@quolu/lattice 0.63.6 → 0.63.7

package/sensor/dist/mcp/server-instructions.js

@@ -18,79 +18,79 @@ exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = exports.SERVER_INSTRUCTIONS = void 0
  * burn tokens. ADR 0049 / 0059 require the eight compatibility tools to remain
  * visible by default; provider identity is Lattice regardless of their names.
  */
-exports.SERVER_INSTRUCTIONS = `# Lattice sensor — code intelligence over an indexed knowledge graph
-
-Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
-
-Lattice sensor is a SQLite knowledge graph of every symbol, edge, and file in
-the workspace — pre-computed structure you would otherwise re-derive by
-reading files (cached intelligence: thousands of parse/trace decisions you
-don't pay to re-reason each run). Reads are sub-millisecond; the index lags
-writes by ~1s through the file watcher. Reach for it BEFORE *and* while
-writing or editing code — not just for questions: one call returns the
-verbatim source PLUS who calls it and what it affects, so you edit with the
-blast radius in view. More accurate context, in far fewer tokens and
-round-trips than reading files yourself.
-
-## One tool: lattice_sensor_explore — use it instead of reading files
-
-There is a single tool, \`lattice_sensor_explore\`, and it is Read-equivalent. It
-takes either a natural-language question or a bag of symbol/file names and
-returns the **verbatim, line-numbered source** of the relevant symbols
-grouped by file — the same \`<n>\\t<line>\` shape \`Read\` gives you, safe to
-\`Edit\` from — PLUS the call path among them (including dynamic-dispatch hops
-like callbacks, React re-render, and JSX children that grep can't follow) and
-a blast-radius summary of what depends on them.
-
-Whether you're answering "how does X work" or implementing a change (fixing a
-bug, adding a feature), call \`lattice_sensor_explore\` before you Read. ONE call
-usually answers the whole question. Lattice sensor IS the pre-built search index —
-so running your own grep + read loop, or delegating the lookup to a separate
-file-reading sub-task/agent, repeats work lattice sensor already did and costs more
-for the same answer. A direct lattice sensor answer is typically one to a few
-calls; a grep/read exploration is dozens.
-
-## How to query
-
-- **Almost any question — "how does X work", architecture, a bug, "what/where is X", or surveying an area** → \`lattice_sensor_explore\` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.
-- **"How does X reach/become Y? / the flow / the path from X to Y"** → \`lattice_sensor_explore\`, naming the symbols that span the flow (e.g. \`mutateElement renderScene\`) — it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.
-- **Reading or editing a file/symbol you can name** → put its name or file path in the \`lattice_sensor_explore\` query — it returns that current line-numbered source (safe to \`Edit\` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.
-- **Need more?** Call \`lattice_sensor_explore\` again with more specific names — treat the source it returns as already Read.
-
-## Anti-patterns
-
-- **Trust lattice sensor's results — don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.
-- **Don't grep or Read first** to find or understand indexed code — ONE \`lattice_sensor_explore\` returns the relevant symbols' source together in a single round-trip. Reach for raw \`Read\`/\`Grep\` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).
-- **Don't reconstruct a flow by hand** — name the endpoints in one \`lattice_sensor_explore\` and it surfaces the path between them, dynamic-dispatch hops included.
-- **After editing, check the staleness banner.** When a tool response starts with "⚠️ Some files referenced below were edited since the last index sync…", the listed files are pending re-index — Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner — "⚠️ LatticeSensor auto-sync is DISABLED…" — means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.
-- **A file flagged "⚠ changed on disk after the last index sync" drifted from its index** (most common on projects queried via \`projectPath\`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file — it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.
-
-## Limitations
-
-- If a project isn't indexed (no \`.lattice/sensor/\`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.
-- Index lags file writes by ~1 second.
-- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.
-- No live correctness validation — that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.
-
-## Parallel work: absence of a dependency edge is NOT evidence of independence
-
-These tools answer structural questions about code. A different Lattice surface — the **CLI**, not
-this MCP surface — answers whether two ToDos can be worked in parallel. If the project uses
-\`lattice todo\` for process tracking, keep this distinction in mind:
-
-- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.
-  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no
-  edge between them and will still collide.
-- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with
-  \`lattice todo independence --plan <key> --json\`. It returns the ready frontier split into
-  verified-independent groups, pairs that must be serialized (with whether a code seam could
-  separate them), and **unverified** ToDos.
-- \`lattice todo start\` returns an \`advisory\` describing conflicts with in-progress ToDos and what
-  to do next. \`coverage: "missing"\` means "not judged yet" — never "no conflicts".
-- Run \`lattice todo --help\` for the declare → compile → read workflow.
-
-Evidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this
-MCP surface is prose for you to act on, never an input to those contracts.
+exports.SERVER_INSTRUCTIONS = `# Lattice sensor — code intelligence over an indexed knowledge graph
+
+Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
+
+Lattice sensor is a SQLite knowledge graph of every symbol, edge, and file in
+the workspace — pre-computed structure you would otherwise re-derive by
+reading files (cached intelligence: thousands of parse/trace decisions you
+don't pay to re-reason each run). Reads are sub-millisecond; the index lags
+writes by ~1s through the file watcher. Reach for it BEFORE *and* while
+writing or editing code — not just for questions: one call returns the
+verbatim source PLUS who calls it and what it affects, so you edit with the
+blast radius in view. More accurate context, in far fewer tokens and
+round-trips than reading files yourself.
+
+## One tool: lattice_sensor_explore — use it instead of reading files
+
+There is a single tool, \`lattice_sensor_explore\`, and it is Read-equivalent. It
+takes either a natural-language question or a bag of symbol/file names and
+returns the **verbatim, line-numbered source** of the relevant symbols
+grouped by file — the same \`<n>\\t<line>\` shape \`Read\` gives you, safe to
+\`Edit\` from — PLUS the call path among them (including dynamic-dispatch hops
+like callbacks, React re-render, and JSX children that grep can't follow) and
+a blast-radius summary of what depends on them.
+
+Whether you're answering "how does X work" or implementing a change (fixing a
+bug, adding a feature), call \`lattice_sensor_explore\` before you Read. ONE call
+usually answers the whole question. Lattice sensor IS the pre-built search index —
+so running your own grep + read loop, or delegating the lookup to a separate
+file-reading sub-task/agent, repeats work lattice sensor already did and costs more
+for the same answer. A direct lattice sensor answer is typically one to a few
+calls; a grep/read exploration is dozens.
+
+## How to query
+
+- **Almost any question — "how does X work", architecture, a bug, "what/where is X", or surveying an area** → \`lattice_sensor_explore\` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.
+- **"How does X reach/become Y? / the flow / the path from X to Y"** → \`lattice_sensor_explore\`, naming the symbols that span the flow (e.g. \`mutateElement renderScene\`) — it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.
+- **Reading or editing a file/symbol you can name** → put its name or file path in the \`lattice_sensor_explore\` query — it returns that current line-numbered source (safe to \`Edit\` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.
+- **Need more?** Call \`lattice_sensor_explore\` again with more specific names — treat the source it returns as already Read.
+
+## Anti-patterns
+
+- **Trust lattice sensor's results — don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.
+- **Don't grep or Read first** to find or understand indexed code — ONE \`lattice_sensor_explore\` returns the relevant symbols' source together in a single round-trip. Reach for raw \`Read\`/\`Grep\` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).
+- **Don't reconstruct a flow by hand** — name the endpoints in one \`lattice_sensor_explore\` and it surfaces the path between them, dynamic-dispatch hops included.
+- **After editing, check the staleness banner.** When a tool response starts with "⚠️ Some files referenced below were edited since the last index sync…", the listed files are pending re-index — Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner — "⚠️ LatticeSensor auto-sync is DISABLED…" — means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.
+- **A file flagged "⚠ changed on disk after the last index sync" drifted from its index** (most common on projects queried via \`projectPath\`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file — it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.
+
+## Limitations
+
+- If a project isn't indexed (no \`.lattice/sensor/\`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.
+- Index lags file writes by ~1 second.
+- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.
+- No live correctness validation — that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.
+
+## Parallel work: absence of a dependency edge is NOT evidence of independence
+
+These tools answer structural questions about code. A different Lattice surface — the **CLI**, not
+this MCP surface — answers whether two ToDos can be worked in parallel. If the project uses
+\`lattice todo\` for process tracking, keep this distinction in mind:
+
+- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.
+  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no
+  edge between them and will still collide.
+- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with
+  \`lattice todo independence --plan <key> --json\`. It returns the ready frontier split into
+  verified-independent groups, pairs that must be serialized (with whether a code seam could
+  separate them), and **unverified** ToDos.
+- \`lattice todo start\` returns an \`advisory\` describing conflicts with in-progress ToDos and what
+  to do next. \`coverage: "missing"\` means "not judged yet" — never "no conflicts".
+- Run \`lattice todo --help\` for the declare → compile → read workflow.
+
+Evidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this
+MCP surface is prose for you to act on, never an input to those contracts.
 `;
 /**
  * Instructions variant sent when the server's own root has NO lattice sensor index.
@@ -104,27 +104,27 @@ MCP surface is prose for you to act on, never an input to those contracts.
  * project playbook ({@link SERVER_INSTRUCTIONS}) is sent instead when the root
  * IS indexed, so the common case stays tight.
  */
-exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = `# Lattice sensor — available (per-project; pass projectPath)
-
-Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
-
-Lattice sensor is a SQLite knowledge graph of a codebase's symbols, edges, and
-files: one \`lattice_sensor_explore\` call returns the verbatim, line-numbered source
-of the relevant symbols PLUS the call paths between them and a blast-radius
-summary — replacing a grep + Read loop with one round-trip.
-
-This server started somewhere with no \`.lattice/sensor/\` of its own, so there is no
-default project — but the tools are available and work **per project**:
-
-- To query a project that HAS a \`.lattice/sensor/\` index (e.g. a service inside a
-  monorepo, or a second repo), pass its path as \`projectPath\` to
-  \`lattice_sensor_explore\` (and any other lattice sensor tool). Lattice sensor resolves the
-  nearest \`.lattice/sensor/\` at or above that path and answers from it — for as many
-  projects as you like in one session.
-- For a project with no \`.lattice/sensor/\`, decide whether the expected reduction in
-  repeated Read/Grep work justifies the one-time indexing cost. When workspace writes
-  and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\`
-  yourself and then retry with that \`projectPath\`; otherwise use built-in tools and
-  tell the user the exact init command. A new index is picked up live, with no restart.
+exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = `# Lattice sensor — available (per-project; pass projectPath)
+
+Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
+
+Lattice sensor is a SQLite knowledge graph of a codebase's symbols, edges, and
+files: one \`lattice_sensor_explore\` call returns the verbatim, line-numbered source
+of the relevant symbols PLUS the call paths between them and a blast-radius
+summary — replacing a grep + Read loop with one round-trip.
+
+This server started somewhere with no \`.lattice/sensor/\` of its own, so there is no
+default project — but the tools are available and work **per project**:
+
+- To query a project that HAS a \`.lattice/sensor/\` index (e.g. a service inside a
+  monorepo, or a second repo), pass its path as \`projectPath\` to
+  \`lattice_sensor_explore\` (and any other lattice sensor tool). Lattice sensor resolves the
+  nearest \`.lattice/sensor/\` at or above that path and answers from it — for as many
+  projects as you like in one session.
+- For a project with no \`.lattice/sensor/\`, decide whether the expected reduction in
+  repeated Read/Grep work justifies the one-time indexing cost. When workspace writes
+  and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\`
+  yourself and then retry with that \`projectPath\`; otherwise use built-in tools and
+  tell the user the exact init command. A new index is picked up live, with no restart.
 `;
 //# sourceMappingURL=server-instructions.js.map

package/sensor/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "@quolu/lattice-sensor",
-  "version": "0.7.3-lattice.1",
-  "private": true,
-  "description": "Lattice-owned local structural sensor.",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/kitepon/Lattice.git"
-  },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "npm run clean && tsc && npm run copy-assets",
-    "copy-assets": "node -e \"const fs=require('fs');fs.mkdirSync('dist/db',{recursive:true});fs.copyFileSync('src/db/schema.sql','dist/db/schema.sql');fs.mkdirSync('dist/extraction/wasm',{recursive:true});fs.readdirSync('src/extraction/wasm').filter(f=>f.endsWith('.wasm')).forEach(f=>fs.copyFileSync('src/extraction/wasm/'+f,'dist/extraction/wasm/'+f))\"",
-    "dev": "tsc --watch",
-    "build:kernel": "bash scripts/build-kernel.sh",
-    "test": "vitest run --maxWorkers=4 --minWorkers=1",
-    "test:watch": "vitest",
-    "test:eval": "vitest run __tests__/evaluation/",
-    "eval": "npm run build && npx tsx __tests__/evaluation/runner.ts",
-    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\""
-  },
-  "keywords": [
-    "code-intelligence",
-    "knowledge-graph",
-    "static-analysis"
-  ],
-  "author": "",
-  "license": "MIT",
-  "dependencies": {
-    "@clack/prompts": "^1.3.0",
-    "commander": "^14.0.2",
-    "fast-string-width": "^3.0.2",
-    "fast-wrap-ansi": "^0.2.0",
-    "ignore": "^7.0.5",
-    "jsonc-parser": "^3.3.1",
-    "picomatch": "^4.0.4",
-    "sisteransi": "^1.0.5",
-    "tree-sitter-wasms": "^0.1.11",
-    "web-tree-sitter": "^0.25.3"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.0",
-    "@types/node": "^20.19.30",
-    "@types/picomatch": "^4.0.2",
-    "typescript": "^5.0.0",
-    "vitest": "^2.1.9"
-  },
-  "engines": {
-    "node": ">=20.0.0 <25.0.0 || >=26.0.0"
-  }
-}
+{
+  "name": "@quolu/lattice-sensor",
+  "version": "0.7.3-lattice.1",
+  "private": true,
+  "description": "Lattice-owned local structural sensor.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kitepon/Lattice.git"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "npm run clean && tsc && npm run copy-assets",
+    "copy-assets": "node -e \"const fs=require('fs');fs.mkdirSync('dist/db',{recursive:true});fs.copyFileSync('src/db/schema.sql','dist/db/schema.sql');fs.mkdirSync('dist/extraction/wasm',{recursive:true});fs.readdirSync('src/extraction/wasm').filter(f=>f.endsWith('.wasm')).forEach(f=>fs.copyFileSync('src/extraction/wasm/'+f,'dist/extraction/wasm/'+f))\"",
+    "dev": "tsc --watch",
+    "build:kernel": "bash scripts/build-kernel.sh",
+    "test": "vitest run --maxWorkers=4 --minWorkers=1",
+    "test:watch": "vitest",
+    "test:eval": "vitest run __tests__/evaluation/",
+    "eval": "npm run build && npx tsx __tests__/evaluation/runner.ts",
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\""
+  },
+  "keywords": [
+    "code-intelligence",
+    "knowledge-graph",
+    "static-analysis"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "@clack/prompts": "^1.3.0",
+    "commander": "^14.0.2",
+    "fast-string-width": "^3.0.2",
+    "fast-wrap-ansi": "^0.2.0",
+    "ignore": "^7.0.5",
+    "jsonc-parser": "^3.3.1",
+    "picomatch": "^4.0.4",
+    "sisteransi": "^1.0.5",
+    "tree-sitter-wasms": "^0.1.11",
+    "web-tree-sitter": "^0.25.3"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.0",
+    "@types/node": "^20.19.30",
+    "@types/picomatch": "^4.0.2",
+    "typescript": "^5.0.0",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=20.0.0 <25.0.0 || >=26.0.0"
+  }
+}

package/src/cli-help.mjs

@@ -106,6 +106,7 @@ Write commands:
         # 監査と構造finalizationは残作業であり、doneの門ではない
   reopen --plan <key> --task <id> --reason <text> [--override-reason <text>]
   evidence promote --plan <key> --task <id> --evidence <file>
+      # done状態と完了時刻を維持し、最新doneへ追記eventで証拠を再束縛する
   dependency connect --from-plan <key> --from-task <id> --to-plan <key> --to-task <id> --reason <text>
       # 開発中に発見したplan跨ぎ依存を明示接続する。依存の自動推定は行わない
   independence compile --plan <key> --input <file>  # witness setとsensorから並列可否を記録する

package/src/todo-cli.mjs

@@ -631,7 +631,10 @@ async function mutate({
     eventPayload = { evidence, ...(testResult === null ? {} : { test_result: testResult }) };
   }
   if (kind === 'done' && payload === 'evidence_promotion') {
-    eventPayload = { done_mode: 'evidence_promotion', imported: true, evidence };
+    // imported/authored の由来はlock内のcanonical stateから解決する。
+    // CLI側で固定するとauthored doneの証拠を再束縛できず、path更新後の
+    // evidence_unverifiedを修復する公開経路が無くなる。
+    eventPayload = { done_mode: 'evidence_promotion', evidence };
   }
   const { event, snapshot, plan, phases } = await appendTodoEvent({
     repoRoot,

package/src/todo-contracts.mjs

@@ -544,7 +544,8 @@ function validPayload(event) {
   }
   if (event.kind === 'done' && payload?.done_mode === 'evidence_promotion') {
     return exactRecord(payload, ['done_mode', 'imported', 'target_done_digest', 'evidence'])
-      && payload.imported === true && isTodoDigest(payload.target_done_digest) && evidence(payload.evidence);
+      && typeof payload.imported === 'boolean'
+      && isTodoDigest(payload.target_done_digest) && evidence(payload.evidence);
   }
   if (event.kind === 'reopen') return exactRecord(payload, ['reason', 'target_done_digest', 'override_reason'])
     && nullableText(payload.reason) && payload.reason !== null && isTodoDigest(payload.target_done_digest)
@@ -599,7 +600,11 @@ function validCarriedState(value) {
   if (value.status === 'blocked') return value.done_at === null && value.blocked_reason !== null
     && activeEvidenceValid && testResult === null;
   return value.blocked_reason === null && value.evidence !== null
-    && (value.imported ? validateTodoImportSource(value.evidence) : evidence(value.evidence));
+    // importedは完了状態の来歴を表す。evidence_promotion後もtrueを維持するため、
+    // imported doneの現在証拠はimport sourceまたは通常evidence descriptorのどちらも有効。
+    && (value.imported
+      ? validateTodoImportSource(value.evidence) || evidence(value.evidence)
+      : evidence(value.evidence));
 }
 
 function validStateMigration(value) {

package/src/todo-store.mjs

@@ -59,6 +59,7 @@ const CROSS_PLAN_RECOVERY_CLAIMS_REF = `${STORE_ROOT_REF}/.cross-plan-recovery`;
 const CROSS_PLAN_IMPORT_TRANSACTION_SCHEMA = 'lattice.todo_cross_plan_import_transaction.v1';
 const SOURCE_CUTOVER_BARRIER_REF = `${STORE_ROOT_REF}/source-cutover-recovery.json`;
 const SOURCE_CUTOVER_RECOVERY_CAPABILITY = Symbol('lattice.todo.source-cutover-recovery');
+const EVIDENCE_REPAIR_CAPABILITY = Symbol('lattice.todo.evidence-repair');
 const MAX_FUTURE_SKEW_MS = 5 * 60 * 1_000;
 const WRITER_CALLERS = new Set(['g4-migration', 'g5-authoring']);
 const TODO_REVISION_SCHEMAS = Object.freeze([
@@ -534,8 +535,11 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
           Object.assign(state, structuredClone(migration.state), { evidence_unverified: false });
           if (state.evidence !== null) {
             const evidence = state.evidence;
-            const context = { plan_key: plan.plan_key, task_id: migration.to_task_id };
-            if (state.imported) {
+            const context = { plan_key: plan.plan_key, task_id: migration.to_task_id,
+              event_digest: event.event_digest };
+            // importedは完了の来歴であって現在のdescriptor型ではない。promotion後の
+            // imported doneは通常evidenceを持つため、descriptor自身から検証器を選ぶ。
+            if (validateTodoImportSource(evidence)) {
               if (verifyImportSource) {
                 pendingVerifications.set(`task:${migration.to_task_id}`, () => verifyImportSource(evidence, context));
               }
@@ -655,7 +659,7 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
         if (verifyImportSource) {
           const evidence = event.payload.evidence;
           pendingVerifications.set(`task:${event.task_id}`, () => verifyImportSource(evidence, {
-            plan_key: plan.plan_key, task_id: event.task_id,
+            plan_key: plan.plan_key, task_id: event.task_id, event_digest: event.event_digest,
           }));
         }
         state.status = 'in-progress';
@@ -709,7 +713,7 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
         if (verifyEvidence) {
           const evidence = event.payload.evidence;
           pendingVerifications.set(`task:${event.task_id}`, () => verifyEvidence(evidence, {
-            plan_key: plan.plan_key, task_id: event.task_id,
+            plan_key: plan.plan_key, task_id: event.task_id, event_digest: event.event_digest,
           }));
         }
         state.status = 'done'; state.done_at = event.recorded_at; state.evidence = event.payload.evidence;
@@ -721,7 +725,7 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
         if (verifyImportSource) {
           const evidence = event.payload.evidence;
           pendingVerifications.set(`task:${event.task_id}`, () => verifyImportSource(evidence, {
-            plan_key: plan.plan_key, task_id: event.task_id,
+            plan_key: plan.plan_key, task_id: event.task_id, event_digest: event.event_digest,
           }));
         }
         state.status = 'done'; state.done_at = event.payload.completed_at === 'unknown_requires_evidence'
@@ -730,15 +734,27 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
         completion.set(event.task_id, { mode: 'historical_import', completed_at: event.payload.completed_at });
       } else {
         const current = completion.get(event.task_id);
-        if (state.status !== 'done' || current?.mode !== 'historical_import'
-          || current.completed_at !== 'unknown_requires_evidence'
-          || doneDigest.get(event.task_id) !== event.payload.target_done_digest) {
-          fail('STORE_INCONSISTENT', 'invalid_evidence_promotion');
+        const expectedTarget = doneDigest.get(event.task_id) ?? null;
+        if (state.status !== 'done' || current === undefined
+          || state.imported !== event.payload.imported
+          || expectedTarget !== event.payload.target_done_digest) {
+          fail('STORE_INCONSISTENT', 'invalid_evidence_promotion', {
+            task_id: event.task_id,
+            status: state.status,
+            current_completion_mode: current?.mode ?? null,
+            current_imported: state.imported,
+            requested_imported: event.payload.imported,
+            expected_target_done_digest: expectedTarget,
+            actual_target_done_digest: event.payload.target_done_digest,
+            eligible_status: 'done',
+            next_action: state.status === 'done'
+              ? 'retry_against_latest_done_state' : 'complete_the_task_before_promoting_evidence',
+          });
         }
         if (verifyEvidence) {
           const evidence = event.payload.evidence;
           pendingVerifications.set(`task:${event.task_id}`, () => verifyEvidence(evidence, {
-            plan_key: plan.plan_key, task_id: event.task_id,
+            plan_key: plan.plan_key, task_id: event.task_id, event_digest: event.event_digest,
           }));
         }
         state.evidence = event.payload.evidence;
@@ -1143,7 +1159,7 @@ function readEvidenceBlob(absoluteRepo, oid) {
   return entry.bytes;
 }
 
-function evidenceVerifier(manifest, repoRoot, hard) {
+function evidenceVerifier(manifest, repoRoot, hard, repair = null) {
   const repositories = new Map(manifest.repositories.map((repo) => [repo.repo_id, repo.path]));
   return (descriptor, context = {}) => {
     if (!validateEvidenceDescriptor(descriptor)) fail('STORE_INCONSISTENT', 'evidence_descriptor_invalid');
@@ -1166,6 +1182,15 @@ function evidenceVerifier(manifest, repoRoot, hard) {
       if (sha256Bytes(bytes) !== descriptor.content_digest) throw new Error('digest mismatch');
       return true;
     } catch {
+      const repairTarget = repair !== null
+        && typeof repair.taskId === 'string'
+        && context.plan_key === repair.planKey
+        && typeof context.task_id === 'string'
+        && context.task_id === repair.taskId;
+      // evidence promotionだけは、同じtaskの過去eventを新しいhard-verified eventで
+      // supersedeするためにここを通る。prospective event自身と他taskは免除しない。
+      if (repairTarget
+        && (repair.eventDigest === null || context.event_digest !== repair.eventDigest)) return false;
       if (hard) fail('STORE_INCONSISTENT', 'evidence_unverified', {
         ...context,
         next_action: context.plan_key === undefined
@@ -1325,13 +1350,20 @@ function liveReplacementPreservesListStructure(lineBytes, replacement) {
   return source !== null && target !== null && source[1] === target[1] && source[2] === target[2];
 }
 
-function importSourceVerifier(repoRoot, hard, cache = null) {
+function importSourceVerifier(repoRoot, hard, cache = null, repair = null) {
   return (descriptor, context = {}) => {
     if (!validateTodoImportSource(descriptor)) fail('STORE_INCONSISTENT', 'import_source_descriptor_invalid');
     try {
       pinnedSourceLine(repoRoot, descriptor, cache);
       return true;
     } catch {
+      const repairTarget = repair !== null
+        && typeof repair.taskId === 'string'
+        && context.plan_key === repair.planKey
+        && typeof context.task_id === 'string'
+        && context.task_id === repair.taskId;
+      if (repairTarget
+        && (repair.eventDigest === null || context.event_digest !== repair.eventDigest)) return false;
       if (hard) fail('STORE_INCONSISTENT', 'import_source_unverified', {
         ...context,
         next_action: 'verify_source_commit_origin_path_and_line_then_retry',
@@ -1506,8 +1538,14 @@ export async function readTodoStore(options = {}) {
       fail('STORE_INCONSISTENT', 'manifest_revision_binding_mismatch');
     }
     prefetchVerificationObjects(manifest, repoRoot, journal.events, pinnedSourceCache);
-    const verifyEvidence = evidenceVerifier(manifest, repoRoot, options.forWrite === true);
-    const verifyImportSource = importSourceVerifier(repoRoot, options.forWrite === true, pinnedSourceCache);
+    const evidenceRepair = options.evidenceRepairCapability === EVIDENCE_REPAIR_CAPABILITY
+      ? options.evidenceRepair ?? null : null;
+    const verifyEvidence = evidenceVerifier(
+      manifest, repoRoot, options.forWrite === true, evidenceRepair,
+    );
+    const verifyImportSource = importSourceVerifier(
+      repoRoot, options.forWrite === true, pinnedSourceCache, evidenceRepair,
+    );
     const tasks = replay(plan, journal.events, {
       now: options.now ? new Date(options.now) : new Date(),
       verifyEvidence: options.forWrite === true ? verifyEvidence : undefined,
@@ -1516,8 +1554,13 @@ export async function readTodoStore(options = {}) {
     const expectedSnapshot = snapshotFor(plan, journal.events, structuredClone(tasks));
     // Read-time evidence failure is annotation, never store rejection.
     for (const task of tasks) if (task.evidence !== null) {
+      const context = {
+        plan_key: plan.plan_key,
+        task_id: task.task_id,
+        event_digest: null,
+      };
       const verified = validateTodoImportSource(task.evidence)
-        ? verifyImportSource(task.evidence) : verifyEvidence(task.evidence);
+        ? verifyImportSource(task.evidence, context) : verifyEvidence(task.evidence, context);
       if (!verified) task.evidence_unverified = true;
     }
     let snapshot = null;
@@ -1829,17 +1872,33 @@ function resolveTargetedEvent(input, storeMember) {
       payload: { ...input.payload, target_done_digest: targetDigest },
     };
   }
-  if (input.kind === 'done' && exactRecord(input.payload, [
-    'done_mode', 'imported', 'evidence',
-  ]) && input.payload.done_mode === 'evidence_promotion' && input.payload.imported === true) {
-    // Same binding as `reopen`: an imported completion carried across a revision
-    // is bound to the carrying `plan_genesis`, not to a `done` event. Whether the
-    // completion is actually eligible for promotion stays replay's decision.
+  if (input.kind === 'done'
+    && (exactRecord(input.payload, ['done_mode', 'evidence'])
+      || exactRecord(input.payload, ['done_mode', 'imported', 'evidence']))
+    && input.payload.done_mode === 'evidence_promotion') {
+    // Same binding as `reopen`: a completion carried across a revision is bound
+    // to the carrying `plan_genesis`, while an authored/re-promoted completion is
+    // bound to its latest done event. imported/authored is canonical state, not a
+    // caller assertion; resolving both under the store lock avoids a stale read.
     const targetDigest = resolveDoneBindingDigest(storeMember, input.task_id);
-    if (targetDigest === null) fail('STORE_INCONSISTENT', 'invalid_evidence_promotion');
+    const state = storeMember.tasks.find(({ task_id: taskId }) => taskId === input.task_id);
+    if (targetDigest === null || state?.status !== 'done') {
+      fail('STORE_INCONSISTENT', 'invalid_evidence_promotion', {
+        task_id: input.task_id,
+        status: state?.status ?? null,
+        expected_target_done_digest: targetDigest,
+        eligible_status: 'done',
+        next_action: 'complete_the_task_before_promoting_evidence',
+      });
+    }
     return {
       ...input,
-      payload: { ...input.payload, target_done_digest: targetDigest },
+      payload: {
+        done_mode: 'evidence_promotion',
+        imported: state.imported,
+        target_done_digest: targetDigest,
+        evidence: input.payload.evidence,
+      },
     };
   }
   if (input.kind === 'phase_reopen' && exactRecord(input.payload, ['reason', 'override_reason'])) {
@@ -1940,7 +1999,14 @@ export async function appendTodoEvent(options = {}) {
   requireWriter(options.writer, 'g5-authoring');
   const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
   return withLock(repoRoot, async () => {
-    const store = await readTodoStore({ repoRoot, forWrite: true, now: options.now });
+    const evidenceRepair = options.event.kind === 'done'
+      && options.event.payload?.done_mode === 'evidence_promotion'
+      ? { planKey: options.planKey, taskId: options.event.task_id, eventDigest: null }
+      : null;
+    const store = await readTodoStore({
+      repoRoot, forWrite: true, now: options.now, evidenceRepair,
+      evidenceRepairCapability: EVIDENCE_REPAIR_CAPABILITY,
+    });
     const member = store.members.find(({ descriptor }) => descriptor.plan_key === options.planKey);
     if (!member) fail('STORE_INCONSISTENT', 'plan_not_active');
     // planへ帰属するeventは別chainへ積む。task状態もPhase状態も直接は動かさないので、
@@ -1973,8 +2039,16 @@ export async function appendTodoEvent(options = {}) {
       [...member.journal.events, event], appendSourceCache);
     replay(member.plan, [...member.journal.events, event], {
       now: options.now ? new Date(options.now) : new Date(),
-      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true),
-      verifyImportSource: importSourceVerifier(repoRoot, true, appendSourceCache),
+      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true, {
+        planKey: member.plan.plan_key,
+        taskId: event.task_id,
+        eventDigest: event.event_digest,
+      }),
+      verifyImportSource: importSourceVerifier(repoRoot, true, appendSourceCache, {
+        planKey: member.plan.plan_key,
+        taskId: event.task_id,
+        eventDigest: event.event_digest,
+      }),
     });
     const eventBytes = canonicalLine(event);
     const activeRef = member.descriptor.journal_ref;