(cwd, argv[8]), stdout });
     };
@@ -4059,6 +4491,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[7] === '--input' && typeof argv[8] === 'string' && argv[8].length > 0) {
     action = async () => {
       const { repoRoot, runDir } = await resolveRunStore(cwd, argv[4]);
+      await requireLegacyRunMode(runDir, 'seam resolve');
       return runSeamResolve({ runDir, repoRoot, findingDigest: argv[6],
         requestPath: path.resolve(cwd, argv[8]), stdout });
     };
@@ -4076,6 +4509,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[7] === '--input' && typeof argv[8] === 'string' && argv[8].length > 0) {
     action = async () => {
       const { runDir, runRef } = await resolveRunStore(cwd, argv[4]);
+      await requireLegacyRunMode(runDir, 'finding record');
       if (await readCommittedEpochStore(runDir) === null) {
         throw new CliContractError('RUN_NOT_MANAGED', 'runがmanaged storeへactivateされていない');
       }
@@ -4090,6 +4524,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[4] === '--input' && typeof argv[5] === 'string' && argv[5].length > 0) {
     action = async () => {
       const { runDir, runRef } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, 'recompile');
       if (await readCommittedEpochStore(runDir) === null) {
         throw new CliContractError('RUN_NOT_MANAGED', 'runがmanaged storeへactivateされていない');
       }
@@ -4102,6 +4537,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[2] === '--run' && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = async () => {
       const { runDir, runRef } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, argv[1]);
       return runManagedControl({
         runDir, runRef, operation: argv[1], artifactDigest: null, stdout,
         requestId: requestIdOverride,
@@ -4115,6 +4551,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     && argv[2] === '--run' && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = async () => {
       const { runDir } = await resolveRunStore(cwd, argv[3]);
+      await requireLegacyRunMode(runDir, 'event verify');
       return eventVerify({ runDir, stdout });
     };
   }
@@ -4129,7 +4566,7 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
       return typedFailure(stderr, 'CONTRACT_VIOLATION', error.message);
     }
     if (error instanceof RuntimeEpochStoreError) {
-      return typedFailure(stderr, error.code, error.message);
+      return typedFailure(stderr, error.code, error.message, error.detail);
     }
     if (error instanceof AdapterRegistryError) {
       return typedFailure(stderr, error.code, error.message, error.detail);
@@ -4137,6 +4574,11 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
     if (error instanceof ManagedRuntimeError) {
       return typedFailure(stderr, error.code, error.message);
     }
+    if (error instanceof PullRunError || error instanceof TodoStoreError
+      || error instanceof RuntimeDriverStateError
+      || error instanceof RuntimeLifecycleLockError) {
+      return typedFailure(stderr, error.code, error.message, error.detail);
+    }
     throw error;
   }
 }