@quolu/lattice 0.50.1 → 0.52.0

package/src/runtime-engine.mjs

@@ -488,10 +488,10 @@ export async function observeExecutor(options = {}) {
  * findingがあればconflict_found＋intake_frozenを追記する（RC3-F検出、裁定はRC3-G）。
  */
 export function classifyCheckpointObservation(options = {}) {
-  if (!exactRecord(options, ['runId', 'plan', 'events', 'packets', 'todoId', 'detect', 'recordedAt'])) {
+  if (!exactRecord(options, ['runId', 'plan', 'events', 'packets', 'manifests', 'todoId', 'detect', 'recordedAt'])) {
     fail('classifyCheckpointObservation optionsがexact shapeでない');
   }
-  const { runId, plan, events, packets, todoId, detect, recordedAt } = options;
+  const { runId, plan, events, packets, manifests, todoId, detect, recordedAt } = options;
   if (typeof detect !== 'function') fail('detect関数が必要');
   const state = projectRuntimeState({ events });
   const checkpoints = state.checkpoints.filter((entry) => entry.todo_id === todoId);
@@ -501,21 +501,47 @@ export function classifyCheckpointObservation(options = {}) {
     todoId,
     checkpoint,
     packets,
+    manifests,
     runningTodoIds: state.running,
   });
   if (!Array.isArray(detectedFindings)) fail('detectがfindings配列を返さない');
   const observations = detectedFindings
     .filter((finding) => finding.kind === 'undeclared_write' && finding.todo_ids?.length === 1)
     .map((finding) => ({ ...finding, kind: 'prediction_excess' }));
+  const scopeExpanded = observations.length === 0 ? [] : (() => {
+    const manifest = manifests[todoId];
+    const predictedPaths = sortedText(new Set(manifest?.writes ?? []));
+    const addedPaths = sortedText(new Set(observations.map((observation) => {
+      const location = observation.path ?? observation.resource_id;
+      if (typeof location !== 'string' || location.length === 0) {
+        fail('prediction_excessにpathまたはresource_idがない');
+      }
+      return location;
+    })));
+    const currentPaths = new Set([...predictedPaths, ...addedPaths]);
+    const incoming = (plan.precedence ?? [])
+      .filter((edge) => edge.to_todo_id === todoId)
+      .length;
+    return [{
+      task_id: todoId,
+      compared_witness_digest: null,
+      first_seen_path_count: predictedPaths.length,
+      path_count: currentPaths.size,
+      added_paths: addedPaths,
+      removed_paths: [],
+      growth_events: 1,
+      gate_shape: incoming >= 2,
+    }];
+  })();
   const findings = detectedFindings.filter((finding) => !(
     finding.kind === 'undeclared_write' && finding.todo_ids?.length === 1
   ));
-  // 再分類のidempotence: 既に保存済みのfinding（kind＋todo_ids＋path）は再記録しない。
+  // 再分類のidempotence: path/resourceのどちらであっても、同じfindingだけ再記録しない。
   const recordedKeys = new Set(state.conflicts.map((conflict) => (
-    `${conflict.kind}|${[...(conflict.todo_ids ?? [])].sort().join(',')}|${conflict.path ?? ''}`
+    `${conflict.kind}|${[...(conflict.todo_ids ?? [])].sort().join(',')}|${conflict.path ?? ''}|${conflict.resource_id ?? ''}`
   )));
   const freshFindings = findings.filter((finding) => !recordedKeys.has(
-    `${finding.kind}|${[...(finding.todo_ids ?? [])].sort().join(',')}|${finding.path ?? ''}`,
+    `${finding.kind}|${[...(finding.todo_ids ?? [])].sort().join(',')}|${finding.path ?? ''}|${finding.resource_id ?? ''}`,
   ));
   let next = [...events];
   for (const finding of freshFindings) {
@@ -543,7 +569,12 @@ export function classifyCheckpointObservation(options = {}) {
       recordedAt,
     }));
   }
-  return { events: next, findings: freshFindings, observations };
+  return {
+    events: next,
+    findings: freshFindings,
+    observations,
+    scope_expanded: scopeExpanded,
+  };
 }
 
 const RECEIPT_BINDING_FIELDS = Object.freeze([

package/src/runtime-front-end.mjs

@@ -7,6 +7,7 @@ import { compileSchedulabilityGraphV2 } from './schedulability-compiler-v2.mjs';
 import { verifySchedulabilityPlanV2 } from './schedulability-verifier-v2.mjs';
 import {
   BOUNDARY_MANIFEST_SCHEMA,
+  RUN_REQUEST_PREDICTION_SCHEMA,
   RUN_REQUEST_SCHEMA,
   SENSOR_EXPECT_KINDS,
   SENSOR_QUERY_OPERATIONS,
@@ -448,7 +449,8 @@ export function compileRuntimePlanV1(options = {}) {
   const outcomeByQueryId = normalizeEvidence(sensorEvidence, queryById);
 
   const todoIds = request.todos.map((todo) => todo.todo_id);
-  const predictionsOnly = request.schema === RUN_REQUEST_SCHEMA;
+  const predictionsOnly = [RUN_REQUEST_SCHEMA, RUN_REQUEST_PREDICTION_SCHEMA]
+    .includes(request.schema);
 
   // witnessの束縛を解決する。query set外の参照と、expect↔query targetの
   // 不一致（別targetのreceiptへの再ラベル）はQUERY_DRIFT。
@@ -642,6 +644,32 @@ export function compileRuntimePlanV1(options = {}) {
     }
   }
 
+  // 同じ意味的な線はpathが交差しなくても共有契約である。reads同士だけは並列可とし、
+  // 少なくとも片方がwritesのpairを独立したresourceへする。1 lineを全taskの単一resourceへ
+  // 丸めるとreads×readsまでconflictになるため、pair単位で実体化する。
+  const lineGroups = new Map();
+  for (const todoId of todoIds) {
+    for (const line of request.manual_witness[todoId].lines ?? []) {
+      if (!lineGroups.has(line.line_id)) {
+        lineGroups.set(line.line_id, { reads: new Set(), writes: new Set() });
+      }
+      lineGroups.get(line.line_id)[line.role].add(todoId);
+    }
+  }
+  const lineConflictGroups = [];
+  for (const [lineId, roles] of [...lineGroups.entries()]
+    .sort((left, right) => compareText(left[0], right[0]))) {
+    const participants = [...new Set([...roles.reads, ...roles.writes])].sort(compareText);
+    for (let left = 0; left < participants.length; left += 1) {
+      for (let right = left + 1; right < participants.length; right += 1) {
+        const leftId = participants[left];
+        const rightId = participants[right];
+        if (!roles.writes.has(leftId) && !roles.writes.has(rightId)) continue;
+        lineConflictGroups.push({ lineId, todoIds: [leftId, rightId] });
+      }
+    }
+  }
+
   // state_effect宣言のないbare shared resourceは、方向不明の共有資源として
   // conflict化する（安全と推測しない）。
   const bareResourceGroups = new Map();
@@ -732,6 +760,15 @@ export function compileRuntimePlanV1(options = {}) {
       provenance: [manualProvenance(request)],
     });
   }
+  for (const group of lineConflictGroups) {
+    resources.push({
+      resource_id: `line-${sha16(group.lineId)}-${sha16(group.todoIds.join('\0'))}`,
+      kind: 'line',
+      target: group.lineId,
+      todo_ids: group.todoIds,
+      provenance: [manualProvenance(request)],
+    });
+  }
   for (const [index, group] of predictedWriteGroups.entries()) {
     resources.push({
       resource_id: `predicted-ww-${sha16(`${group.target}:${index}`)}`,
@@ -831,6 +868,7 @@ export function compileRuntimePlanV1(options = {}) {
       state_effects: witness.state_effects,
       unknowns: witness.unknowns,
       affected_tests: witness.affected_tests,
+      ...(witness.lines === undefined ? {} : { lines: witness.lines }),
       graph_evidence: bindingsByTodo.get(todoId).map((binding) => {
         const outcome = outcomeByQueryId.get(binding.query_id);
         return {

package/src/runtime-managed-supervisor.mjs

@@ -19,6 +19,7 @@ import {
   validateAdapterLaunchDescriptor,
   validateAdapterRegistry,
   validateControllerDescriptor,
+  validateControllerError,
   validateControllerHeartbeat,
   validateControllerRegistration,
   validateControllerResponse,
@@ -308,7 +309,9 @@ export class RuntimeManagedSupervisor {
     if (this.#controllers.has(descriptor.controller_id)
       || this.#registrationToController.has(registration.registration_digest)) fail('ADAPTER_CONTROLLER_UNAVAILABLE', 'controller二重登録');
     const now = this.#clock();
-    const record = { descriptor: structuredClone(descriptor), registration: structuredClone(registration), transport, lastHeartbeat: now, lastHeartbeatSequence: 0, connected: true, revoked: false };
+    const record = { descriptor: structuredClone(descriptor), registration: structuredClone(registration),
+      transport, lastHeartbeat: now, lastHeartbeatSequence: 0,
+      lastRecordedLeaseSetDigest: null, connected: true, revoked: false };
     this.#controllers.set(descriptor.controller_id, record);
     this.#registrationToController.set(registration.registration_digest, descriptor.controller_id);
     await this.#append('controller_registered', { controller_id: descriptor.controller_id, registration_digest: registration.registration_digest });
@@ -326,7 +329,13 @@ export class RuntimeManagedSupervisor {
     // livenessだけを担い、lease集合はwrite認可時のcentral gate full-chainで照合する。
     record.lastHeartbeat = this.#clock();
     record.lastHeartbeatSequence = sequence;
-    await this.#append('controller_heartbeat', { controller_id: controllerId, registration_digest: registrationDigest, sequence, lease_set_digest: leaseSetDigest });
+    // heartbeatはlivenessの更新であり、同じlease集合のtickを全件journalへ積む必要はない。
+    // 初回とlease集合の変化だけを耐久記録し、壁時計に比例するjournal成長を止める。
+    if (record.lastRecordedLeaseSetDigest !== leaseSetDigest) {
+      await this.#append('controller_heartbeat', { controller_id: controllerId,
+        registration_digest: registrationDigest, sequence, lease_set_digest: leaseSetDigest });
+      record.lastRecordedLeaseSetDigest = leaseSetDigest;
+    }
   }
 
   async disconnect(controllerId) {
@@ -357,9 +366,14 @@ export class RuntimeManagedSupervisor {
     if (!validateControllerResponse(operation, response, request.request_id)) {
       await this.#failClosed(record, 'ADAPTER_CONTROLLER_UNAVAILABLE', `${operation} response不正`);
     }
-    await this.#append(operation === 'dispatch' ? 'dispatch_routed' : 'observation_routed', {
-      controller_id: controllerId, request_digest: request.request_digest, response_digest: response.response_digest,
-    });
+    // running pollは状態遷移ではない。全tickを耐久化すると長寿命workerほどcontrol journalを
+    // 膨らませ、artifact document上限でsupervisor自身を落とす。dispatchと非running観測だけを残す。
+    if (operation === 'dispatch' || response.observation?.state !== 'running') {
+      await this.#append(operation === 'dispatch' ? 'dispatch_routed' : 'observation_routed', {
+        controller_id: controllerId, request_digest: request.request_digest,
+        response_digest: response.response_digest,
+      });
+    }
     return structuredClone(response);
   }
 
@@ -774,7 +788,15 @@ async function exchangeControllerHandshake({ socketPath, runId, supervisorSessio
   });
 }
 
-function createControllerSocketTransport(socketPath, timeoutMs) {
+function createControllerSocketTransport(
+  socketPath,
+  timeoutMs,
+  dispatchLivenessTimeoutMs = timeoutMs,
+) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1
+    || !Number.isSafeInteger(dispatchLivenessTimeoutMs) || dispatchLivenessTimeoutMs < 1) {
+    fail('SUPERVISOR_CONFIGURATION_INVALID', 'controller transport timeout不正');
+  }
   const socket = net.createConnection({ path: socketPath });
   const pending = new Map();
   let buffer = '';
@@ -786,6 +808,22 @@ function createControllerSocketTransport(socketPath, timeoutMs) {
     socket.once('error', reject);
   });
   socket.setEncoding('utf8');
+  const armRequestTimer = (requestId, entry) => {
+    clearTimeout(entry.timer);
+    const waitMs = entry.operation === 'dispatch' ? dispatchLivenessTimeoutMs : timeoutMs;
+    entry.timer = setTimeout(() => {
+      pending.delete(requestId);
+      entry.reject(new ManagedRuntimeError(
+        'ADAPTER_CONTROLLER_UNAVAILABLE',
+        `${entry.operation} timeout`,
+      ));
+    }, waitMs);
+  };
+  const refreshDispatchLiveness = () => {
+    for (const [requestId, entry] of pending.entries()) {
+      if (entry.operation === 'dispatch') armRequestTimer(requestId, entry);
+    }
+  };
   const failPending = (detail) => {
     connected = false;
     for (const entry of pending.values()) { clearTimeout(entry.timer); entry.reject(new ManagedRuntimeError('ADAPTER_CONTROLLER_UNAVAILABLE', detail)); }
@@ -801,15 +839,29 @@ function createControllerSocketTransport(socketPath, timeoutMs) {
       const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1);
       let document;
       try { document = JSON.parse(line); } catch { failPending('controller document JSON不正'); socket.destroy(); return; }
-      if (document?.schema === 'lattice.scripted_adapter_error.v1'
-        && typeof document.code === 'string'
-        && typeof document.message === 'string') {
-        failPending(`${document.code}: ${document.message}`);
+      const errorEntry = pending.get(document?.request_id);
+      if (errorEntry && validateControllerError(document, document.request_id)) {
+        pending.delete(document.request_id);
+        clearTimeout(errorEntry.timer);
+        const detail = Object.keys(document.detail).length === 0
+          ? ''
+          : `: ${canonicalizeArtifact(document.detail)}`;
+        errorEntry.reject(new ManagedRuntimeError(
+          'ADAPTER_CONTROLLER_UNAVAILABLE',
+          `${document.code}: ${document.message}${detail}`,
+        ));
         socket.destroy();
         return;
       }
       if (validateControllerHeartbeat(document)) {
-        Promise.resolve(heartbeatHandler?.(structuredClone(document))).catch(() => socket.destroy());
+        if (heartbeatHandler === null) {
+          socket.destroy();
+          continue;
+        }
+        Promise.resolve()
+          .then(() => heartbeatHandler(structuredClone(document)))
+          .then(() => refreshDispatchLiveness())
+          .catch(() => socket.destroy());
         continue;
       }
       const entry = pending.get(document.request_id);
@@ -826,14 +878,19 @@ function createControllerSocketTransport(socketPath, timeoutMs) {
       await ready;
       if (!connected) fail('ADAPTER_CONTROLLER_UNAVAILABLE', 'controller persistent socket不達');
       return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => { pending.delete(request.request_id); reject(new ManagedRuntimeError('ADAPTER_CONTROLLER_UNAVAILABLE', `${operation} timeout`)); }, timeoutMs);
-        pending.set(request.request_id, { operation, resolve, reject, timer });
+        const entry = { operation, resolve, reject, timer: null };
+        pending.set(request.request_id, entry);
+        armRequestTimer(request.request_id, entry);
         socket.write(`${canonicalizeArtifact(request)}\n`);
       });
     },
   });
 }
 
+export const runtimeManagedSupervisorInternal = Object.freeze({
+  createControllerSocketTransport,
+});
+
 /**
  * durable registryをpreflightし、実controller hostとのnonce challenge後にだけactivation証拠を返す。
  * callerは成功返却前にrun storeへ何もpublishしてはならない。
@@ -987,7 +1044,11 @@ async function activateManagedSupervisorController({ repoRoot, runDir, runId, ad
     supervisorDescriptor.descriptor_digest = selfDigest(supervisorDescriptor, 'descriptor_digest');
     const activationControlEvent = { schema: 'lattice.runtime_control_event.v1', run_id: runId, sequence: 1, previous_digest: null, kind: 'supervisor_activated', session_nonce_digest: sessionNonceDigest, payload: { supervisor_descriptor_digest: supervisorDescriptor.descriptor_digest, controller_descriptor_digest: controllerDescriptor.descriptor_digest, registration_digest: registration.registration_digest }, recorded_at: supervisorDescriptor.activated_at, event_digest: '' };
     activationControlEvent.event_digest = selfDigest(activationControlEvent, 'event_digest');
-    const controllerTransport = createControllerSocketTransport(handshakeConnectPath, timeoutMs);
+    const controllerTransport = createControllerSocketTransport(
+      handshakeConnectPath,
+      timeoutMs,
+      controllerDescriptor.heartbeat.ttl_ms,
+    );
     let disposed = false;
     const disposeController = async () => {
       if (disposed) return;
@@ -1178,6 +1239,11 @@ export async function sendRuntimeActivationRequest({ socketPath, request, expect
   });
 }
 
+/** 外部workerの完了を含む初回activationは、同じbootstrap接続で最終結果まで待つ。 */
+export function sendRuntimeActivationRequestUntilSettled(args) {
+  return sendRuntimeActivationRequest({ ...args, timeoutMs: 0 });
+}
+
 /** stopped/crashed supervisorの同一run明示再起動前処理。live/foreign socketは削除しない。 */
 export async function prepareManagedSupervisorRestart({ runDir }) {
   if (!path.isAbsolute(runDir) || await realpath(runDir) !== runDir) fail('RUN_NOT_MANAGED', 'restart runDir不正');

package/src/runtime-multi-epoch-store.mjs

@@ -28,17 +28,51 @@ import {
 const HEX_DIGEST = /^[0-9a-f]{64}$/u;
 const EPOCH_DIRECTORY = /^\d{8}$/u;
 const TRANSACTION_ID = /^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$/u;
+const RUNTIME_UPGRADE_COMMAND = 'npm install -g @quolu/lattice@latest --prefer-online';
 
 export class RuntimeEpochStoreError extends Error {
-  constructor(code, message) {
+  constructor(code, message, detail) {
     super(message);
     this.name = 'RuntimeEpochStoreError';
     this.code = code;
+    this.detail = detail;
   }
 }
 
-function fail(code, message) {
-  throw new RuntimeEpochStoreError(code, message);
+function fail(code, message, detail) {
+  throw new RuntimeEpochStoreError(code, message, detail);
+}
+
+function schemaGeneration(schema, family) {
+  if (typeof schema !== 'string') return null;
+  const prefix = `${family}.v`;
+  if (!schema.startsWith(prefix)) return null;
+  const generationText = schema.slice(prefix.length);
+  if (!/^[1-9][0-9]*$/u.test(generationText)) return null;
+  const generation = Number.parseInt(generationText, 10);
+  return Number.isSafeInteger(generation) ? generation : null;
+}
+
+export function rejectFutureRuntimeStoreSchema(schema, { artifact, family, expectedVersion }) {
+  const observedVersion = schemaGeneration(schema, family);
+  if (observedVersion === null || observedVersion <= expectedVersion) return;
+  const expectedSchema = `${family}.v${expectedVersion}`;
+  fail(
+    'UNSUPPORTED_RUNTIME_STORE_VERSION',
+    `${artifact}のschema ${schema} はこのLatticeが対応する ${expectedSchema} より新しい`,
+    {
+      artifact,
+      observed_schema: schema,
+      expected_schema: expectedSchema,
+      observed_version: observedVersion,
+      expected_version: expectedVersion,
+      upgrade_command: RUNTIME_UPGRADE_COMMAND,
+    },
+  );
+}
+
+function rejectFutureArtifact(value, options) {
+  rejectFutureRuntimeStoreSchema(value?.schema, options);
 }
 
 function plainRecord(value) {
@@ -245,6 +279,7 @@ function validateLegacyInputs({ request, compileArtifact, legacyMeta }) {
 }
 
 function normalizeActivationMeta(meta, request, compileArtifact) {
+  rejectFutureArtifact(meta, { artifact: 'run_meta', family: 'lattice.run_meta', expectedVersion: 2 });
   if (meta?.schema === 'lattice.run_meta.v1') return meta;
   if (exactRecord(meta, [
     'schema', 'run_id', 'executor_adapter', 'run_event_schema', 'control_event_schema',
@@ -348,33 +383,51 @@ export function validatePhaseRevisionCommitReceipt(value) {
     && selfDigestValid(value, 'receipt_digest');
 }
 
-function validateRunMetaV2(meta, createdBundle) {
+function validateRunMetaV2Envelope(meta) {
   return exactRecord(meta, [
     'schema', 'run_id', 'executor_adapter', 'run_event_schema', 'control_event_schema',
     'epoch_bundle_schema', 'created_plan_digest', 'meta_digest',
   ]) && meta.schema === 'lattice.run_meta.v2'
+    && typeof meta.run_id === 'string'
+    && typeof meta.executor_adapter === 'string'
+    && typeof meta.run_event_schema === 'string'
+    && typeof meta.control_event_schema === 'string'
+    && typeof meta.epoch_bundle_schema === 'string'
+    && HEX_DIGEST.test(meta.created_plan_digest ?? '')
+    && selfDigestValid(meta, 'meta_digest');
+}
+
+function validateRunMetaV2(meta, createdBundle) {
+  return validateRunMetaV2Envelope(meta)
     && meta.run_id === createdBundle.run_id
     && meta.run_event_schema === 'lattice.run_event.v1'
     && meta.control_event_schema === 'lattice.runtime_control_event.v1'
     && meta.epoch_bundle_schema === 'lattice.runtime_epoch_bundle.v1'
-    && meta.created_plan_digest === createdBundle.plan.plan_digest
-    && selfDigestValid(meta, 'meta_digest');
+    && meta.created_plan_digest === createdBundle.plan.plan_digest;
 }
 
-function validateCommittedPointer(pointer, bundle) {
+function validateCommittedPointerEnvelope(pointer) {
   return exactRecord(pointer, [
     'schema', 'run_id', 'plan_epoch', 'plan_ref', 'bundle_digest',
     'activation_run_event_digest', 'activation_control_event_digest', 'pointer_digest',
   ]) && pointer.schema === 'lattice.committed_epoch_pointer.v1'
-    && pointer.run_id === bundle.run_id
-    && pointer.plan_epoch === bundle.plan_epoch
-    && pointer.plan_ref === bundle.plan.plan_ref
-    && pointer.bundle_digest === bundle.bundle_digest
+    && typeof pointer.run_id === 'string'
+    && Number.isSafeInteger(pointer.plan_epoch) && pointer.plan_epoch >= 1
+    && typeof pointer.plan_ref === 'string'
+    && HEX_DIGEST.test(pointer.bundle_digest ?? '')
     && HEX_DIGEST.test(pointer.activation_run_event_digest ?? '')
     && HEX_DIGEST.test(pointer.activation_control_event_digest ?? '')
     && selfDigestValid(pointer, 'pointer_digest');
 }
 
+function validateCommittedPointer(pointer, bundle) {
+  return validateCommittedPointerEnvelope(pointer)
+    && pointer.run_id === bundle.run_id
+    && pointer.plan_epoch === bundle.plan_epoch
+    && pointer.plan_ref === bundle.plan.plan_ref
+    && pointer.bundle_digest === bundle.bundle_digest;
+}
+
 /** v1 aliasをbyte不変のままepoch 1へ昇格し、pointerを最後にcommitする。 */
 export async function activateEpochOneStore({
   runDir, request, compileArtifact, legacyMeta, activationRunEventDigest, activationControlEventDigest,
@@ -462,17 +515,35 @@ export async function activateEpochOneStore({
 /** pointerを正本としてactive bundleだけを読む。directory最大値へfallbackしない。 */
 export async function readCommittedEpochStore(runDir) {
   const meta = await readRegularJson(path.join(runDir, 'run-meta.json'), 'run meta');
+  rejectFutureArtifact(meta, { artifact: 'run_meta', family: 'lattice.run_meta', expectedVersion: 2 });
   if (meta?.schema !== 'lattice.run_meta.v2') return null;
-  const pointer = await readRegularJson(path.join(runDir, 'committed-epoch.json'), 'committed epoch pointer');
-  if (!Number.isInteger(pointer?.plan_epoch) || pointer.plan_epoch < 1) {
-    fail('INVALID_RUN_STORE', 'committed epoch pointerのepochが不正');
+  if (!validateRunMetaV2Envelope(meta)) fail('INVALID_RUN_STORE', 'run meta envelopeが不正');
+  rejectFutureRuntimeStoreSchema(meta.run_event_schema,
+    { artifact: 'run_event', family: 'lattice.run_event', expectedVersion: 1 });
+  rejectFutureRuntimeStoreSchema(meta.control_event_schema,
+    { artifact: 'runtime_control_event', family: 'lattice.runtime_control_event', expectedVersion: 1 });
+  rejectFutureRuntimeStoreSchema(meta.epoch_bundle_schema,
+    { artifact: 'runtime_epoch_bundle', family: 'lattice.runtime_epoch_bundle', expectedVersion: 1 });
+  if (meta.run_event_schema !== 'lattice.run_event.v1'
+    || meta.control_event_schema !== 'lattice.runtime_control_event.v1'
+    || meta.epoch_bundle_schema !== 'lattice.runtime_epoch_bundle.v1') {
+    fail('INVALID_RUN_STORE', 'run meta schema bindingが不正');
   }
+  const pointer = await readRegularJson(path.join(runDir, 'committed-epoch.json'), 'committed epoch pointer');
+  rejectFutureArtifact(pointer, {
+    artifact: 'committed_epoch_pointer', family: 'lattice.committed_epoch_pointer', expectedVersion: 1,
+  });
+  if (!validateCommittedPointerEnvelope(pointer)) fail('INVALID_RUN_STORE', 'committed epoch pointer envelopeが不正');
   const epochName = String(pointer.plan_epoch).padStart(8, '0');
   if (!EPOCH_DIRECTORY.test(epochName)) fail('INVALID_RUN_STORE', 'epoch directory名が不正');
   const bundle = await readRegularJson(path.join(runDir, 'epochs', epochName, 'epoch-bundle.json'), 'epoch bundle');
+  rejectFutureArtifact(bundle,
+    { artifact: 'runtime_epoch_bundle', family: 'lattice.runtime_epoch_bundle', expectedVersion: 1 });
   const createdBundle = pointer.plan_epoch === 1
     ? bundle
     : await readRegularJson(path.join(runDir, 'epochs', '00000001', 'epoch-bundle.json'), 'created epoch bundle');
+  rejectFutureArtifact(createdBundle,
+    { artifact: 'runtime_epoch_bundle', family: 'lattice.runtime_epoch_bundle', expectedVersion: 1 });
   if (!validateRuntimeEpochBundle(bundle)
     || !validateRuntimeEpochBundle(createdBundle)
     || createdBundle.plan_epoch !== 1
@@ -485,6 +556,8 @@ export async function readCommittedEpochStore(runDir) {
     const current = epoch === pointer.plan_epoch
       ? bundle
       : await readRegularJson(path.join(runDir, 'epochs', String(epoch).padStart(8, '0'), 'epoch-bundle.json'), `epoch ${epoch} bundle`);
+    rejectFutureArtifact(current,
+      { artifact: 'runtime_epoch_bundle', family: 'lattice.runtime_epoch_bundle', expectedVersion: 1 });
     if (!validateRuntimeEpochBundle(current) || current.plan_epoch !== epoch
       || current.run_id !== meta.run_id
       || current.predecessor_bundle_digest !== previous.bundle_digest) {