@quolu/lattice 0.56.0 → 0.57.0

package/bin/lattice-bridge.mjs

@@ -28,7 +28,8 @@ if (typeof instanceToken !== 'string' || !/^[0-9a-f]{64}$/u.test(instanceToken))
     code: 'BRIDGE_INSTANCE_TOKEN_INVALID', message: 'bridge instance token is invalid' })}\n`);
   process.exit(1);
 }
-const controller = bridgeRuntimeController({ env, instanceToken });
+const controller = bridgeRuntimeController({ env, instanceToken,
+  heartbeat: () => hubHeartbeat.lastHeartbeatSummary() });
 let timer;
 let closing = false;
 let descriptorFingerprint = null;
@@ -140,7 +141,7 @@ timer = setInterval(async () => {
     try {
       const heartbeat = await hubHeartbeat.tick({ config });
       hubHeartbeatError = null;
-      if (heartbeat?.state === 'unreachable' || heartbeat?.state === 'rejected') {
+      if (['unreachable', 'rejected', 'partial'].includes(heartbeat?.state)) {
         const fingerprint = JSON.stringify(heartbeat);
         if (fingerprint !== hubHeartbeatError) process.stderr.write(`${fingerprint}\n`);
         hubHeartbeatError = fingerprint;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/bridge-cli.mjs

@@ -151,7 +151,19 @@ async function bridgeRuntimeDrift(persistence, runtime) {
  * mismatched path, or an enabled bridge with no persistence entry at all all
  * survive until someone reinstalls the entry.
  */
-function bridgeRemedy(persistence, drift) {
+function bridgeRemedy(persistence, drift, runtime) {
+  // A hub that refused some of this terminal's projects keeps serving the rest,
+  // so nothing else looks wrong — the refused ids simply never reach the
+  // published dashboard from here. They are held by another terminal that is
+  // still heartbeating; this resolves itself if that terminal goes offline, and
+  // otherwise the way out is to stop claiming the id here. (The protocol has an
+  // `adopt` field for taking one over deliberately, but nothing populates it —
+  // there is no CLI for it, so naming it as a remedy would be naming a door
+  // that does not open.)
+  const rejected = runtime?.last_heartbeat?.rejected_projects ?? [];
+  if (rejected.length > 0) {
+    return `lattice todo dashboard remove ${rejected[0]} --json`;
+  }
   if (persistence === null) return null;
   if (persistence.state === 'unreadable') return RECONFIGURE_COMMAND;
   // Only reached with the bridge enabled, so "nothing is installed" means the
@@ -167,7 +179,7 @@ async function bridgeDiagnostics({ config, launchAgent, env, runtimeIdentity })
   const persistence = await bridgePersistence({ launchAgent, env });
   const runtime = await runtimeIdentity({ env });
   const drift = await bridgeRuntimeDrift(persistence, runtime);
-  return { persistence, runtime, drift, remedy: bridgeRemedy(persistence, drift) };
+  return { persistence, runtime, drift, remedy: bridgeRemedy(persistence, drift, runtime) };
 }
 
 function fail(stderr, code, message) {

package/src/bridge-daemon.mjs

@@ -307,7 +307,7 @@ async function attest(descriptor) {
 }
 
 const UNIDENTIFIED_RUNTIME = Object.freeze({ pid: null, version: null, node_path: null,
-  node_version: null, bridge_path: null });
+  node_version: null, bridge_path: null, last_heartbeat: null });
 
 /**
  * Who is actually serving right now — pid, product version, node binary — as
@@ -330,7 +330,10 @@ export async function readBridgeRuntimeIdentity({ env = process.env } = {}) {
   const text = (value) => (typeof value === 'string' ? value : null);
   return { state: 'running', pid: descriptor.pid, version: text(body.version),
     node_path: text(body.node_path), node_version: text(body.node_version),
-    bridge_path: text(body.bridge_path) };
+    bridge_path: text(body.bridge_path),
+    // Absent from daemons older than 0.55.2 — null then means "this daemon does
+    // not report it", not "the hub accepted everything".
+    last_heartbeat: body.last_heartbeat ?? null };
 }
 
 async function healthy(descriptor, config) {

package/src/bridge-hub-heartbeat.mjs

@@ -50,8 +50,8 @@ function terminalIdentityPath(env) {
  * restarts. It must survive restarts: registration is a full-state
  * reconciliation keyed by terminal_id (ADR 0162 Decision 4), so a fresh id on
  * every daemon start would make the hub see "a new terminal" contesting the
- * same project_ids the old id still owns until its TTL lapses — a
- * self-inflicted `BRIDGE_HUB_PROJECT_CONFLICT`.
+ * same project_ids the old id still owns until its TTL lapses — self-inflicted
+ * contention, answered now by a `rejected` entry rather than a failed request.
  */
 export async function readOrCreateBridgeHubTerminalId({ env = process.env } = {}) {
   const refs = bridgeConfigPaths(env);
@@ -130,9 +130,46 @@ export async function sendBridgeHubHeartbeat({ hubUrl, request, fetchImpl = fetc
   if (response.status !== 200) {
     return { schema: HEARTBEAT_RESULT_SCHEMA, state: 'rejected', status: response.status, detail: body };
   }
+  // A hub that accepted some ids and refused others answers 200 with a non-empty
+  // `rejected`. Calling that plain 'accepted' would hide exactly the case this
+  // protocol change exists to make visible: a project of ours is live on another
+  // terminal and will never reach the published view from here until someone
+  // adopts it. Give it its own state so `bridge status` can report it without
+  // having to know the registration result's shape.
+  const rejected = Array.isArray(body?.rejected) ? body.rejected : [];
+  if (rejected.length > 0) {
+    return { schema: HEARTBEAT_RESULT_SCHEMA, state: 'partial', result: body };
+  }
   return { schema: HEARTBEAT_RESULT_SCHEMA, state: 'accepted', result: body };
 }
 
+/**
+ * Compact projection of the last heartbeat, for the daemon's attested health
+ * response and from there `lattice bridge status`.
+ *
+ * Until now a hub that refused this terminal's projects said so only in the
+ * daemon's stderr, and the bridge LaunchAgent has no StandardErrorPath — so the
+ * only symptom an operator ever saw was a project that silently never appeared
+ * on the published dashboard (2026-08-10). The result has to reach a surface a
+ * person actually reads.
+ */
+export function bridgeHubHeartbeatSummary(result, at = null) {
+  if (result === null || result === undefined) return null;
+  const rejected = Array.isArray(result.result?.rejected) ? result.result.rejected : [];
+  const reclaimed = Array.isArray(result.result?.reclaimed_from_offline)
+    ? result.result.reclaimed_from_offline : [];
+  const detail = result.detail === undefined || result.detail === null ? null
+    : (typeof result.detail === 'string' ? result.detail : JSON.stringify(result.detail)).slice(0, 300);
+  return {
+    state: result.state,
+    at,
+    rejected_projects: rejected.map((entry) => entry.project_id)
+      .sort((left, right) => left.localeCompare(right, 'en')),
+    reclaimed_projects: [...reclaimed],
+    detail,
+  };
+}
+
 /**
  * Periodic controller for the bridge daemon's own poll loop
  * (`bin/lattice-bridge.mjs`). Call `tick({ config })` on every iteration; it
@@ -147,24 +184,33 @@ export function createBridgeHubHeartbeatController({
 } = {}) {
   let lastSentAt = null;
   let lastResult = null;
+  let lastResultAt = null;
+  const record = (result, atMs) => {
+    lastResult = result;
+    lastResultAt = new Date(atMs).toISOString();
+    return result;
+  };
   return Object.freeze({
     async tick({ config }) {
-      if (config?.hub == null) { lastSentAt = null; lastResult = null; return null; }
+      if (config?.hub == null) {
+        lastSentAt = null; lastResult = null; lastResultAt = null; return null;
+      }
       const nowMs = now();
       if (lastSentAt !== null && nowMs - lastSentAt < intervalMs) return lastResult;
       lastSentAt = nowMs;
       const projects = await readActiveProjects({ env });
       if (projects.length === 0) {
-        lastResult = { schema: HEARTBEAT_RESULT_SCHEMA, state: 'skipped_no_projects' };
-        return lastResult;
+        return record({ schema: HEARTBEAT_RESULT_SCHEMA, state: 'skipped_no_projects' }, nowMs);
       }
       const terminalId = await readOrCreateBridgeHubTerminalId({ env });
       const request = buildBridgeHubRegistrationRequest({
         terminalId, port: config.listen.port, projectIds: projects.map((project) => project.project_id),
       });
-      lastResult = await sendBridgeHubHeartbeat({ hubUrl: config.hub.url, request, fetchImpl });
-      return lastResult;
+      return record(
+        await sendBridgeHubHeartbeat({ hubUrl: config.hub.url, request, fetchImpl }), nowMs,
+      );
     },
     lastHeartbeatResult: () => lastResult,
+    lastHeartbeatSummary: () => bridgeHubHeartbeatSummary(lastResult, lastResultAt),
   });
 }

package/src/bridge-hub-protocol.mjs

@@ -98,11 +98,12 @@ function validRegistry(registry) {
 /**
  * Apply one registration/heartbeat call to a registry snapshot. Pure: takes the
  * current entries and returns the next ones plus a result summary, mutating
- * nothing. Throws `BridgeHubProtocolError` for an invalid request or an
- * unresolved project_id conflict; on throw, `registry` is guaranteed untouched
- * because nothing is written until every conflict check has passed.
+ * nothing. Throws `BridgeHubProtocolError` only for a malformed registry or
+ * request; a project_id already held by another terminal is no longer fatal —
+ * see the contention rules inline.
  */
-export function applyBridgeHubRegistration({ registry, request, remoteAddress, now = new Date() }) {
+export function applyBridgeHubRegistration({ registry, request, remoteAddress, now = new Date(),
+  ttlMs = BRIDGE_HUB_HEARTBEAT_TTL_MS }) {
   if (!validRegistry(registry)) {
     throw new BridgeHubProtocolError('BRIDGE_HUB_REGISTRY_INVALID', 'bridge hub registry is invalid');
   }
@@ -119,30 +120,44 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
   const requestedSet = new Set(projectIds);
   const adoptSet = new Set(adopt);
 
-  const conflicts = registry
-    .filter((entry) => requestedSet.has(entry.project_id)
-      && entry.terminal_id !== terminalId && !adoptSet.has(entry.project_id))
-    .map((entry) => ({ project_id: entry.project_id, owning_terminal_id: entry.terminal_id }));
-  if (conflicts.length > 0) {
-    throw new BridgeHubProtocolError('BRIDGE_HUB_PROJECT_CONFLICT',
-      'one or more project_ids are already owned by a different terminal',
-      {
-        conflicts: conflicts.sort((left, right) => left.project_id.localeCompare(right.project_id, 'en')),
-        next_action: 're-register naming the conflicting project_ids in adopt',
-      });
-  }
+  // A heartbeat carries the terminal's whole active set, so one contested
+  // project_id used to fail the entire request and strand every unrelated
+  // project on that terminal — invisibly, since the daemon only logs the
+  // rejection to a stderr nobody reads. Contested ids are now settled one at a
+  // time and the rest are accepted:
+  //
+  //   owner offline (no heartbeat within the TTL) — the entry is very likely a
+  //     leftover from a terminal that moved on, so the live claimant takes it
+  //     over. Nothing else ever retracts it: entries are never expired.
+  //   owner online — the project genuinely belongs to another live terminal.
+  //     Reject just that id and report it, so the operator can adopt on purpose.
+  //     Handing it over unconditionally would make two live terminals trade
+  //     ownership every heartbeat and flip the published route back and forth.
+  const claimed = registry.filter((entry) => requestedSet.has(entry.project_id)
+    && entry.terminal_id !== terminalId && !adoptSet.has(entry.project_id));
+  const offline = (entry) => now.getTime() - Date.parse(entry.last_seen_at) > ttlMs;
+  const rejected = claimed.filter((entry) => !offline(entry))
+    .map((entry) => ({ project_id: entry.project_id, owning_terminal_id: entry.terminal_id }))
+    .sort((left, right) => left.project_id.localeCompare(right.project_id, 'en'));
+  const reclaimed = sorted(claimed.filter(offline).map((entry) => entry.project_id));
+
+  const rejectedSet = new Set(rejected.map((entry) => entry.project_id));
+  const acceptedIds = projectIds.filter((projectId) => !rejectedSet.has(projectId));
+  const acceptedSet = new Set(acceptedIds);
 
   const registeredAtByProject = new Map(registry
     .filter((entry) => entry.terminal_id === terminalId)
     .map((entry) => [entry.project_id, entry.registered_at]));
-  const adopted = sorted(projectIds.filter((projectId) => adoptSet.has(projectId)
+  const adopted = sorted(acceptedIds.filter((projectId) => adoptSet.has(projectId)
     && !registeredAtByProject.has(projectId)));
   // Full-state reconciliation: every entry this terminal owned is dropped, then
-  // rebuilt from `projectIds`. A project omitted from this call — dropped
+  // rebuilt from the accepted ids. A project omitted from this call — dropped
   // locally, or never re-sent after a crash — is released, not left as a
-  // phantom no future heartbeat can retract.
-  const others = registry.filter((entry) => entry.terminal_id !== terminalId && !requestedSet.has(entry.project_id));
-  const mine = projectIds.map((projectId) => ({
+  // phantom no future heartbeat can retract. Rejected ids stay with their live
+  // owner, so `others` keeps them.
+  const others = registry.filter((entry) => entry.terminal_id !== terminalId
+    && !acceptedSet.has(entry.project_id));
+  const mine = acceptedIds.map((projectId) => ({
     project_id: projectId,
     terminal_id: terminalId,
     display_name: displayName,
@@ -157,12 +172,18 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
   return {
     registry: nextRegistry,
     result: {
-      schema: 'lattice.bridge_hub_registration_result.v1',
+      // v2: partial acceptance. v1 answered a contested id with a 409 that threw
+      // the whole request away; v2 accepts what it can and names what it could
+      // not. A v1 terminal reading a v2 result sees a 200 and simply does not
+      // notice `rejected` — still strictly better than losing every project.
+      schema: 'lattice.bridge_hub_registration_result.v2',
       terminal_id: terminalId,
       address: remoteAddress,
       port,
-      registered: sorted(projectIds),
+      registered: sorted(acceptedIds),
       adopted,
+      rejected,
+      reclaimed_from_offline: reclaimed,
     },
   };
 }
@@ -170,8 +191,9 @@ export function applyBridgeHubRegistration({ registry, request, remoteAddress, n
 /**
  * Read-time projection for the aggregate `/projects/` view and per-project
  * routing. Never mutates or drops entries — a terminal that stopped
- * heartbeating shows as 'offline' forever, not gone, until it either
- * re-registers or a different terminal explicitly adopts the project.
+ * heartbeating shows as 'offline' forever, not gone, until it re-registers, a
+ * different terminal explicitly adopts the project, or a different terminal
+ * claims it while this one is past the TTL (see applyBridgeHubRegistration).
  */
 export function projectBridgeHubRegistry({ registry, now = new Date(), ttlMs = BRIDGE_HUB_HEARTBEAT_TTL_MS }) {
   if (!validRegistry(registry)) {

package/src/bridge-hub-server.mjs

@@ -436,14 +436,17 @@ export async function startBridgeHubServer({
     try {
       result = await registrationLock(async () => {
         const entries = await store.read();
-        const applied = applyBridgeHubRegistration({ registry: entries, request, remoteAddress, now: now() });
+        const applied = applyBridgeHubRegistration({
+          registry: entries, request, remoteAddress, now: now(), ttlMs,
+        });
         await store.write(applied.registry);
         return applied.result;
       });
     } catch (error) {
       if (error instanceof BridgeHubProtocolError) {
-        const status = error.code === 'BRIDGE_HUB_PROJECT_CONFLICT' ? 409
-          : error.code === 'BRIDGE_HUB_REGISTRATION_INVALID' ? 400 : 500;
+        // A contested project_id no longer throws — it comes back in the 200
+        // body's `rejected`. Only a malformed request or registry lands here.
+        const status = error.code === 'BRIDGE_HUB_REGISTRATION_INVALID' ? 400 : 500;
         respondError(response, status, error.code, error.detail ?? null);
         return;
       }

package/src/bridge-server.mjs

@@ -193,6 +193,7 @@ export async function startBridgeServer({
   instanceToken = null,
   resolveUpstream = (upstream) => resolveBridgeUpstream(upstream, { env }),
   interfaces = networkInterfaces(),
+  heartbeat = () => null,
 } = {}) {
   if (config?.enabled !== true) throw new BridgeConfigError('BRIDGE_DISABLED', 'bridge is disabled');
   if (!Array.isArray(config.allowed_hosts) || config.allowed_hosts.length === 0) {
@@ -240,7 +241,11 @@ export async function startBridgeServer({
           address: currentConfig.listen.address, port: currentConfig.listen.port,
           updated_at: currentConfig.updated_at ?? null,
           version: packageJson.version, node_path: process.execPath,
-          node_version: process.version, bridge_path: process.argv[1] ?? null }
+          node_version: process.version, bridge_path: process.argv[1] ?? null,
+          // The hub's answer to our last registration. Nothing else carries it
+          // out of the daemon: the LaunchAgent has no StandardErrorPath, so a
+          // hub refusing our projects was previously invisible everywhere.
+          last_heartbeat: heartbeat() }
         : { schema: 'lattice.bridge_health.v1', status: 'available' })}\n`);
       return;
     }
@@ -321,6 +326,7 @@ export function bridgeRuntimeController({
   register = registerBridgeUpstream,
   report = (line) => process.stderr.write(`${line}\n`),
   readInterfaces = () => networkInterfaces(),
+  heartbeat = () => null,
 } = {}) {
   let active = null;
   let fingerprint = null;
@@ -371,7 +377,7 @@ export function bridgeRuntimeController({
         fingerprint = next;
         return active;
       }
-      const replacement = await startBridgeServer({ config, env, instanceToken, interfaces });
+      const replacement = await startBridgeServer({ config, env, instanceToken, interfaces, heartbeat });
       const previous = active;
       active = replacement;
       fingerprint = next;

package/src/cli-help.mjs

@@ -43,6 +43,7 @@ Commands:
   intake --run .lattice/runs/<id> --task <task_id>
   intake release --run .lattice/runs/<id> --task <task_id>
   intake attach --run .lattice/runs/<id> --task <task_id> --input <worker.json>
+  intake detach --run .lattice/runs/<id> --task <task_id>
   intake intervention --run .lattice/runs/<id> --task <task_id>
   intake accept --run .lattice/runs/<id> --task <task_id>
   adapter register --input <descriptor.json>
@@ -194,6 +195,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'run intake': 'run intake --run .lattice/runs/<id> --task <task_id>',
   'run intake release': 'run intake release --run .lattice/runs/<id> --task <task_id>',
   'run intake attach': 'run intake attach --run .lattice/runs/<id> --task <task_id> --input <worker.json>',
+  'run intake detach': 'run intake detach --run .lattice/runs/<id> --task <task_id>',
   'run intake intervention': 'run intake intervention --run .lattice/runs/<id> --task <task_id>',
   'run intake accept': 'run intake accept --run .lattice/runs/<id> --task <task_id>',
   'run adapter register': 'run adapter register --input <descriptor.json> | --schema --json',

package/src/runtime-cli.mjs

@@ -100,6 +100,7 @@ import {
   acceptPullTask,
   attachPullWorker,
   closePullRun,
+  detachPullWorker,
   inspectRunMode as inspectPullRunMode,
   intakePullTask,
   interventionPullTask,
@@ -4411,6 +4412,15 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
       const output = await releasePullTask({ runDir, taskId: argv[6] });
       stdout.write(`${JSON.stringify(output)}\n`); return 0;
     };
+  } else if (argv.length === 7
+    && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'detach'
+    && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0
+    && argv[5] === '--task' && typeof argv[6] === 'string' && argv[6].length > 0) {
+    action = async () => {
+      const { runDir } = await resolveRunStore(cwd, argv[4]);
+      const output = await detachPullWorker({ runDir, taskId: argv[6] });
+      stdout.write(`${JSON.stringify(output)}\n`); return 0;
+    };
   } else if (argv.length === 9
     && argv[0] === 'run' && argv[1] === 'intake' && argv[2] === 'attach'
     && argv[3] === '--run' && typeof argv[4] === 'string' && argv[4].length > 0

package/src/runtime-pull-intake.mjs

@@ -216,6 +216,7 @@ function project(events, meta) {
         sequence: event.sequence,
         ...structuredClone(event.payload),
         worker: null,
+        worker_detached: false,
         accepted: null,
       });
     } else if (event.kind === 'intake_refreshed') {
@@ -235,6 +236,13 @@ function project(events, meta) {
     } else if (event.kind === 'worker_stopped' || event.kind === 'worker_resumed') {
       const intake = intakes.get(event.task_id);
       if (intake?.worker) intake.worker.stopped = event.kind === 'worker_stopped';
+    } else if (event.kind === 'worker_detached') {
+      const intake = intakes.get(event.task_id);
+      // `worker_detached` is remembered separately from `worker === null`: an
+      // intake that never had a worker and one whose worker was deliberately
+      // unbound look identical otherwise, and only the latter may be released
+      // by an operator who is not the original seat.
+      if (intake) { intake.worker = null; intake.worker_detached = true; }
     } else if (event.kind === 'task_accepted') {
       const intake = intakes.get(event.task_id);
       if (intake) intake.accepted = structuredClone(event.payload);
@@ -287,6 +295,20 @@ function sameActor(left, right) {
   return left?.host === right.host && left?.session === right.session && left?.agent === right.agent;
 }
 
+/**
+ * The acting actor when the caller has one, `null` when it does not.
+ *
+ * Recovery is performed by an operator who is by definition NOT the seat being
+ * recovered — the seat may be SIGSTOP'd, dead, or from a session that no longer
+ * exists. Demanding the seat's own env-derived identity on a recovery command
+ * would mean only the frozen seat could unfreeze itself, which is the trap this
+ * whole path exists to remove. The actor is recorded when present so the trail
+ * survives, but it is not an authorization gate here.
+ */
+function optionalActorFromEnvironment(environment = process.env) {
+  try { return actorFromEnvironment(environment); } catch { return null; }
+}
+
 function activeMember(store, planKey) {
   const member = store.members?.find((entry) => entry.plan?.plan_key === planKey);
   if (!member) fail('PLAN_NOT_ACTIVE', `active planが見つからない: ${planKey}`);
@@ -805,10 +827,15 @@ export async function releasePullTask({ runDir, taskId, environment = process.en
     if (intake.worker !== null) {
       fail('INTAKE_WORKER_ATTACHED', 'workerがattach済みのintakeはreleaseできない', {
         task_id: taskId,
-        next_action: 'workerを安全に停止・detachできる正規経路を先に使う',
+        next_action: 'lattice run intake detach --run <run> --task <task> --json',
       });
     }
-    if (!sameActor(intake.actor, actor)) {
+    // The actor gate protects a seat's own in-progress work from another seat.
+    // Once the worker is detached there is no seat left to protect, and demanding
+    // the original session's identity would block the operator performing the
+    // recovery — the seat that owned this intake is precisely the one that is
+    // gone. The releasing actor is recorded either way.
+    if (intake.worker_detached !== true && !sameActor(intake.actor, actor)) {
       fail('INTAKE_BINDING_CONFLICT', 'intakeを作成したactorだけがreleaseできる', {
         task_id: taskId,
       });
@@ -930,6 +957,66 @@ export async function attachPullWorker({ runDir, taskId, input, environment = pr
   } finally { await lock.release(); }
 }
 
+/**
+ * Unbind a worker from its intake, releasing it first if the hold stopped it.
+ *
+ * This is the door `releasePullTask`'s own `next_action` already names. Without
+ * it a hold that can never clear leaves the seat SIGSTOP'd with no legitimate
+ * exit: `run close` refuses while the intake is unaccepted, `run intake release`
+ * refuses while a worker is attached, and `run abandon` is legacy-only. A shared
+ * pull run over a repo with no indexable code reached exactly that state
+ * (2026-08-10) — the sensor could not stamp an empty index, so the boundary was
+ * never verifiable and the hold was permanent.
+ *
+ * Authorization is process identity, not the actor: `signalAttachedWorker`
+ * re-verifies lstart/argv/pgid against the recorded binding before signalling,
+ * which is strictly stronger than an env-derived actor claim (env vars are
+ * trivially settable; a process's start identity is not). See
+ * `optionalActorFromEnvironment` for why the seat's own identity cannot be the
+ * gate on a recovery command.
+ */
+export async function detachPullWorker({ runDir, taskId, environment = process.env }) {
+  if (!identifier(taskId)) fail('INVALID_TASK_ID', 'task idが不正');
+  const actor = optionalActorFromEnvironment(environment);
+  const lock = await acquirePullLock(runDir, 'detach', `${taskId}-${randomUUID()}`);
+  try {
+    let current = await readPullStore(runDir);
+    const state = project(current.events, current.meta);
+    if (state.closed) fail('RUN_CLOSED', 'closed pull runのworkerをdetachできない');
+    const intake = state.intakes.find((entry) => entry.task_id === taskId);
+    if (intake === undefined) fail('INTAKE_NOT_FOUND', 'active intakeが存在しない', { task_id: taskId });
+    if (intake.accepted !== null) {
+      fail('INTAKE_ALREADY_ACCEPTED', 'accepted intakeのworkerはdetachできない', { task_id: taskId });
+    }
+    if (intake.worker === null) {
+      fail('INTAKE_WORKER_ABSENT', 'attach済みworkerが無い', { task_id: taskId });
+    }
+    // Resume before unbinding. Once the binding is gone nothing in this store can
+    // name that pid again, so a worker left stopped here would be unreachable by
+    // any future command — the same one-way door, one step further along.
+    const resumed = intake.worker.stopped;
+    if (resumed) {
+      await signalAttachedWorker(intake, 'SIGCONT');
+      current = await appendEvent(runDir, current, buildEvent({
+        events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
+        payload: { released_by: 'worker_detach' },
+      }));
+    }
+    current = await appendEvent(runDir, current, buildEvent({
+      events: current.events, meta: current.meta, kind: 'worker_detached', taskId,
+      payload: { detached_by: actor, pid: intake.worker.pid, resumed },
+    }));
+    const output = {
+      schema: 'lattice.pull_worker_detach_result.v1', outcome: 'detached',
+      run_id: state.run_id, task_id: taskId, pid: intake.worker.pid, resumed,
+      next_action: 'lattice run intake release --run <run> --task <task> --json',
+      result_digest: '',
+    };
+    output.result_digest = digestArtifact(output);
+    return output;
+  } finally { await lock.release(); }
+}
+
 function observationModel(state) {
   const intakes = state.intakes.filter((entry) => (
     entry.accepted === null && entry.intervention.state !== 'hold'
@@ -1105,7 +1192,13 @@ export async function interventionPullTask(runDir, taskId) {
   if (!intake) fail('TASK_NOT_INTAKED', `taskがintakeされていない: ${taskId}`);
   const output = { schema: 'lattice.pull_intervention.v1', run_id: stored.meta.run_id,
     task_id: taskId, ...structuredClone(intake.intervention),
-    worker_attached: intake.worker !== null, worker_stopped: intake.worker?.stopped ?? false };
+    worker_attached: intake.worker !== null, worker_stopped: intake.worker?.stopped ?? false,
+    // `next_action` says how to clear the hold. When the seat is already frozen
+    // the operator also needs to know how to get out if it never clears — the
+    // absence of that answer is what turned one unverifiable boundary into an
+    // unrecoverable run (2026-08-10).
+    recovery: intake.worker?.stopped === true
+      ? 'lattice run intake detach --run <run> --task <task> --json' : null };
   output.result_digest = digestArtifact(output); return output;
 }
 

package/src/todo-cli.mjs

@@ -2676,6 +2676,50 @@ async function serveGantt({ repoRoot, port, stdout, env, scope = DEFAULT_GANTT_S
   return null;
 }
 
+/**
+ * Whether this command should mark the repo as an actively-worked project.
+ *
+ * Being "active" is not a local convenience: the bridge heartbeat sends every
+ * active project to the hub, and the hub routes the published dashboard from
+ * that set. So a command that flips this flag is claiming, on the operator's
+ * behalf, that this terminal serves this project — for the next two hours.
+ *
+ * A read must never make that claim. Running `lattice todo status` inside a
+ * clone to look at it once used to register the project here, contest it with
+ * whichever terminal actually serves it, and (before partial acceptance landed)
+ * take that terminal's whole project set down with it. The diagnosing operator
+ * extended the very outage they were investigating (2026-08-10).
+ *
+ * The rule is an allowlist of store writes, not a denylist of known-bad reads.
+ * The denylist it replaces had grown one incident at a time — `verify` was
+ * added to it the day before, after `todo verify` turned out to be unreachable
+ * for exactly the store inconsistency it exists to diagnose — and every read
+ * added later would have defaulted back to claiming ownership.
+ *
+ * `dashboard` commands are excluded: they own the registry themselves, and
+ * pre-registering the current repo ahead of `dashboard remove` would re-add
+ * what the operator is asking to drop.
+ */
+function writesTodoStore(argv) {
+  const [command, second, third] = argv;
+  if (argv.includes('--schema')) return false;
+  switch (command) {
+    case 'note': return second !== 'list';
+    case 'migrate': return !argv.includes('--dry-run');
+    case 'snapshot': return argv.includes('--rebuild');
+    case 'independence': return second === 'compile'
+      || (second === 'witness' && ['migrate', 'scaffold'].includes(third));
+    case 'seam-proposal': return ['compile', 'apply', 'land'].includes(second);
+    case 'evidence': return second === 'promote';
+    case 'dependency': return second === 'connect';
+    case 'phase': return second !== 'status';
+    case 'start': case 'retract': case 'block': case 'unblock': case 'done':
+    case 'reopen': case 'split': case 'revise': case 'revise-phase': case 'revise-set':
+      return true;
+    default: return false;
+  }
+}
+
 async function ensureActiveProjectDashboard({ repoRoot, env }) {
   if (env.LATTICE_DASHBOARD_AUTOSTART === '0') return null;
   const actorIdentity = ACTOR_ENV_KEYS.map((key) => env[key]);
@@ -3137,21 +3181,12 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
 
   try {
     const repoRoot = resolveRepoRoot(cwd);
-    const ganttCommand = argv[0] === 'gantt';
-    const dashboardAdopt = argv[0] === 'dashboard' && argv[1] === 'adopt';
-    const migrationDryRun = argv[0] === 'migrate' && argv.includes('--dry-run');
-    // `verify` is the store's own read-only recovery diagnostic — the command
-    // an operator reaches for precisely when the store might be inconsistent.
-    // ensureActiveProjectDashboard calls readTodoStoreStable for an unrelated
-    // side effect (registering this session as an active dashboard project),
-    // and readTodoStoreStable retries a persistent STORE_INCONSISTENT as if it
-    // were a transient in-flight write before giving up and reporting a
-    // content-free STORE_BUSY. Running that pre-hook ahead of `verify` meant
-    // the one command meant to surface the real inconsistency never got to —
-    // it died in the same generic way every other command did (2026-08-10 P0:
-    // `todo verify` was unreachable for the exact case it exists to diagnose).
-    const verifyCommand = argv[0] === 'verify';
-    if (!ganttCommand && !dashboardAdopt && !migrationDryRun && !verifyCommand) {
+    // Only a store write claims this terminal as the project's live source; see
+    // `writesTodoStore`. This also keeps the pre-hook away from `verify`, whose
+    // whole job is to diagnose a store too inconsistent for the pre-hook's own
+    // `readTodoStoreStable` to read (2026-08-10 P0: `todo verify` was
+    // unreachable for exactly the case it exists to diagnose).
+    if (writesTodoStore(argv)) {
       await ensureActiveProjectDashboard({ repoRoot, env });
     }
     const result = atomicCommit