@quolu/lattice 0.67.4 → 0.68.0

package/README.ja.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src=".github/og.png" alt="Lattice — 閉ざされて見えた山岳地形から複数の進行経路が現れる" width="100%">
+  <img src="https://raw.githubusercontent.com/kitepon/Lattice/main/.github/og.png" alt="Lattice — 閉ざされて見えた山岳地形から複数の進行経路が現れる" width="100%">
   <br>
   <sub><em>この画像は、閉ざされているように見えた場所から複数の進行経路が現れ、自律した実行者たちが協調して動き出す瞬間を表しています。</em></sub>
 </p>
@@ -129,14 +129,49 @@ typed理由つきで分類します——宣言を直せば通るのか、操作
 ## 所有境界
 
 本repoはplan／ToDo／run store、Lattice sensor、schema、migration、release、diagnosticsを
-所有します。[dotagents](https://github.com/kitepon-rgb/dotagents)はkitepon.devを支える内部
-toolchainであり、製品横断の工程利用・導入・host統合を所有します。
+所有します。[dotagents](https://github.com/kitepon/dotagents)はkitepon.devを支える内部toolchainとして、
+任意の製品横断工場導入とhost統合を統括します。Latticeの製品状態、更新、診断、releaseを所有または
+制御しません。
 廃止済みの前身sensorは独立製品として配線せず、Lattice sensorだけを現役面とします。
 MarkItDownは別区分の第三者CLIです。
 
 現在の工程状態と完了証拠の正本は、このrepoのLattice storeです。文書の役割と現行導線は
-[docs/README.md](docs/README.md)、製品思想は[PLAN.md](PLAN.md)、公開contractは
-[docs/00_product-contract.md](docs/00_product-contract.md)を参照してください。
+[docs/README.md](https://github.com/kitepon/Lattice/blob/main/docs/README.md)、製品思想は
+[PLAN.md](https://github.com/kitepon/Lattice/blob/main/PLAN.md)、公開contractは
+[docs/00_product-contract.md](https://github.com/kitepon/Lattice/blob/main/docs/00_product-contract.md)を参照してください。
+
+## 導入・更新・診断
+
+npm packageが単独導入と更新の正規入口です。更新後はtyped discoveryでCLIを確認し、必要なら
+製品所有のdashboardを新版へ入れ替えます。bridgeを有効化したhostだけ`bridge status`も確認します。
+常駐bridgeは読み込み済みの旧版を1分以内に自動で置き換えます。
+
+```bash
+npm install -g @quolu/lattice@latest
+lattice --version
+lattice status --json
+lattice bridge status --json
+```
+
+## Release
+
+Latticeのreleaseはこのrepoから行います。`package.json`と`CHANGELOG.md`を更新し、製品gateを通し、
+release commitを既定branchへ着地・pushしてから、同じ版をregistryへ公開して実installを確認します。
+`prepublishOnly`はdirty treeとremote既定branchへ未着地のcommitを拒否します。
+
+```bash
+npm run ci
+npm run verify:release-commit
+npm publish --access public
+npm install -g @quolu/lattice@<version>
+lattice --version
+lattice status --json
+lattice bridge status --json
+```
+
+製品CI契約は[docs/ci-contract.md](https://github.com/kitepon/Lattice/blob/main/docs/ci-contract.md)、
+dashboard／bridgeの配備固有確認は
+[docs/operations/lattice-kitepon-deployment.md](https://github.com/kitepon/Lattice/blob/main/docs/operations/lattice-kitepon-deployment.md)が正です。
 
 CLIの全体像は`lattice --help`、各公開namespaceの正規構文は
 `lattice <plan|run|event|todo|sensor|factory-diagnostics|runtime-errors|bridge|hooks> --help`で確認できます。
@@ -145,12 +180,24 @@ CLIの全体像は`lattice --help`、各公開namespaceの正規構文は
 
 ## 開発
 
+製品local gateは次の3入口です。
+
 ```bash
 npm test
 npm run check
 npm run ci
+```
+
+製品localの保守で必要な時だけ次を使います。
+
+```bash
 node scripts/reap-orphan-test-daemons.mjs
 lattice sensor sync . --json
+```
+
+次は任意の工場統合診断であり、Lattice単独の開発gateまたはrelease gateではありません。
+
+```bash
 spotter doctor
 codex-sidecar diagnostics --project . --preset auditor --json
 ```
@@ -165,7 +212,7 @@ codex-sidecar diagnostics --project . --preset auditor --json
 
 Node.js 22.13以上、ただし25.xを除きます（`engines: >=22.13 <25 || >=26`。Node 25.xはV8 turboshaft
 WASM JITの不具合で同梱sensorが壊れるため、bannerを出して起動を止めます）。境界観測は配布物に同梱したLattice sensorだけを使い、PATH上の
-廃止済みruntimeや旧cache/dataへfallbackしません。Spotterはproject単位で生成stateの所有境界を守ります。
+廃止済みruntimeや旧cache/dataへfallbackしません。Latticeはproject単位で生成stateの所有境界を守ります。
 
 どのrepoでも、Latticeの導入状態はdirectoryの有無を推測せず、最初に次のtyped discoveryで判定します。
 
@@ -188,7 +235,7 @@ lattice plan create --input .lattice/plan-create.json
 
 `invalid`をMarkdown fallbackへ丸めず、`next_action`に従ってstoreを診断してください。
 discoveryと初期transactionの不変条件は
-[ADR 0058](docs/adr/0058-project-discovery-and-initial-authoring.md)が正です。
+[ADR 0058](https://github.com/kitepon/Lattice/blob/main/docs/adr/0058-project-discovery-and-initial-authoring.md)が正です。
 
 ## 実行runを端から端まで動かす
 
@@ -257,7 +304,7 @@ required evidenceを束縛した`todo phase accept`で重監査の判断を記
 「閉じた」の可視表現なので、監査の記録なしにそこへ行かせません。作成時に拒否はせず、
 `todo migrate`／`plan create`の結果と最後のdoneのadvisoryで`terminal_audit_required`を通知します。
 **終端監査はToDoのdispatch可否へ影響しません**（Phaseは重監査の順序だけを制御し、開始順はToDo DAGが決めます）。
-規約は[ADR 0147](docs/adr/0147-audit-is-on-by-default.md)が正です。
+規約は[ADR 0147](https://github.com/kitepon/Lattice/blob/main/docs/adr/0147-audit-is-on-by-default.md)が正です。
 
 ```bash
 lattice todo phase status --plan <key>   # phase無しplanでも暗黙Phaseを返す（implicit: true）
@@ -277,7 +324,8 @@ lattice todo phase baseline --reason <text> --except <監査したいplan_key>
 一括の入口は、現在監査待ちで一度も監査に触れていないPhaseだけを対象にします。**自動では
 実行しません**——どれを監査し、どれを歴史として畳むかは人が決め、Latticeは宣言を受け取って
 記録するだけです。`--except`は「最近の作業でコードも生きているので本当に監査したい」planを
-残すための口です。規約は[ADR 0148](docs/adr/0148-history-closes-unaudited-not-audited.md)が正です。
+残すための口です。規約は
+[ADR 0148](https://github.com/kitepon/Lattice/blob/main/docs/adr/0148-history-closes-unaudited-not-audited.md)が正です。
 
 誤ってphase無しで作ったplanへ後からPhaseを被せる場合は、`revise-phase`の
 `state_policy: acquire_phase`でdone状態を保ったまま獲得できます（未割当→割当の向きだけを許し、
@@ -310,13 +358,13 @@ LANや外部reverse proxyから閲覧するoptional bridgeは既定で無効で
 完走したplanは図の場所を取りません。除いた工程は凡例の件数、右ペインの「全工程」一覧、各工程の詳細から
 辿れ、詳細の前提・後続は除外前の依存関係を示します。総数・進捗・最長依存鎖は除外前の全工程で数えます。
 凡例の件数バッジを押すと全工程を描いた図へ切り替わります。表示規約は
-[ADR 0066](docs/adr/0066-gantt-live-scope-drops-finished-work.md)が正です。
+[ADR 0066](https://github.com/kitepon/Lattice/blob/main/docs/adr/0066-gantt-live-scope-drops-finished-work.md)が正です。
 
 右ペインは概要・選択工程・全工程の3面で、いずれもToDo storeを表示します（元plan Markdown本文は
 再表示しません。元文書へは各工程の詳細が持つ行対応から辿ります）。全工程一覧は動いているplanを
 最終活動の新しい順で上に、全工程が図から外れた完走planを古い順で下にまとめ、plan内は登録順です。
 決着済みPhaseと図から外した工程は既定で畳み、開けば読めます。規約は
-[ADR 0067](docs/adr/0067-right-pane-shows-the-store-and-orders-by-activity.md)が正です。
+[ADR 0067](https://github.com/kitepon/Lattice/blob/main/docs/adr/0067-right-pane-shows-the-store-and-orders-by-activity.md)が正です。
 
 `lattice todo gantt`と`lattice todo gantt status`による静的工程表は廃止済みで、呼ぶと
 `STATIC_GANTT_RETIRED`が動的dashboardを案内します。
@@ -331,7 +379,7 @@ daemonの生死はdescriptor 1枚では持ちません。daemonは自分のpid
 旧daemonが観測されないまま生き残ることはありません。descriptorだけを失った場合は2本目を建てず、
 配信を続けているdaemonを引き取ります。signalを送るのはその場で再認証を通った相手だけで、応答しない
 pidへは送りません（pid再利用で無関係のprocessを止めうるためです）。規約は
-[ADR 0157](docs/adr/0157-dashboard-daemons-are-discoverable-by-record.md)が正です。
+[ADR 0157](https://github.com/kitepon/Lattice/blob/main/docs/adr/0157-dashboard-daemons-are-discoverable-by-record.md)が正です。
 状態を書き込む`start / block / unblock / done / evidence promote / reopen / note / independence mode /
 revise / revise-phase / revise-set / phase review|accept|reject|reopen|close-unaudited|baseline /
 dashboard adopt`では、監査actorとして次の3環境変数を渡せます。未設定ならhost／`session`／USERから
@@ -347,7 +395,7 @@ export LATTICE_TODO_ACTOR_AGENT=<agent-id>
 blobを書きます。flagの順は問いません。空の設計メモは拒否します。無策なら`NO_PLAN`と書いてください。
 
 authoring入口と閉じる口の契約は
-[ADR 0181](docs/adr/0181-authoring-entry-accepts-drafts.md)を参照してください。
+[ADR 0181](https://github.com/kitepon/Lattice/blob/main/docs/adr/0181-authoring-entry-accepts-drafts.md)を参照してください。
 
 ## 特許
 
@@ -380,4 +428,4 @@ authoring入口と閉じる口の契約は
 **MIT License**のままです。upstreamの出自と帰属表示は[`sensor/NOTICE`](sensor/NOTICE)、
 license本文は[`sensor/LICENSE`](sensor/LICENSE)が持ちます。上記の条件はこれを変更しません。
 
-© 2026 quolu (kitepon-rgb)
+© 2026 quolu (kitepon.dev)

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src=".github/og.png" alt="Lattice — several viable routes emerging through an apparently blocked mountain valley" width="100%">
+  <img src="https://raw.githubusercontent.com/kitepon/Lattice/main/.github/og.png" alt="Lattice — several viable routes emerging through an apparently blocked mountain valley" width="100%">
   <br>
   <sub><em>This image represents several viable paths emerging from terrain that first appeared blocked, as autonomous executors begin moving in coordination.</em></sub>
 </p>
@@ -231,7 +231,7 @@ live dependency diagram refuses to fold such a plan away, because folding is how
 says "closed", and nothing gets there without an evidence-bound `phase accept`. Creation is never
 rejected over it; the requirement is reported instead. And the audit gate never touches dispatch:
 phases order reviews, the ToDo DAG orders work
-([ADR 0147](docs/adr/0147-audit-is-on-by-default.md)).
+([ADR 0147](https://github.com/kitepon/Lattice/blob/main/docs/adr/0147-audit-is-on-by-default.md)).
 
 **History closes unaudited, never audited.** Work that finished long ago cannot be audited — the
 code under review has already moved. Demanding an audit there produces either a false finding
@@ -240,7 +240,7 @@ code under review has already moved. Demanding an audit there produces either a
 incapable of passing as `accepted`** — phase-accept dependencies unlock on `accepted` alone. The
 bulk entry point never runs by itself, and the machine never infers "old enough to skip"; a human
 decides what gets audited and what becomes history
-([ADR 0148](docs/adr/0148-history-closes-unaudited-not-audited.md)).
+([ADR 0148](https://github.com/kitepon/Lattice/blob/main/docs/adr/0148-history-closes-unaudited-not-audited.md)).
 
 ## Patent
 
@@ -259,13 +259,48 @@ Noncommercial use is permitted under the [License](#license) below.
 ## Ownership boundary
 
 This repository owns the plan/ToDo/run store, the bundled sensor, schemas, migrations,
-releases, and diagnostics. [dotagents](https://github.com/kitepon-rgb/dotagents) is the
-internal toolchain behind kitepon.dev and owns cross-product installation and host integration.
+releases, and diagnostics. [dotagents](https://github.com/kitepon/dotagents) coordinates optional
+cross-product factory installation and host integration; it does not own or control Lattice's
+product state, update, diagnostics, or release.
 
-- Product philosophy: [PLAN.md](PLAN.md)
-- Public contract: [docs/00_product-contract.md](docs/00_product-contract.md)
-- Immutable decisions: [docs/adr/](docs/adr/)
-- Document map: [docs/README.md](docs/README.md)
+- Product philosophy: [PLAN.md](https://github.com/kitepon/Lattice/blob/main/PLAN.md)
+- Public contract: [docs/00_product-contract.md](https://github.com/kitepon/Lattice/blob/main/docs/00_product-contract.md)
+- Immutable decisions: [docs/adr/](https://github.com/kitepon/Lattice/tree/main/docs/adr)
+- Document map: [docs/README.md](https://github.com/kitepon/Lattice/blob/main/docs/README.md)
+
+## Update and diagnostics
+
+The npm package is the standalone update path. After updating, typed discovery verifies the
+installed CLI and refreshes the product-owned dashboard when needed. Check the bridge only on a
+host where it is enabled; its supervised process replaces an older loaded version within one minute.
+
+```bash
+npm install -g @quolu/lattice@latest
+lattice --version
+lattice status --json
+lattice bridge status --json
+```
+
+## Release
+
+Maintainers release Lattice from this repository. Update `package.json` and `CHANGELOG.md`, pass the
+product gate, land and push the release commit on the default branch, then publish and verify that
+same version from the registry. `prepublishOnly` rejects a dirty tree or a commit not landed on the
+remote default branch.
+
+```bash
+npm run ci
+npm run verify:release-commit
+npm publish --access public
+npm install -g @quolu/lattice@<version>
+lattice --version
+lattice status --json
+lattice bridge status --json
+```
+
+The product CI contract is [docs/ci-contract.md](https://github.com/kitepon/Lattice/blob/main/docs/ci-contract.md). The deployment-specific
+dashboard and bridge checks are in
+[docs/operations/lattice-kitepon-deployment.md](https://github.com/kitepon/Lattice/blob/main/docs/operations/lattice-kitepon-deployment.md).
 
 ## Development
 
@@ -275,6 +310,21 @@ npm run check   # syntax + control-character gate
 npm run ci      # full gate
 ```
 
+Product-local maintenance, when relevant:
+
+```bash
+node scripts/reap-orphan-test-daemons.mjs
+lattice sensor sync . --json
+```
+
+These optional factory-integration diagnostics are not Lattice's standalone development or release
+gate:
+
+```bash
+spotter doctor
+codex-sidecar diagnostics --project . --preset auditor --json
+```
+
 The full gate includes checks that are unusual and deliberate:
 
 - **`check:cli-surface`** — every shipped command must have help text *and* be exercised through
@@ -305,4 +355,4 @@ repository and remains under the **MIT License**. Its upstream origin and attrib
 recorded in [`sensor/NOTICE`](sensor/NOTICE); the license text is
 [`sensor/LICENSE`](sensor/LICENSE). The terms above do not modify it.
 
-© 2026 quolu (kitepon-rgb)
+© 2026 quolu (kitepon.dev)

package/docs/bridge-setup.md

@@ -4,6 +4,37 @@ Latticeのproject dashboardは既定でloopbackだけにbindし、bridge用socke
 LAN上のreverse proxyなどから閲覧する時だけ、利用者がlisten IPを明示してbridgeを有効化する。
 `postinstall`では質問やnetwork公開を行わない。
 
+## 工程操作から配信漏れを知る
+
+`lattice status --json`とToDoの保存操作が、工程結果のstdoutに加え、stderrへ
+`lattice.dashboard_delivery.v1`を返す。工程の保存成功を公開配信の成功と読み替えない。
+
+| state | 確認できたこと |
+| --- | --- |
+| `local_only` | PC内の工程表が利用可能。`reason`は`bridge_unconfigured`または`bridge_disabled` |
+| `bridge_only` | bridge設定を利用。hubが未設定のため、その先の公開配信は未確認 |
+| `hub_delivered` | hubが対象工程を受理し、一覧にonlineで掲載し、工程HTMLの中継が成功 |
+| `failed` | 配信を確認できない。`reason`と`next_action`で原因と復旧入口を返す |
+
+有効なbridge設定がある端末では、工程操作が常駐設定・実行体・実processを確認し、欠落や実行pathのずれを
+正規の`bridge reconfigure`で復旧してから配信を確認する。無効・未設定のbridgeは自動公開しない。
+PCの初期化等で設定自体が失われた時は`local_only`がその事実を示す。公開先を推測して復元はしない。
+
+明示の復旧入口`lattice todo dashboard ensure --json`は、ローカルdaemonから設定済みbridgeとhub配信までを
+処理する。結果は`lattice.todo_dashboard_ensure_result.v1`で、`activity.delivery`に同じ配信結果を含む。
+配信失敗では非0を返す。通常の工程保存は配信故障で止めず、保存結果と配信失敗を別々に返す。
+
+`bridge setup`／`reconfigure`にhubが設定されている場合は、dashboard起動、hubへの登録、一覧と工程HTMLの
+確認までを成功条件とする。stdoutの`lattice.bridge_cli_result.v4`は維持し、stderrへ確認結果を返す。通信や中継が
+失敗した時は`BRIDGE_HUB_DELIVERY_UNCONFIRMED`で非0を返す。通信故障でも保存済みの接続設定は保持する。
+hub URLは端末から直接到達する登録先を使う。reverse proxy経由の登録は接続元がproxyになり、hubから端末への
+経路を誤る。別の公開HTTPS入口がある構成では、公開HTTPSとSSEの受入も本書後半に従って実施する。
+
+配信確認は全OS共通とし、常駐の復旧はMacのLaunchAgent、WindowsのStartup Folderの既存入口を使う。
+実行中の版だけが異なる場合は既存の自動更新に任せ、配信確認から再設定を強制しない。
+
+## 共通の設定入口
+
 TTYでは`lattice bridge setup`で安全側既定の対話wizardを開始できる。最初の公開確認は既定で無効を選び、
 cancelした場合は設定を変更しない。非TTYではhangせず、次の非対話commandを案内する。
 portを省略するか`auto`にすると、49152–65535から候補を重複なく選び、
@@ -106,7 +137,7 @@ lattice bridge reconfigure --json
 macOSのLaunchAgent載せ直しでは、`launchctl bootout`のexit 0はunload受付だけである。labelが
 domainから消える（`launchctl print`が113）前に`bootstrap`すると、launchdは
 `5 Input/output error`を返す。`reconfigure`はprint 113を待ってから載せる（0.60.7・
-[ADR 0179](adr/0179-launchctl-bootout-completes-when-print-returns-113.md)）。失敗時は
+[ADR 0179](https://github.com/kitepon/Lattice/blob/main/docs/adr/0179-launchctl-bootout-completes-when-print-returns-113.md)）。失敗時は
 launchctlのexit codeとstderrが`lattice.cli_error.v2`の`detail`に残る。
 
 ### 公開面から自分のprojectが消えた時（`last_heartbeat`）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.67.4",
+  "version": "0.68.0",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",
@@ -64,13 +64,16 @@
     "ignore": "^7.0.5",
     "jsonc-parser": "^3.3.1",
     "picomatch": "^4.0.3",
-    "remark-gfm": "^4.0.1",
-    "remark-parse": "^11.0.0",
     "sisteransi": "^1.0.5",
     "tree-sitter-wasms": "^0.1.11",
-    "unified": "^11.0.5",
     "web-tree-sitter": "^0.25.3"
   },
+  "devDependencies": {
+    "micromark-util-decode-string": "^2.0.1",
+    "remark-gfm": "^4.0.1",
+    "remark-parse": "^11.0.0",
+    "unified": "^11.0.5"
+  },
   "scripts": {
     "prepack": "npm --prefix sensor run build",
     "verify:release-commit": "node scripts/verify-release-commit.mjs",
@@ -79,11 +82,12 @@
     "test:profile": "node scripts/run-product-tests.mjs",
     "test:sensor": "npm --prefix sensor test",
     "check": "node scripts/check-syntax.mjs",
-    "ci": "npm run test && npm run test:sensor && npm run check && npm run check:cli-surface && npm run check:open-questions && npm run check:reachability && npm run verify:todo-store",
+    "ci": "npm run check:docs && npm run test && npm run test:sensor && npm run check && npm run check:cli-surface && npm run check:open-questions && npm run check:reachability && npm run verify:todo-store",
     "verify:todo-store": "node bin/lattice.mjs todo verify --json",
     "check:cli-surface": "node scripts/verify-cli-surface.mjs",
     "check:open-questions": "node scripts/verify-open-questions.mjs",
     "check:reachability": "node scripts/verify-product-reachability.mjs",
+    "check:docs": "node scripts/verify-docs.mjs && node scripts/verify-packed-markdown.mjs && node --test test/documentation-ci-contract.test.mjs test/markdown-link-targets.test.mjs",
     "upstream:check": "node scripts/upstream-check.mjs",
     "upstream:sync": "node scripts/upstream-sync.mjs"
   },

package/src/bridge-cli.mjs

@@ -6,6 +6,8 @@ import * as clack from '@clack/prompts';
 import packageJson from '../package.json' with { type: 'json' };
 import { resolveBridgeListenAddress } from './bridge-address.mjs';
 import { registerBridgeUpstream } from './bridge-registrar.mjs';
+import { ensureTodoDashboardDaemon } from './todo-dashboard-registry.mjs';
+import { verifyBridgeHubDelivery } from './dashboard-delivery.mjs';
 import {
   BridgeConfigError, configureBridge, disableBridge, readBridgeConfig, restoreBridgeConfig,
   normalizeBridgeAllowedHost, withBridgeOperationLock,
@@ -237,6 +239,26 @@ function result(action, config, recovery = null, liveness = null, diagnostics =
     warnings };
 }
 
+/** 設定済みbridgeの常駐が欠けた場合だけ、正規の再設定経路で復旧する。 */
+export async function recoverConfiguredBridge({ config, env = process.env,
+  launchAgent = platformLaunchAgent(), runtimeIdentity = readBridgeRuntimeIdentity,
+  reconfigure = runBridgeCli } = {}) {
+  const diagnostics = await bridgeDiagnostics({ config, launchAgent, env, runtimeIdentity });
+  if (diagnostics === null) return;
+  if (diagnostics.persistence.state === 'installed'
+    && diagnostics.persistence.node_exists && diagnostics.persistence.bridge_exists
+    && diagnostics.runtime?.state === 'running'
+    && diagnostics.drift.every((field) => field === 'version')) return;
+  let errorOutput = '';
+  const code = await reconfigure({ argv: ['reconfigure', '--json'], env,
+    stdout: { write() {} }, stderr: { write(chunk) { errorOutput += chunk; } },
+    launchAgent, runtimeIdentity });
+  if (code !== 0) {
+    const error = JSON.parse(errorOutput);
+    throw new BridgeConfigError(error.code, error.message, error.detail);
+  }
+}
+
 export async function collectBridgeSetupWizard({ input, output, prompts = clack } = {}) {
   const common = { input, output };
   const enabled = await prompts.confirm({ ...common,
@@ -287,6 +309,7 @@ export async function runBridgeCli({ argv, stdout, stderr, env = process.env,
     stop: stopBridgeDaemon, clearStop: clearBridgeStopControl },
   launchAgent = platformLaunchAgent(), runtimeIdentity = readBridgeRuntimeIdentity,
   bridgePath = DEFAULT_BRIDGE_PATH,
+  ensureDashboard = ensureTodoDashboardDaemon, verifyDelivery = verifyBridgeHubDelivery,
   prompts = clack, probe = probeBridgeListener, interfaces = networkInterfaces() } = {}) {
   if (!Array.isArray(argv)) {
     return fail(stderr, 'USAGE', 'usage: lattice bridge <setup|reconfigure|status|disable|register> [options] --json');
@@ -392,6 +415,7 @@ export async function runBridgeCli({ argv, stdout, stderr, env = process.env,
           reuseCurrentPort: options.port === undefined,
         });
         try {
+          if (configured.hub !== null) await ensureDashboard({ env });
           if (!agentSnapshot.loaded && current !== null) {
             const requestStop = daemon.requestStop ?? daemon.stop ?? requestBridgeDaemonStop;
             await requestStop({ env, listen: current.listen });
@@ -414,6 +438,12 @@ export async function runBridgeCli({ argv, stdout, stderr, env = process.env,
         return configured;
       });
     } else return fail(stderr, 'USAGE', 'unknown bridge command or options');
+    // hubを指定した設定は、保存・常駐起動だけでは成功にしない。通信故障時も設定は
+    // 保持し、次の工程操作から同じ接続を復旧できるようにする。
+    if ((command === 'setup' || command === 'reconfigure') && config.hub !== null) {
+      const delivery = await verifyDelivery({ config, env });
+      stderr.write(`${JSON.stringify(delivery)}\n`);
+    }
     // Liveness and the persistence/runtime diagnostics are only meaningful for
     // a read: the mutating commands have just reconfigured the daemon and the
     // socket may not have settled yet.

package/src/bridge-hub-heartbeat.mjs

@@ -17,7 +17,7 @@
 
 import { randomBytes } from 'node:crypto';
 import { hostname } from 'node:os';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { link, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 
 import { bridgeConfigPaths } from './bridge-config.mjs';
@@ -68,13 +68,18 @@ export async function readOrCreateBridgeHubTerminalId({ env = process.env } = {}
       if (error?.code !== 'ENOENT') throw error;
     }
     const terminalId = randomBytes(16).toString('hex');
+    const temporary = `${ref}.${terminalId}.tmp`;
+    await writeFile(temporary, `${JSON.stringify({ schema: TERMINAL_IDENTITY_SCHEMA, terminal_id: terminalId })}\n`,
+      { encoding: 'utf8', mode: 0o600, flag: 'wx' });
     try {
-      await writeFile(ref, `${JSON.stringify({ schema: TERMINAL_IDENTITY_SCHEMA, terminal_id: terminalId })}\n`,
-        { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+      // 完成済みのbytesだけを、既存のIDを上書きせず公開する。
+      await link(temporary, ref);
       return terminalId;
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error;
-      // Lost the create race to another process; loop back and read what it wrote.
+      // 同時生成の勝者が公開した完成済みIDを読む。
+    } finally {
+      await unlink(temporary);
     }
   }
 }

package/src/cli-help.mjs

@@ -110,6 +110,7 @@ Write commands:
   reopen --plan <key> --task <id> --reason <text> [--override-reason <text>]
   evidence promote --plan <key> --task <id> --evidence <file>
       # done状態と完了時刻を維持し、最新doneへ追記eventで証拠を再束縛する
+  start --plan <key> --task <id> --rebind --reason <text>  # 改訂でcarryされたin-progressへ現版のstart束縛を積み直す（ADR 0191）
   dependency connect --from-plan <key> --from-task <id> --to-plan <key> --to-task <id> --reason <text>
   dependency disconnect --from-plan <key> --from-task <id> --to-plan <key> --to-task <id> --reason <text>
       # 開発中に発見した依存を明示接続する（同一plan内・plan跨ぎとも）。依存の自動推定は行わない

package/src/dashboard-delivery.mjs

@@ -0,0 +1,103 @@
+import { BridgeConfigError, readBridgeConfig } from './bridge-config.mjs';
+import { createBridgeHubHeartbeatController } from './bridge-hub-heartbeat.mjs';
+
+// 配信結果は全OS共通。常駐の復旧はbridge CLIがOS固有の入口へ委ねる。
+
+const SCHEMA = 'lattice.dashboard_delivery.v1';
+const SETUP = 'lattice bridge setup --listen <IP> --dashboard --hub <URL> --json';
+
+function receipt(state, reason, projectIds = [], urls = [], nextAction = null) {
+  return { schema: SCHEMA, state, reason, project_ids: projectIds, urls, next_action: nextAction };
+}
+
+function unconfirmed(reason, projectIds = []) {
+  return new BridgeConfigError('BRIDGE_HUB_DELIVERY_UNCONFIRMED',
+    '工程の公開配信を確認できません。接続設定は保存済みです。', {
+      reason, project_ids: projectIds, next_action: 'lattice todo dashboard ensure --json',
+    });
+}
+
+/** 登録の受付、一覧への掲載、工程HTMLの中継を同じ呼出しで確認する。 */
+export async function verifyBridgeHubDelivery({ config, env = process.env, projectId = null,
+  heartbeat = async () => createBridgeHubHeartbeatController({ env }).tick({ config }),
+  fetchImpl = fetch, timeoutMs = 5_000 } = {}) {
+  if (config.hub === null) return receipt('bridge_only', 'hub_unconfigured', [], [], SETUP);
+  const delivered = await heartbeat();
+  const result = delivered?.result;
+  const registered = result?.registered;
+  if (!['accepted', 'partial'].includes(delivered?.state)
+    || result?.schema !== 'lattice.bridge_hub_registration_result.v2'
+    || !Array.isArray(registered) || !registered.every((id) => typeof id === 'string')
+    || !Array.isArray(result.rejected)) {
+    throw unconfirmed(delivered?.state ?? 'heartbeat_missing');
+  }
+  const projectIds = projectId === null ? registered : [projectId];
+  if (projectIds.length === 0 || projectIds.some((id) => !registered.includes(id))
+    || (projectId === null && result.rejected.length > 0)) {
+    throw unconfirmed('project_not_registered', projectIds);
+  }
+  const request = (url, accept) => fetchImpl(url, { redirect: 'error',
+    headers: { accept }, signal: AbortSignal.timeout(timeoutMs) });
+  let listing;
+  try {
+    const response = await request(new URL('projects/', config.hub.url), 'application/json');
+    if (response.status !== 200) throw unconfirmed('hub_listing_unavailable', projectIds);
+    listing = await response.json();
+  } catch (error) {
+    if (error?.code === 'BRIDGE_HUB_DELIVERY_UNCONFIRMED') throw error;
+    throw unconfirmed('hub_listing_unavailable', projectIds);
+  }
+  if (!Array.isArray(listing) || projectIds.some((id) =>
+    !listing.some((entry) => entry.project_id === id && entry.status === 'online'))) {
+    throw unconfirmed('project_not_visible', projectIds);
+  }
+  const urls = [];
+  for (const id of projectIds) {
+    const url = new URL(`projects/${encodeURIComponent(id)}/`, config.hub.url);
+    try {
+      const response = await request(url, 'text/html');
+      if (response.status !== 200 || !response.headers.get('content-type')?.includes('text/html')) {
+        throw unconfirmed('project_unreachable', [id]);
+      }
+      const html = await response.text();
+      if (!/<title>Lattice — [^<]+依存工程図<\/title>/u.test(html)) {
+        throw unconfirmed('project_response_invalid', [id]);
+      }
+    } catch (error) {
+      if (error?.code === 'BRIDGE_HUB_DELIVERY_UNCONFIRMED') throw error;
+      throw unconfirmed('project_unreachable', [id]);
+    }
+    urls.push(url.href);
+  }
+  return receipt('hub_delivered', null, projectIds, urls);
+}
+
+export async function ensureProjectDashboardDelivery({ projectId, env = process.env,
+  readConfig = readBridgeConfig, verify = verifyBridgeHubDelivery,
+  recover = async (options) => {
+    const { recoverConfiguredBridge } = await import('./bridge-cli.mjs');
+    await recoverConfiguredBridge(options);
+  } } = {}) {
+  const config = await readConfig({ env });
+  if (config === null || !config.enabled) {
+    return receipt('local_only', config === null ? 'bridge_unconfigured' : 'bridge_disabled',
+      [projectId], [], SETUP);
+  }
+  await recover({ config, env });
+  return verify({ config: await readConfig({ env }), env, projectId });
+}
+
+/** stdoutの工程契約を変えず、保存と配信の結果を別のtyped receiptで伝える。 */
+export async function reportProjectDashboardDelivery({ projectId, env, stderr,
+  ensureDelivery = ensureProjectDashboardDelivery }) {
+  let delivery;
+  try { delivery = await ensureDelivery({ projectId, env }); }
+  catch (error) {
+    // 外部境界の故障だけを配信失敗へ写す。内部の型・実装不整合は隠さない。
+    if (typeof error?.code !== 'string') throw error;
+    delivery = receipt('failed', error.code, [projectId], [],
+      error.detail?.next_action ?? 'lattice bridge status --json');
+  }
+  stderr?.write(`${JSON.stringify(delivery)}\n`);
+  return delivery;
+}

package/src/fs-publish.mjs

@@ -0,0 +1,16 @@
+import { rename } from 'node:fs/promises';
+import { setTimeout } from 'node:timers/promises';
+
+/** Windowsは読み手が開いている宛先へのrenameを一時的にEPERMで拒否する。
+ * 同じatomic renameを待って再実行し、恒久的な拒否は元のエラーで返す。 */
+export async function renamePublishedFile(source, destination, {
+  renameFile = rename, platform = process.platform, wait = setTimeout, attempts = 8,
+} = {}) {
+  for (let attempt = 0; ; attempt++) {
+    try { return await renameFile(source, destination); }
+    catch (error) {
+      if (platform !== 'win32' || error?.code !== 'EPERM' || attempt + 1 >= attempts) throw error;
+      await wait(Math.min(64, 2 ** attempt));
+    }
+  }
+}

package/src/git-process.mjs

@@ -42,7 +42,9 @@ export function gitCatFileBatch(objectNames, { cwd, maxBodyBytes }) {
     maxBuffer: (maxBodyBytes + 256) * objectNames.length,
     stdio: ['pipe', 'pipe', 'ignore'],
   });
-  if (result.status !== 0 || result.stdout === undefined || result.stdout === null) {
+  // Linux / Node 24ではmaxBuffer超過時にもstatus=0と完全stdoutを返しつつ、errorだけを
+  // ENOBUFSにする競合がある。statusだけで成功判定するとprocess自身が報告した失敗を失う。
+  if (result.error || result.status !== 0 || result.stdout === undefined || result.stdout === null) {
     throw new Error(`git cat-file --batch failed: status=${result.status ?? 'signal'}`);
   }
   const stdout = result.stdout;

package/src/project-cli.mjs

@@ -24,6 +24,7 @@ import {
 import { isTodoIndependenceLegacyMarker } from './todo-independence-contracts.mjs';
 import { selectIndependenceGuidance } from './todo-independence-guidance.mjs';
 import { ensureTodoDashboardActivity } from './todo-dashboard-registry.mjs';
+import { reportProjectDashboardDelivery } from './dashboard-delivery.mjs';
 import { resolveProjectIdentity } from './project-identity.mjs';
 import {
   buildTodoPlan,
@@ -336,8 +337,9 @@ async function resolveProjectState({ cwd, cliVersion, diagnoseStructureArtifacts
   }
 }
 
-export async function runProjectStatus({ cwd, stdout, cliVersion, env = process.env,
-  ensureDashboardActivity = ensureTodoDashboardActivity }) {
+export async function runProjectStatus({ cwd, stdout, stderr = process.stderr, cliVersion, env = process.env,
+  ensureDashboardActivity = ensureTodoDashboardActivity,
+  reportDelivery = reportProjectDashboardDelivery }) {
   const state = await resolveProjectState({
     cwd, cliVersion, diagnoseStructureArtifacts: true,
   });
@@ -349,13 +351,19 @@ export async function runProjectStatus({ cwd, stdout, cliVersion, env = process.
         repoRoot: state.repoRoot, projectId: state.store.project_id, env,
       });
       const actorSession = env.LATTICE_TODO_ACTOR_SESSION;
-      await ensureDashboardActivity({
+      const activity = await ensureDashboardActivity({
         repoRoot: state.repoRoot, projectId: state.store.project_id,
         displayName: identity.displayName,
         sessionId: isTodoIdentifier(actorSession) ? actorSession : `status-${process.pid}`, env,
       });
-    } catch {
+      if (activity !== undefined) {
+        await reportDelivery({ projectId: state.store.project_id, env, stderr });
+      }
+    } catch (error) {
       // dashboardはdiscoveryの副作用。statusをdashboard故障で止めない（ADR 0181）。
+      stderr.write(`${JSON.stringify({ schema: 'lattice.dashboard_delivery.v1', state: 'failed',
+        reason: error.code ?? 'DASHBOARD_FAILED', project_ids: [state.store.project_id], urls: [],
+        next_action: 'lattice todo dashboard ensure --json' })}\n`);
     }
   }
   stdout.write(`${JSON.stringify(state.result)}\n`);

package/src/runtime-os-observation.mjs

@@ -16,7 +16,7 @@ export function osObservationEnvironment() { return { ...process.env, LC_ALL: 'C
 
 /** processのstart identity（darwin/linuxはps lstart、win32はPowerShell StartTime Ticks）の生文字列を返す。 */
 export async function observeStartIdentityRaw(pid) {
-  const executable = process.platform === 'win32' ? 'powershell.exe' : '/bin/ps';
+  const executable = process.platform === 'win32' ? 'pwsh.exe' : '/bin/ps';
   const args = process.platform === 'win32'
     ? ['-NoProfile', '-NonInteractive', '-Command',
       `[System.Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToUniversalTime().Ticks`]

package/src/runtime-windows-process.mjs

@@ -37,7 +37,7 @@ export async function observeWindowsWorkerProcess(pid) {
   }
   const filter = JSON.stringify(`ProcessId=${pid}`);
   const script = `Get-CimInstance Win32_Process -Filter ${filter} | Select-Object ProcessId,CommandLine,CreationDate | ConvertTo-Json -Compress`;
-  const { stdout } = await execFileAsync('powershell.exe', ['-NoProfile', '-Command', script], {
+  const { stdout } = await execFileAsync('pwsh.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
     encoding: 'utf8',
   });
   const row = JSON.parse(stdout.trim() || 'null');

package/src/todo-cli.mjs

@@ -901,6 +901,47 @@ async function startTask({
     structureContext });
 }
 
+// plan改訂でcarryされたin-progress ToDoの再束縛入口（ADR 0191）。task状態・開始時刻は
+// 変えず、現plan_version・現actorのstart束縛だけをjournalへ積む。runtime intakeは
+// literal startだけを束縛に使いcarryを推定しないため、改訂を跨いだ進行中工程の
+// 再開はこの入口だけが正規経路になる。advisory・independence gateは初回startで
+// 済んでいるため再適用しない。
+async function rebindStart({ repoRoot, env, planKey, taskId, reason }) {
+  const store = await readTodoStore({ repoRoot });
+  const member = store.members.find(({ descriptor }) => descriptor.plan_key === planKey);
+  if (member === undefined) throw new TodoStoreError('STORE_INCONSISTENT', 'plan_not_active');
+  const task = member.tasks.find(({ task_id: candidate }) => candidate === taskId);
+  if (task === undefined) {
+    throw new TodoStoreError('TASK_NOT_FOUND', 'task_not_found', undefined, {
+      requested_task_id: taskId,
+    });
+  }
+  if (task.status !== 'in-progress') {
+    throw new TodoStoreError('TASK_START_BINDING_UNSUPPORTED', 'rebind_requires_in_progress', undefined, {
+      task_id: taskId, status: task.status,
+    });
+  }
+  let noteContext;
+  try {
+    ({ context: noteContext } = await readTodoNoteContext({ repoRoot, store, planKey, taskId }));
+  } catch (error) {
+    if (!['NOTE_LOG_CORRUPT', 'NOTE_PROJECTION_INVALID'].includes(error?.code)) throw error;
+    noteContext = {
+      schema: 'lattice.todo_note_context.unreadable.v1',
+      project_id: member.plan.project_id,
+      plan_key: planKey,
+      task_id: taskId,
+      code: error.code,
+      reason: error.detail?.reason ?? 'note_context_unreadable',
+      next_action: `lattice todo note list --plan ${planKey} --json`,
+    };
+  }
+  return mutate({
+    repoRoot, env, planKey, taskId, kind: 'start',
+    payload: { start_mode: 'rebind', reason }, evidenceRef: null, noteContext,
+  });
+}
+
 async function retractStart({ repoRoot, env, planKey, taskId, reason }) {
   const actor = mutationActor(env);
   const store = await readTodoStore({ repoRoot });
@@ -3483,23 +3524,34 @@ function writesTodoStore(argv) {
   }
 }
 
-async function ensureActiveProjectDashboard({ repoRoot, env }) {
+async function ensureActiveProjectDashboard({ repoRoot, env, stderr, strict = false }) {
   if (env.LATTICE_DASHBOARD_AUTOSTART === '0') return null;
   let actor;
-  try { actor = mutationActor(env); } catch { return null; }
+  try { actor = mutationActor(env); } catch (error) { if (strict) throw error; return null; }
   const sessionId = actor.session;
   let store;
   try { store = await readTodoStoreStable({ repoRoot }); }
-  catch { return null; }
+  catch (error) { if (strict) throw error; return null; }
   let identity;
   try { identity = await resolveProjectIdentity({ repoRoot, projectId: store.project_id, env }); }
-  catch { return null; }
+  catch (error) { if (strict) throw error; return null; }
   try {
-    return await ensureTodoDashboardActivity({
+    const activity = await ensureTodoDashboardActivity({
       repoRoot, projectId: store.project_id, displayName: identity.displayName, sessionId, env,
     });
-  } catch {
+    const { reportProjectDashboardDelivery } = await import('./dashboard-delivery.mjs');
+    const delivery = await reportProjectDashboardDelivery({ projectId: store.project_id, env, stderr });
+    if (strict && delivery.state === 'failed') {
+      throw new TodoStoreError('DASHBOARD_DELIVERY_FAILED', 'dashboard_delivery_failed', undefined,
+        { delivery });
+    }
+    return { ...activity, delivery };
+  } catch (error) {
     // dashboardは副作用。start/doneをdashboard故障で止めない（ADR 0181）。
+    if (strict) throw error;
+    stderr?.write(`${JSON.stringify({ schema: 'lattice.dashboard_delivery.v1', state: 'failed',
+      reason: error.code ?? 'DASHBOARD_FAILED', project_ids: [store.project_id], urls: [],
+      next_action: 'lattice todo dashboard ensure --json' })}\n`);
     return null;
   }
 }
@@ -3703,7 +3755,8 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
     // コマンドの副作用でしか daemon を ensure できず、OS再起動後に誰も書込まなければ
     // 公開工程図が503のまま沈黙した。launchd等の周期実行から叩く冪等な入口。
     action = async (repoRoot) => {
-      const ensured = await ensureActiveProjectDashboard({ repoRoot, env });
+      const ensured = await ensureActiveProjectDashboard({ repoRoot,
+        env: { ...env, LATTICE_DASHBOARD_AUTOSTART: '1' }, stderr, strict: true });
       return { schema: 'lattice.todo_dashboard_ensure_result.v1',
         ensured: ensured !== null, activity: ensured };
     };
@@ -3970,11 +4023,18 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
     action = (repoRoot) => phaseBaseline({ repoRoot, env, reason: argv[3], exceptPlanKeys });
   } else if (argv[0] === 'start') {
     const flags = matchFlagCommand(argv, ['start'], {
-      known: ['plan', 'task', 'parallel-frontier', 'override-reason', 'serial-confirmed'],
+      known: ['plan', 'task', 'parallel-frontier', 'override-reason', 'serial-confirmed', 'rebind', 'reason'],
       required: ['plan', 'task'],
-      booleans: ['parallel-frontier', 'serial-confirmed'],
+      booleans: ['parallel-frontier', 'serial-confirmed', 'rebind'],
     });
-    if (flags !== null && isTodoIdentifier(flags.plan) && isTodoIdentifier(flags.task)
+    if (flags !== null && flags.rebind === true) {
+      if (isTodoIdentifier(flags.plan) && isTodoIdentifier(flags.task)
+        && typeof flags.reason === 'string' && flags.reason.length > 0) {
+        action = (repoRoot) => rebindStart({
+          repoRoot, env, planKey: flags.plan, taskId: flags.task, reason: flags.reason,
+        });
+      }
+    } else if (flags !== null && isTodoIdentifier(flags.plan) && isTodoIdentifier(flags.task)
       && (flags['override-reason'] === undefined || (typeof flags['override-reason'] === 'string'
         && flags['override-reason'].length > 0))) {
       action = (repoRoot) => startTask({
@@ -4099,7 +4159,7 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
     // `readTodoStoreStable` to read (2026-08-10 P0: `todo verify` was
     // unreachable for exactly the case it exists to diagnose).
     if (writesTodoStore(argv)) {
-      await ensureActiveProjectDashboard({ repoRoot, env });
+      await ensureActiveProjectDashboard({ repoRoot, env, stderr });
     }
     const result = atomicCommit
       ? await commitTodoStoreMutation({ repoRoot, argv, action, env })

package/src/todo-contracts.mjs

@@ -532,6 +532,12 @@ function validPayload(event) {
       && isTodoDigest(payload.target_event_digest)
       && nullableText(payload.reason) && payload.reason !== null;
   }
+  // rebind: plan改訂でcarryされたin-progress ToDoへ、現plan_versionの明示的start束縛を積み直す
+  // （runtime intakeはliteral startだけを束縛に使い、carryを推定しない。ADR 0191）
+  if (event.kind === 'start' && payload?.start_mode === 'rebind') {
+    return exactRecord(payload, ['start_mode', 'reason'])
+      && nullableText(payload.reason) && payload.reason !== null;
+  }
   if (event.kind === 'start') return exactRecord(payload, ['override_reason']) && nullableText(payload.override_reason);
   if (event.kind === 'start_retracted') return exactRecord(payload, ['reason', 'target_start_digest'])
     && nullableText(payload.reason) && payload.reason !== null

package/src/todo-store.mjs

@@ -1,5 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import { fsyncDirectory } from './fs-dir-sync.mjs';
+import { renamePublishedFile } from './fs-publish.mjs';
 import {
   lstat, mkdir, open, readFile, readdir, realpath, rename, rm, rmdir,
 } from 'node:fs/promises';
@@ -678,6 +679,17 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
     if (state === undefined) fail('STORE_INCONSISTENT', 'event_task_missing');
     const dependenciesDone = localPredecessors(plan, event.task_id).every((id) => states.get(id)?.status === 'done');
     if (event.kind === 'start') {
+      if (event.payload.start_mode === 'rebind') {
+        // 改訂でcarryされたin-progressの再束縛。状態・開始時刻は動かさず、start束縛だけを
+        // 現actor・現plan_versionのeventへ更新する（ADR 0191）
+        if (state.status !== 'in-progress') {
+          fail('STORE_INCONSISTENT', 'invalid_rebind_start_transition');
+        }
+        authoredStartBindings.set(event.task_id, {
+          actor: structuredClone(event.actor), event_digest: event.event_digest,
+        });
+        continue;
+      }
       if (event.payload.start_mode === 'historical_import') {
         if (!importedGenesis || state.status !== 'pending') {
           fail('STORE_INCONSISTENT', 'invalid_historical_import_start_transition');
@@ -1125,6 +1137,7 @@ function validateMergedTransition(store, member, event) {
   const phaseAcceptReady = mergedPhaseAcceptReady(store, targetKey);
   const dependenciesDone = taskDependenciesDone && phaseAcceptReady;
   if (event.kind === 'start' && event.payload.start_mode !== 'historical_import'
+    && event.payload.start_mode !== 'rebind'
     && (!phaseAcceptReady || (!taskDependenciesDone && event.payload.override_reason === null))) {
     fail('STORE_INCONSISTENT', 'invalid_start_transition');
   }
@@ -1198,7 +1211,10 @@ function readEvidenceBlob(absoluteRepo, oid) {
   const [entry] = gitCatFileBatch([oid], {
     cwd: absoluteRepo, maxBodyBytes: TODO_LIMITS.narrativeSectionBytes + 1,
   });
-  if (entry.missing || entry.type !== 'blob') throw new Error('not blob');
+  // child_processのmaxBufferはprocess出力の総量を制限するだけで、証拠1件の意味上限ではない。
+  // 契約上限はbytesで明示判定し、process bufferの打切りを意味判定に使わない。
+  if (entry.missing || entry.type !== 'blob'
+    || entry.bytes.length > TODO_LIMITS.narrativeSectionBytes) throw new Error('not bounded blob');
   if (evidenceBlobCache.size >= EVIDENCE_BLOB_CACHE_LIMIT) {
     evidenceBlobCache.delete(evidenceBlobCache.keys().next().value);
   }
@@ -1267,7 +1283,10 @@ function pinnedSourceLine(repoRoot, source, cache = null) {
     }
     if (blob === undefined) {
       const blobEntry = entries.shift();
-      if (blobEntry.missing || blobEntry.type !== 'blob') throw new Error('not blob');
+      // commitとblobを同じbatchで読むと総buffer予算は2件分になる。source 1件の意味上限は
+      // cacheへ入れる前に実bytesで判定する。
+      if (blobEntry.missing || blobEntry.type !== 'blob'
+        || blobEntry.bytes.length > TODO_LIMITS.narrativeSectionBytes) throw new Error('not bounded source blob');
       blob = blobEntry.bytes;
       cache?.blobs.set(objectSpec, blob);
     }
@@ -1704,7 +1723,7 @@ async function atomicWrite(absolute, bytes) {
       process.stderr.write(`lattice: fsync skipped (WSL2/NTFS EIO) ${absolute}\n`);
     }
     await handle.close(); handle = null;
-    await rename(temporary, absolute);
+    await renamePublishedFile(temporary, absolute);
     await fsyncDirectory(path.dirname(absolute));
   } finally {
     if (handle) await handle.close();
@@ -1725,7 +1744,7 @@ async function atomicWriteMode(absolute, bytes, mode) {
       process.stderr.write(`lattice: fsync skipped (WSL2/NTFS EIO) ${absolute}\n`);
     }
     await handle.close(); handle = null;
-    await rename(temporary, absolute);
+    await renamePublishedFile(temporary, absolute);
     await fsyncDirectory(path.dirname(absolute));
   } finally {
     if (handle) await handle.close();