@quolu/lattice 0.55.1 → 0.57.0

package/src/bridge-hub-landing.mjs

@@ -0,0 +1,223 @@
+/**
+ * Bridge hub public landing — the product face of lattice.kitepon.dev.
+ *
+ * Pure rendering only: no I/O, no clock, no store access. The hub server
+ * (`bridge-hub-server.mjs`) reads the registry, projects the public view,
+ * applies the operator's visibility file, and passes the result here.
+ *
+ * Design canon (ADR 0164): the page follows the kitepon.dev brand canon
+ * (RootSitePromotion docs/color-system.md, docs/identity-system.md) — not
+ * the loopback dashboard's look. Constraints baked in:
+ * - No arrow glyphs as link decoration (identity-system.md "Links").
+ * - No external resources: CSP stays `default-src 'none'`, the diagram is
+ *   inline SVG, fonts are the system stack.
+ * - No white small text on #EF8D32; deep orange for small labels.
+ * - No noindex: this page exists to be found (ADR 0164 Decision 5).
+ */
+
+export const BRIDGE_HUB_LANDING_LANGUAGES = Object.freeze(['ja', 'en']);
+
+const ORIGIN = 'https://lattice.kitepon.dev';
+
+// One table for both languages: a missing translation is a visible
+// structural gap here, never a silent fallback at a call site.
+const LANDING_COPY = Object.freeze({
+  ja: Object.freeze({
+    htmlLang: 'ja',
+    canonicalPath: '/',
+    switchHref: '/en/',
+    switchLabel: 'English',
+    title: 'Lattice — 並列開発のschedulability compiler',
+    description: 'コードベースの実際の変更境界を解析し、開発タスクの並列実行可否を判定するLatticeの製品紹介と、公開中のライブ工程表。',
+    eyebrow: '公開 / 特許出願済み',
+    heroLead: 'コードベースの実際の変更境界を解析し、複数の開発タスクを並列実行できるか判定するschedulability compiler。競合する場合は境界を分割し、計画を再コンパイルする。',
+    howTitle: 'Latticeがしていること',
+    howCards: [
+      { title: '境界を観測する', body: 'コードの実際の変更境界——ファイル・シンボル・依存の交差——を、索引済みのコード知識グラフから読み取ります。宣言や推測ではなく、実態から始めます。' },
+      { title: '並列可能を証明する', body: 'タスク同士の書込範囲が交差しないことを検証し、同時に走らせてよい組を確定します。並列化は雰囲気ではなく、証明の結果です。' },
+      { title: '分割して、再コンパイル', body: 'タスクが衝突したら、境界を切り分けて計画を再コンパイルします。工程は止まらず、次に走れる形へ組み直されます。' },
+    ],
+    diagramLabel: '衝突した2つのタスクの境界を分割し、並列の2経路へ再コンパイルする図',
+    liveTitle: 'ライブ工程表',
+    liveCaption: 'この一覧は、Latticeが管理している実プロジェクトの公開データから、いまこの瞬間に生成されています。開くと各工程の現在地が見られます。この一覧自体が動作デモです。',
+    hostPrefix: '配信元',
+    statusOnline: 'オンライン',
+    statusOffline: 'オフライン',
+    empty: 'いまは公開中の端末がありません。少し待ってから再読み込みしてください。',
+    ctaGithub: 'GitHubで見る',
+    ctaRoot: 'kitepon.devへ戻る',
+    rootHref: 'https://kitepon.dev/',
+    footerNote: 'kitepon.dev の開発工程を、Lattice自身で可視化しています。',
+    footerNavLabel: '関連リンク',
+  }),
+  en: Object.freeze({
+    htmlLang: 'en',
+    canonicalPath: '/en/',
+    switchHref: '/',
+    switchLabel: '日本語',
+    title: 'Lattice — a schedulability compiler for parallel development',
+    description: 'Product page and live public plans for Lattice, a schedulability compiler that proves which development tasks can run in parallel.',
+    eyebrow: 'PUBLIC / PATENT PENDING',
+    heroLead: 'A schedulability compiler that analyzes real code-change boundaries and proves which development tasks can run in parallel. When tasks collide, it splits the boundary and recompiles the plan.',
+    howTitle: 'What Lattice does',
+    howCards: [
+      { title: 'Observe real boundaries', body: 'It reads the actual change boundaries of the code — files, symbols, crossing dependencies — from an indexed knowledge graph. It starts from reality, not from declarations.' },
+      { title: 'Prove parallelism', body: 'It verifies that tasks touch non-overlapping write ranges and pins down which of them may run at the same time. Parallelism is a proof result, not a mood.' },
+      { title: 'Split and recompile', body: 'When tasks collide, it splits the seam and recompiles the plan. The work does not stop; it is reshaped into what can run next.' },
+    ],
+    diagramLabel: 'Diagram: two colliding tasks are split at the boundary and recompiled into two parallel routes',
+    liveTitle: 'Live plans',
+    liveCaption: 'This list is compiled at this very moment from public data of real projects managed by Lattice itself. Open one to see where the work stands. The list is the demo.',
+    hostPrefix: 'served by',
+    statusOnline: 'ONLINE',
+    statusOffline: 'OFFLINE',
+    empty: 'No terminals are publishing right now. Check back in a moment.',
+    ctaGithub: 'View on GitHub',
+    ctaRoot: 'Back to kitepon.dev',
+    rootHref: 'https://kitepon.dev/en',
+    footerNote: 'The development of kitepon.dev, made visible by Lattice itself.',
+    footerNavLabel: 'Related links',
+  }),
+});
+
+const GITHUB_URL = 'https://github.com/kitepon-rgb/Lattice';
+
+export function escapeHtml(value) {
+  return String(value).replaceAll('&', '&amp;').replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#39;');
+}
+
+// Brand-canon tokens (RootSitePromotion docs/color-system.md, 2026-07-27).
+// Paper/White carry the page; Ink carries text; Orange is confined to
+// eyebrow/labels/pills/CTA; Cobalt to the diagram and hover borders.
+const LANDING_STYLE = `:root{color-scheme:light;--paper:#f8f5ef;--white:#fffef9;--ink:#111b35;--ink-soft:rgba(17,27,53,.62);--line:rgba(17,27,53,.14);--orange:#ef8d32;--orange-strong:#c65300;--orange-deep:#a84400;--orange-soft:#fbe5d2;--cobalt:#2149aa}
+*{box-sizing:border-box}
+body{min-height:100vh;margin:0;color:var(--ink);background:var(--paper);font:16px/1.8 system-ui,-apple-system,"Hiragino Sans","Yu Gothic UI",sans-serif}
+.shell{max-width:960px;margin:0 auto;padding:28px 22px 48px}
+.brand{display:flex;align-items:center;gap:9px;padding-bottom:22px;border-bottom:1px solid var(--line);font-size:.88rem}
+.brand a{color:var(--ink);font-weight:800;text-decoration:none}
+.brand a:hover{color:var(--orange-strong)}
+.brand .sep{color:var(--ink-soft)}
+.brand .lang{margin-left:auto;font-weight:700;color:var(--ink-soft)}
+.brand .lang:hover{color:var(--orange-strong)}
+.hero{padding:58px 0 40px}
+.eyebrow{margin:0 0 10px;color:var(--orange-deep);font-size:.72rem;font-weight:800;letter-spacing:.18em}
+h1{margin:0 0 16px;font-size:clamp(2.4rem,7vw,4rem);line-height:1.12;letter-spacing:-.04em}
+.lead{max-width:640px;margin:0;font-size:1.06rem;color:var(--ink)}
+.how{margin:14px 0 0;padding:30px 26px 34px;border-radius:16px;background:var(--orange-soft)}
+h2{margin:0 0 18px;font-size:1.28rem;letter-spacing:-.01em}
+.cards{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:14px;margin:0;padding:0;list-style:none}
+.cards li{padding:18px 18px 20px;border:1px solid var(--line);border-radius:12px;background:var(--white)}
+.cards h3{margin:0 0 8px;font-size:.98rem}
+.cards p{margin:0;font-size:.86rem;line-height:1.75;color:var(--ink-soft)}
+.diagram{display:block;margin:26px auto 0;max-width:520px;width:100%;height:auto}
+.live{padding:44px 0 8px}
+.live-caption{max-width:640px;margin:0 0 22px;font-size:.92rem;color:var(--ink-soft)}
+.plans{display:grid;gap:12px;margin:0;padding:0;list-style:none}
+.plans a{display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:center;gap:6px 20px;padding:16px 20px;border:1px solid var(--line);border-radius:12px;color:inherit;background:var(--white);text-decoration:none}
+.plans a:hover{border-color:var(--cobalt);transform:translateY(-1px)}
+.plans a:focus-visible{outline:2px solid var(--cobalt);outline-offset:2px}
+.plans strong{font-size:1.04rem}
+.plans .host{grid-column:1;font-size:.76rem;color:var(--ink-soft)}
+.plans .pill{grid-column:2;grid-row:1/span 2;justify-self:end;padding:3px 10px;border-radius:999px;font-size:.72rem;font-weight:800;letter-spacing:.06em}
+.pill.online{color:var(--orange-strong);background:var(--orange-soft)}
+.pill.offline{color:var(--ink-soft);background:rgba(17,27,53,.07)}
+.empty{padding:18px 20px;border:1px dashed var(--line);border-radius:12px;color:var(--ink-soft)}
+.cta{display:flex;flex-wrap:wrap;gap:12px;padding:36px 0 44px}
+.cta a{display:inline-block;padding:12px 22px;border-radius:999px;font-weight:800;font-size:.94rem;text-decoration:none}
+.cta .primary{color:var(--white);background:var(--orange-strong)}
+.cta .primary:hover{background:var(--orange-deep)}
+.cta .secondary{color:var(--ink);border:1px solid var(--line);background:var(--white)}
+.cta .secondary:hover{border-color:var(--orange-strong);color:var(--orange-strong)}
+.cta a:focus-visible{outline:2px solid var(--cobalt);outline-offset:2px}
+.footer{display:flex;flex-wrap:wrap;justify-content:space-between;gap:16px;padding-top:20px;border-top:1px solid var(--line);color:var(--ink-soft);font-size:.82rem}
+.footer a{color:var(--ink);font-weight:700;text-decoration:none}
+.footer a:hover{color:var(--orange-strong)}
+.footer nav{display:flex;gap:18px}
+@media(max-width:720px){.cards{grid-template-columns:1fr}}
+@media(max-width:560px){.shell{padding:20px 16px 36px}.hero{padding:44px 0 30px}.how{padding:22px 18px 26px}.plans a{padding:14px 16px}.footer{display:block}.footer nav{margin-top:10px}}`;
+
+// Collide -> split -> parallel, in brand geometry: Cobalt trajectories,
+// Discovery Orange nodes. Inline so the CSP never needs img-src.
+function landingDiagram(label) {
+  return `<svg class="diagram" viewBox="0 0 520 150" role="img" aria-label="${escapeHtml(label)}" xmlns="http://www.w3.org/2000/svg">`
+    + `<path d="M20 45 C 90 45 130 72 180 75" fill="none" stroke="#2149aa" stroke-width="2"/>`
+    + `<path d="M20 105 C 90 105 130 78 180 75" fill="none" stroke="#2149aa" stroke-width="2"/>`
+    + `<circle cx="180" cy="75" r="7" fill="#ef8d32"/>`
+    + `<path d="M187 75 C 240 75 260 40 320 40 L 500 40" fill="none" stroke="#2149aa" stroke-width="2"/>`
+    + `<path d="M187 75 C 240 75 260 110 320 110 L 500 110" fill="none" stroke="#2149aa" stroke-width="2"/>`
+    + `<circle cx="320" cy="40" r="5" fill="#ef8d32"/>`
+    + `<circle cx="320" cy="110" r="5" fill="#ef8d32"/>`
+    + `<circle cx="500" cy="40" r="5" fill="#ef8d32"/>`
+    + `<circle cx="500" cy="110" r="5" fill="#ef8d32"/>`
+    + `</svg>`;
+}
+
+function landingHead(copy) {
+  const canonical = `${ORIGIN}${copy.canonicalPath}`;
+  return `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'">`
+    + `<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">`
+    + `<meta name="description" content="${escapeHtml(copy.description)}">`
+    + `<link rel="canonical" href="${canonical}">`
+    + `<link rel="alternate" hreflang="ja" href="${ORIGIN}/">`
+    + `<link rel="alternate" hreflang="en" href="${ORIGIN}/en/">`
+    + `<link rel="alternate" hreflang="x-default" href="${ORIGIN}/">`
+    + `<meta property="og:title" content="${escapeHtml(copy.title)}">`
+    + `<meta property="og:description" content="${escapeHtml(copy.description)}">`
+    + `<meta name="theme-color" content="#f8f5ef">`
+    + `<title>${escapeHtml(copy.title)}</title>`
+    + `<style>${LANDING_STYLE}</style>`;
+}
+
+function landingPlanList(copy, projects, displayNames) {
+  if (projects.length === 0) return `<p class="empty">${escapeHtml(copy.empty)}</p>`;
+  const rows = projects.map((project) => {
+    const href = `/projects/${encodeURIComponent(project.project_id)}/`;
+    const online = project.status === 'online';
+    const title = displayNames[project.project_id] ?? project.project_id;
+    return `<li><a href="${escapeHtml(href)}">`
+      + `<strong>${escapeHtml(title)}</strong>`
+      + `<span class="pill ${online ? 'online' : 'offline'}">${escapeHtml(online ? copy.statusOnline : copy.statusOffline)}</span>`
+      + `<span class="host">${escapeHtml(copy.hostPrefix)}: ${escapeHtml(project.display_name)}</span>`
+      + `</a></li>`;
+  }).join('');
+  return `<ul class="plans">${rows}</ul>`;
+}
+
+/**
+ * Render the public landing.
+ *
+ * @param {object} input
+ * @param {Array<{project_id: string, display_name: string, status: string}>} input.projects
+ *   The already-filtered public view (visibility applied by the caller).
+ * @param {'ja'|'en'} input.lang
+ * @param {Record<string, string>} [input.displayNames]
+ *   Operator display-name map (public-visibility.json); unmapped ids render as-is.
+ */
+export function renderBridgeHubLanding({ projects, lang, displayNames = {} }) {
+  const copy = LANDING_COPY[lang];
+  if (copy === undefined) throw new RangeError(`unsupported landing language: ${lang}`);
+  const cards = copy.howCards.map((card) =>
+    `<li><h3>${escapeHtml(card.title)}</h3><p>${escapeHtml(card.body)}</p></li>`).join('');
+  return `<!doctype html><html lang="${copy.htmlLang}"><head>${landingHead(copy)}</head><body><div class="shell">`
+    + `<header class="brand">`
+    + `<a href="${escapeHtml(copy.rootHref)}">kitepon.dev</a><span class="sep" aria-hidden="true">/</span><strong>Lattice</strong>`
+    + `<a class="lang" href="${copy.switchHref}" lang="${lang === 'ja' ? 'en' : 'ja'}" hreflang="${lang === 'ja' ? 'en' : 'ja'}">${copy.switchLabel}</a>`
+    + `</header>`
+    + `<main>`
+    + `<section class="hero"><p class="eyebrow">${escapeHtml(copy.eyebrow)}</p><h1>Lattice</h1>`
+    + `<p class="lead">${escapeHtml(copy.heroLead)}</p></section>`
+    + `<section class="how"><h2>${escapeHtml(copy.howTitle)}</h2><ul class="cards">${cards}</ul>`
+    + `${landingDiagram(copy.diagramLabel)}</section>`
+    + `<section class="live"><h2>${escapeHtml(copy.liveTitle)}</h2>`
+    + `<p class="live-caption">${escapeHtml(copy.liveCaption)}</p>`
+    + `${landingPlanList(copy, projects, displayNames)}</section>`
+    + `<div class="cta">`
+    + `<a class="primary" href="${GITHUB_URL}">${escapeHtml(copy.ctaGithub)}</a>`
+    + `<a class="secondary" href="${escapeHtml(copy.rootHref)}">${escapeHtml(copy.ctaRoot)}</a>`
+    + `</div>`
+    + `</main>`
+    + `<footer class="footer"><span>${escapeHtml(copy.footerNote)}</span>`
+    + `<nav aria-label="${escapeHtml(copy.footerNavLabel)}"><a href="${escapeHtml(copy.rootHref)}">kitepon.dev</a><a href="${GITHUB_URL}">GitHub</a></nav>`
+    + `</footer></div></body></html>`;
+}

package/src/bridge-hub-protocol.mjs

@@ -98,11 +98,12 @@ function validRegistry(registry) {
 /**
  * Apply one registration/heartbeat call to a registry snapshot. Pure: takes the
  * current entries and returns the next ones plus a result summary, mutating
- * nothing. Throws `BridgeHubProtocolError` for an invalid request or an
- * unresolved project_id conflict; on throw, `registry` is guaranteed untouched
- * because nothing is written until every conflict check has passed.
+ * nothing. Throws `BridgeHubProtocolError` only for a malformed registry or
+ * request; a project_id already held by another terminal is no longer fatal —
+ * see the contention rules inline.
  */
-export function applyBridgeHubRegistration({ registry, request, remoteAddress, now = new Date() }) {
+export function applyBridgeHubRegistration({ registry, request, remoteAddress, now = new Date(),
+  ttlMs = BRIDGE_HUB_HEARTBEAT_TTL_MS }) {
   if (!validRegistry(registry)) {
     throw new BridgeHubProtocolError('BRIDGE_HUB_REGISTRY_INVALID', 'bridge hub registry is invalid');
   }
@@ -119,30 +120,44 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
   const requestedSet = new Set(projectIds);
   const adoptSet = new Set(adopt);
 
-  const conflicts = registry
-    .filter((entry) => requestedSet.has(entry.project_id)
-      && entry.terminal_id !== terminalId && !adoptSet.has(entry.project_id))
-    .map((entry) => ({ project_id: entry.project_id, owning_terminal_id: entry.terminal_id }));
-  if (conflicts.length > 0) {
-    throw new BridgeHubProtocolError('BRIDGE_HUB_PROJECT_CONFLICT',
-      'one or more project_ids are already owned by a different terminal',
-      {
-        conflicts: conflicts.sort((left, right) => left.project_id.localeCompare(right.project_id, 'en')),
-        next_action: 're-register naming the conflicting project_ids in adopt',
-      });
-  }
+  // A heartbeat carries the terminal's whole active set, so one contested
+  // project_id used to fail the entire request and strand every unrelated
+  // project on that terminal — invisibly, since the daemon only logs the
+  // rejection to a stderr nobody reads. Contested ids are now settled one at a
+  // time and the rest are accepted:
+  //
+  //   owner offline (no heartbeat within the TTL) — the entry is very likely a
+  //     leftover from a terminal that moved on, so the live claimant takes it
+  //     over. Nothing else ever retracts it: entries are never expired.
+  //   owner online — the project genuinely belongs to another live terminal.
+  //     Reject just that id and report it, so the operator can adopt on purpose.
+  //     Handing it over unconditionally would make two live terminals trade
+  //     ownership every heartbeat and flip the published route back and forth.
+  const claimed = registry.filter((entry) => requestedSet.has(entry.project_id)
+    && entry.terminal_id !== terminalId && !adoptSet.has(entry.project_id));
+  const offline = (entry) => now.getTime() - Date.parse(entry.last_seen_at) > ttlMs;
+  const rejected = claimed.filter((entry) => !offline(entry))
+    .map((entry) => ({ project_id: entry.project_id, owning_terminal_id: entry.terminal_id }))
+    .sort((left, right) => left.project_id.localeCompare(right.project_id, 'en'));
+  const reclaimed = sorted(claimed.filter(offline).map((entry) => entry.project_id));
+
+  const rejectedSet = new Set(rejected.map((entry) => entry.project_id));
+  const acceptedIds = projectIds.filter((projectId) => !rejectedSet.has(projectId));
+  const acceptedSet = new Set(acceptedIds);
 
   const registeredAtByProject = new Map(registry
     .filter((entry) => entry.terminal_id === terminalId)
     .map((entry) => [entry.project_id, entry.registered_at]));
-  const adopted = sorted(projectIds.filter((projectId) => adoptSet.has(projectId)
+  const adopted = sorted(acceptedIds.filter((projectId) => adoptSet.has(projectId)
     && !registeredAtByProject.has(projectId)));
   // Full-state reconciliation: every entry this terminal owned is dropped, then
-  // rebuilt from `projectIds`. A project omitted from this call — dropped
+  // rebuilt from the accepted ids. A project omitted from this call — dropped
   // locally, or never re-sent after a crash — is released, not left as a
-  // phantom no future heartbeat can retract.
-  const others = registry.filter((entry) => entry.terminal_id !== terminalId && !requestedSet.has(entry.project_id));
-  const mine = projectIds.map((projectId) => ({
+  // phantom no future heartbeat can retract. Rejected ids stay with their live
+  // owner, so `others` keeps them.
+  const others = registry.filter((entry) => entry.terminal_id !== terminalId
+    && !acceptedSet.has(entry.project_id));
+  const mine = acceptedIds.map((projectId) => ({
     project_id: projectId,
     terminal_id: terminalId,
     display_name: displayName,
@@ -157,12 +172,18 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
   return {
     registry: nextRegistry,
     result: {
-      schema: 'lattice.bridge_hub_registration_result.v1',
+      // v2: partial acceptance. v1 answered a contested id with a 409 that threw
+      // the whole request away; v2 accepts what it can and names what it could
+      // not. A v1 terminal reading a v2 result sees a 200 and simply does not
+      // notice `rejected` — still strictly better than losing every project.
+      schema: 'lattice.bridge_hub_registration_result.v2',
       terminal_id: terminalId,
       address: remoteAddress,
       port,
-      registered: sorted(projectIds),
+      registered: sorted(acceptedIds),
       adopted,
+      rejected,
+      reclaimed_from_offline: reclaimed,
     },
   };
 }
@@ -170,8 +191,9 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
 /**
  * Read-time projection for the aggregate `/projects/` view and per-project
  * routing. Never mutates or drops entries — a terminal that stopped
- * heartbeating shows as 'offline' forever, not gone, until it either
- * re-registers or a different terminal explicitly adopts the project.
+ * heartbeating shows as 'offline' forever, not gone, until it re-registers, a
+ * different terminal explicitly adopts the project, or a different terminal
+ * claims it while this one is past the TTL (see applyBridgeHubRegistration).
  */
 export function projectBridgeHubRegistry({ registry, now = new Date(), ttlMs = BRIDGE_HUB_HEARTBEAT_TTL_MS }) {
   if (!validRegistry(registry)) {

package/src/bridge-hub-server.mjs

@@ -35,11 +35,13 @@ import {
   applyBridgeHubRegistration, BRIDGE_HUB_HEARTBEAT_TTL_MS, BridgeHubProtocolError,
   projectBridgeHubRegistry, validateBridgeHubRegistryEntry,
 } from './bridge-hub-protocol.mjs';
+import { escapeHtml, renderBridgeHubLanding } from './bridge-hub-landing.mjs';
 
 const LOOPBACK = '127.0.0.1';
 const HUB_HTTP_ERROR_SCHEMA = 'lattice.bridge_hub_http_error.v1';
 const HUB_REGISTRY_DOCUMENT_SCHEMA = 'lattice.bridge_hub_registry_document.v1';
 const HUB_PUBLIC_PROJECT_SCHEMA = 'lattice.bridge_hub_public_project.v1';
+const HUB_PUBLIC_VISIBILITY_SCHEMA = 'lattice.bridge_hub_public_visibility.v1';
 const MAX_REGISTRATION_BODY_BYTES = 65_536;
 const LOCK_ATTEMPTS = 240;
 const LOCK_WAIT_MS = 25;
@@ -65,11 +67,6 @@ export class BridgeHubServerError extends Error {
   }
 }
 
-function escapeHtml(value) {
-  return String(value).replaceAll('&', '&amp;').replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#39;');
-}
-
 // --- Host allow-list validation (equivalent to bridge-server.mjs's
 // validatedRequestHost/normalizeBridgeAllowedHost, reimplemented locally so
 // this module does not depend on a file a concurrent task is editing). ---
@@ -176,31 +173,9 @@ function respondError(response, status, code, detail = null) {
   response.end(`${JSON.stringify(body)}\n`);
 }
 
-// This must stay visually identical to todo-gantt-live.mjs's dashboardHtml
-// (same shell/brand/card markup, same design tokens) — the public entrance
-// changing its own look when the routing behind it changed from single- to
-// multi-terminal is exactly the regression the owner flagged (room 2474;
-// plan_bridge-hub.md's non-goal "dashboard renderer/gantt UIの変更はしない"
-// covers keeping this landing's appearance, not just the diagrams behind it).
-// Reimplemented locally rather than imported: this codebase's bridge modules
-// each keep their own copy of such patterns rather than cross-importing
-// (see bh2-hub-server.md's rationale for validatedHubHost et al.), and the
-// only genuinely new thing here — an online/offline badge per project — has
-// no home in the single-terminal original to import from anyway.
-function hubIndexHtml(view) {
-  const rows = view.map((project) => {
-    const href = `/projects/${encodeURIComponent(project.project_id)}/`;
-    const online = project.status === 'online';
-    const statusLabel = online ? 'オンライン' : 'オフライン';
-    const statusClass = online ? 'status-online' : 'status-offline';
-    const identity = project.display_name === project.project_id ? '' : `<code>${escapeHtml(project.project_id)}</code>`;
-    return `<li><a href="${escapeHtml(href)}"><strong>${escapeHtml(project.display_name)}</strong>`
-      + `${identity}<span class="${statusClass}">${escapeHtml(statusLabel)}</span>`
-      + `<span aria-hidden="true">→</span></a></li>`;
-  }).join('');
-  const content = rows.length === 0 ? '<p>登録されている端末はありません。</p>' : `<ul>${rows}</ul>`;
-  return `<!doctype html><html lang="ja"><head><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="description" content="Latticeが管理している公開中の工程と現在地を確認できます。"><meta name="robots" content="noindex, nofollow"><meta property="og:title" content="公開中の工程表 — Lattice"><meta property="og:description" content="Latticeが管理している公開中の工程と現在地を確認できます。"><meta name="theme-color" content="#f7f3ea"><title>公開中の工程表 — Lattice</title><style>:root{color-scheme:light;--paper:#f7f3ea;--panel:#fffdf8;--ink:#201d19;--soft:#6c655d;--line:#d8d0c5;--cobalt:#315cbe;--orange:#e85f2a;--good:#0ca30c;--critical:#d03b3b}*{box-sizing:border-box}body{min-height:100vh;margin:0;color:var(--ink);background:var(--paper);font:16px/1.7 system-ui,-apple-system,sans-serif}.shell{max-width:880px;margin:0 auto;padding:28px 22px 40px}.brand{display:flex;align-items:center;gap:9px;padding-bottom:24px;border-bottom:1px solid var(--line);font-size:.88rem}.brand a,.footer a{color:var(--ink);font-weight:800;text-decoration:none}.brand a:hover,.footer a:hover{color:var(--cobalt)}.brand span{color:var(--soft)}main{padding:64px 0 72px}.eyebrow{margin:0 0 8px;color:var(--orange);font-size:.76rem;font-weight:800;letter-spacing:.14em}.lead{max-width:620px;margin:0 0 34px;color:var(--soft)}h1{margin:0 0 14px;font-size:clamp(2rem,6vw,3.4rem);line-height:1.12;letter-spacing:-.04em}ul{display:grid;gap:12px;margin:0;padding:0;list-style:none}li a{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:20px;padding:18px 20px;border:1px solid var(--line);border-radius:12px;color:inherit;background:var(--panel);text-decoration:none;box-shadow:0 8px 28px rgba(48,39,27,.04)}li a:hover{border-color:var(--cobalt);transform:translateY(-1px)}li strong{font-size:1.04rem}li code{color:var(--soft);font-size:.78rem}li .status-online{color:var(--good);font-weight:800}li .status-offline{color:var(--critical);font-weight:800}li>a>span[aria-hidden]{color:var(--cobalt);font-weight:800}.note{margin:28px 0 0;padding:16px 18px;border-left:3px solid var(--orange);color:var(--soft);background:rgba(255,253,248,.72);font-size:.88rem}.footer{display:flex;flex-wrap:wrap;justify-content:space-between;gap:16px;padding-top:20px;border-top:1px solid var(--line);color:var(--soft);font-size:.82rem}.footer nav{display:flex;gap:18px}@media(max-width:560px){.shell{padding:20px 16px 32px}main{padding:44px 0 56px}li a{grid-template-columns:minmax(0,1fr) auto;padding:16px}li code{grid-column:1/-1;grid-row:2}.footer{display:block}.footer nav{margin-top:10px}}</style></head><body><div class="shell"><header class="brand"><a href="https://kitepon.dev/">kitepon.dev</a><span aria-hidden="true">/</span><strong>Lattice</strong></header><main><p class="eyebrow">LIVE DEVELOPMENT</p><h1>公開中の工程表</h1><p class="lead">Latticeが管理しているプロジェクトの工程と、いまどこまで進んでいるかを公開データから確認できます。</p>${content}<p class="note">表示内容はLatticeの記録から自動生成されます。製品の紹介や使い方はGitHubをご覧ください。</p></main><footer class="footer"><span>kitepon.dev の開発工程を、Latticeで可視化しています。</span><nav aria-label="関連リンク"><a href="https://kitepon.dev/">kitepon.dev</a><a href="https://github.com/kitepon-rgb/Lattice">GitHub</a></nav></footer></div></body></html>`;
-}
+// The landing renderer lives in bridge-hub-landing.mjs (ADR 0164: the hub
+// landing is the public product face; the room-2474 "stay identical to
+// dashboardHtml" constraint is superseded by that ADR).
 
 function hubProjectStatusHtml(code, projectId, requestPath, message) {
   return `<!doctype html><html lang="ja"><head><meta charset="utf-8">`
@@ -275,7 +250,12 @@ function hubRuntimeDir(env) {
 
 function hubRuntimePaths(env) {
   const root = hubRuntimeDir(env);
-  return { root, registry: path.join(root, 'terminals.json'), lock: path.join(root, 'registry.lock') };
+  return {
+    root,
+    registry: path.join(root, 'terminals.json'),
+    lock: path.join(root, 'registry.lock'),
+    visibility: path.join(root, 'public-visibility.json'),
+  };
 }
 
 async function readJsonDocument(ref, missing) {
@@ -330,6 +310,51 @@ function validRegistryDocument(value) {
     && value.entries.every(validateBridgeHubRegistryEntry);
 }
 
+const EMPTY_VISIBILITY = Object.freeze({
+  hidden_project_ids: Object.freeze([]), hidden_terminal_ids: Object.freeze([]), display_names: Object.freeze({}),
+});
+
+function validVisibilityDocument(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    && value.schema === HUB_PUBLIC_VISIBILITY_SCHEMA
+    && Object.keys(value).every((key) =>
+      ['schema', 'hidden_project_ids', 'hidden_terminal_ids', 'display_names'].includes(key))
+    && Array.isArray(value.hidden_project_ids)
+    && value.hidden_project_ids.every((entry) => typeof entry === 'string')
+    && Array.isArray(value.hidden_terminal_ids)
+    && value.hidden_terminal_ids.every((entry) => typeof entry === 'string')
+    && value.display_names !== null && typeof value.display_names === 'object'
+    && !Array.isArray(value.display_names)
+    && Object.values(value.display_names).every((entry) => typeof entry === 'string');
+}
+
+/**
+ * Read the operator's public-visibility file (ADR 0164 Decision 3): which
+ * projects/terminals stay off the public listing, and how project ids render.
+ * Hot-read per request so edits apply without a hub restart. A missing file
+ * hides nothing; a malformed file is a typed error, never a silent republish
+ * of an internal terminal.
+ */
+export async function readBridgeHubPublicVisibility({ env = process.env } = {}) {
+  const refs = hubRuntimePaths(env);
+  let document;
+  try {
+    document = await readJsonDocument(refs.visibility, EMPTY_VISIBILITY);
+  } catch (error) {
+    throw new BridgeHubServerError('BRIDGE_HUB_VISIBILITY_FILE_INVALID',
+      `hub public-visibility JSON is invalid: ${refs.visibility}`, undefined, error);
+  }
+  if (document === EMPTY_VISIBILITY) return document;
+  if (!validVisibilityDocument(document)) {
+    throw new BridgeHubServerError('BRIDGE_HUB_VISIBILITY_FILE_INVALID', 'hub public-visibility file is invalid');
+  }
+  return {
+    hidden_project_ids: document.hidden_project_ids,
+    hidden_terminal_ids: document.hidden_terminal_ids,
+    display_names: document.display_names,
+  };
+}
+
 /** Read the persisted registry. A missing file is an empty registry, not an error. */
 export async function readBridgeHubRegistry({ env = process.env } = {}) {
   const refs = hubRuntimePaths(env);
@@ -411,14 +436,17 @@ export async function startBridgeHubServer({
     try {
       result = await registrationLock(async () => {
         const entries = await store.read();
-        const applied = applyBridgeHubRegistration({ registry: entries, request, remoteAddress, now: now() });
+        const applied = applyBridgeHubRegistration({
+          registry: entries, request, remoteAddress, now: now(), ttlMs,
+        });
         await store.write(applied.registry);
         return applied.result;
       });
     } catch (error) {
       if (error instanceof BridgeHubProtocolError) {
-        const status = error.code === 'BRIDGE_HUB_PROJECT_CONFLICT' ? 409
-          : error.code === 'BRIDGE_HUB_REGISTRATION_INVALID' ? 400 : 500;
+        // A contested project_id no longer throws — it comes back in the 200
+        // body's `rejected`. Only a malformed request or registry lands here.
+        const status = error.code === 'BRIDGE_HUB_REGISTRATION_INVALID' ? 400 : 500;
         respondError(response, status, error.code, error.detail ?? null);
         return;
       }
@@ -429,14 +457,22 @@ export async function startBridgeHubServer({
     response.end(`${JSON.stringify(result)}\n`);
   }
 
-  async function handleProjectsIndex(incoming, response) {
+  async function handleLanding(incoming, response, lang) {
     if (incoming.method !== 'GET') {
       response.setHeader('allow', 'GET');
       respondError(response, 405, 'BRIDGE_HUB_METHOD_NOT_ALLOWED');
       return;
     }
     const entries = await store.read();
-    const projected = projectBridgeHubRegistry({ registry: entries, now: now(), ttlMs });
+    const visibility = await readBridgeHubPublicVisibility({ env });
+    const hiddenProjects = new Set(visibility.hidden_project_ids);
+    const hiddenTerminals = new Set(visibility.hidden_terminal_ids);
+    // The visibility filter applies to the listing only (both HTML and JSON);
+    // `/projects/<hidden>/` keeps proxying — hidden is not private (ADR 0164
+    // Decision 3, deliberately: smoke tests fetch their own page, operators
+    // keep the direct URL).
+    const projected = projectBridgeHubRegistry({ registry: entries, now: now(), ttlMs })
+      .filter((entry) => !hiddenProjects.has(entry.project_id) && !hiddenTerminals.has(entry.terminal_id));
     // Only the fields humans need for the public index are exposed; internal
     // routing fields (terminal_id, address, port) stay server-side, matching
     // the codebase's existing posture of not leaking topology to public
@@ -455,7 +491,7 @@ export async function startBridgeHubServer({
       response.end(`${JSON.stringify(view)}\n`);
       return;
     }
-    const html = hubIndexHtml(view);
+    const html = renderBridgeHubLanding({ projects: view, lang, displayNames: visibility.display_names });
     response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store',
       'x-content-type-options': 'nosniff' });
     response.end(html);
@@ -523,17 +559,26 @@ export async function startBridgeHubServer({
       return;
     }
     const rawPath = requestUrl.split('?', 1)[0];
-    if (rawPath === '/') {
-      // The old single-terminal bridge served the project index at root; hub only ever
-      // routed `/projects/*`, so the public entrance 404'd (room 2488 — a functional
-      // regression, not a design one: the front door itself was gone, independent of how
-      // it looks). Redirect rather than duplicate handleProjectsIndex's logic at a second path.
-      response.writeHead(301, { location: '/projects/', 'cache-control': 'no-store' });
+    if (rawPath === '/__lattice/hub/register') { await handleRegister(incoming, response); return; }
+    // The landing (ADR 0164) serves the same page at `/` and `/projects/`
+    // (the old `/` -> `/projects/` 301 is retired: both public inbound links
+    // land on the product face), with the EN variant path-separated under
+    // `/en/` mirroring the root site's convention. These literal matches must
+    // stay ahead of PROJECT_ROUTE so `/projects/` never parses as a project id.
+    if (rawPath === '/' || rawPath === '/projects/') { await handleLanding(incoming, response, 'ja'); return; }
+    if (rawPath === '/en/' || rawPath === '/en/projects/') { await handleLanding(incoming, response, 'en'); return; }
+    if (rawPath === '/en') {
+      response.writeHead(301, { location: '/en/', 'cache-control': 'no-store' });
+      response.end();
+      return;
+    }
+    if (rawPath.startsWith('/en/projects/')) {
+      // Per-project pages are language-neutral; strip the prefix instead of
+      // 404ing a hand-edited EN URL. Query strings survive the strip.
+      response.writeHead(301, { location: requestUrl.slice('/en'.length), 'cache-control': 'no-store' });
       response.end();
       return;
     }
-    if (rawPath === '/__lattice/hub/register') { await handleRegister(incoming, response); return; }
-    if (rawPath === '/projects/') { await handleProjectsIndex(incoming, response); return; }
     const match = PROJECT_ROUTE.exec(rawPath);
     if (match !== null) { await handleProjectProxy(incoming, response, requestUrl, match[1], host); return; }
     respondError(response, 404, 'BRIDGE_HUB_ROUTE_NOT_FOUND');

package/src/bridge-server.mjs

@@ -193,6 +193,7 @@ export async function startBridgeServer({
   instanceToken = null,
   resolveUpstream = (upstream) => resolveBridgeUpstream(upstream, { env }),
   interfaces = networkInterfaces(),
+  heartbeat = () => null,
 } = {}) {
   if (config?.enabled !== true) throw new BridgeConfigError('BRIDGE_DISABLED', 'bridge is disabled');
   if (!Array.isArray(config.allowed_hosts) || config.allowed_hosts.length === 0) {
@@ -240,7 +241,11 @@ export async function startBridgeServer({
           address: currentConfig.listen.address, port: currentConfig.listen.port,
           updated_at: currentConfig.updated_at ?? null,
           version: packageJson.version, node_path: process.execPath,
-          node_version: process.version, bridge_path: process.argv[1] ?? null }
+          node_version: process.version, bridge_path: process.argv[1] ?? null,
+          // The hub's answer to our last registration. Nothing else carries it
+          // out of the daemon: the LaunchAgent has no StandardErrorPath, so a
+          // hub refusing our projects was previously invisible everywhere.
+          last_heartbeat: heartbeat() }
         : { schema: 'lattice.bridge_health.v1', status: 'available' })}\n`);
       return;
     }
@@ -321,6 +326,7 @@ export function bridgeRuntimeController({
   register = registerBridgeUpstream,
   report = (line) => process.stderr.write(`${line}\n`),
   readInterfaces = () => networkInterfaces(),
+  heartbeat = () => null,
 } = {}) {
   let active = null;
   let fingerprint = null;
@@ -371,7 +377,7 @@ export function bridgeRuntimeController({
         fingerprint = next;
         return active;
       }
-      const replacement = await startBridgeServer({ config, env, instanceToken, interfaces });
+      const replacement = await startBridgeServer({ config, env, instanceToken, interfaces, heartbeat });
       const previous = active;
       active = replacement;
       fingerprint = next;

package/src/cli-help.mjs

@@ -43,6 +43,7 @@ Commands:
   intake --run .lattice/runs/<id> --task <task_id>
   intake release --run .lattice/runs/<id> --task <task_id>
   intake attach --run .lattice/runs/<id> --task <task_id> --input <worker.json>
+  intake detach --run .lattice/runs/<id> --task <task_id>
   intake intervention --run .lattice/runs/<id> --task <task_id>
   intake accept --run .lattice/runs/<id> --task <task_id>
   adapter register --input <descriptor.json>
@@ -194,6 +195,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'run intake': 'run intake --run .lattice/runs/<id> --task <task_id>',
   'run intake release': 'run intake release --run .lattice/runs/<id> --task <task_id>',
   'run intake attach': 'run intake attach --run .lattice/runs/<id> --task <task_id> --input <worker.json>',
+  'run intake detach': 'run intake detach --run .lattice/runs/<id> --task <task_id>',
   'run intake intervention': 'run intake intervention --run .lattice/runs/<id> --task <task_id>',
   'run intake accept': 'run intake accept --run .lattice/runs/<id> --task <task_id>',
   'run adapter register': 'run adapter register --input <descriptor.json> | --schema --json',