@quolu/lattice 0.76.0 → 0.78.0

package/README.ja.md

@@ -386,8 +386,11 @@ pidへは送りません（pid再利用で無関係のprocessを止めうるた
 [ADR 0157](https://github.com/kitepon/Lattice/blob/main/docs/adr/0157-dashboard-daemons-are-discoverable-by-record.md)が正です。
 状態を書き込む`start / block / unblock / done / evidence promote / reopen / note / independence mode /
 revise / revise-phase / revise-set / phase review|accept|reject|reopen|close-unaudited|baseline /
-dashboard adopt`では、監査actorとして次の3環境変数を渡せます。未設定ならhost／`session`／USERから
-defaultします。渡した値がidentifierとして不正なら`ACTOR_UNRESOLVED`です。
+dashboard adopt`では、監査actorとして次の3環境変数を渡せます。未設定なら、hostは端末ごとのlabel
+（`terminal-`と16進12桁）、sessionは`session`、agentはUSERになります。hostのlabelは端末の乱数の識別子
+（`~/.lattice/bridge-hub-terminal.json`）から導き、OSのhost名はjournalへ書きません
+（[ADR 0197](https://github.com/kitepon/Lattice/blob/main/docs/adr/0197-terminal-label-instead-of-os-hostname.md)）。
+渡した値がidentifierとして不正なら`ACTOR_UNRESOLVED`です。
 
 ```bash
 export LATTICE_TODO_ACTOR_HOST=<host-id>

package/bin/lattice.mjs

@@ -203,11 +203,10 @@ async function scheduleRuntimeErrorReport() {
 
 // typed契約の外へ漏れた例外を、opt-inのruntime error記録へ残す。どの面で・どの種類の例外で
 // 落ちたかを固定語彙の分類（safe_context）で添える——error_codeだけでは原因を追えなかった。
+// 取消は記録せず、通信の失敗が漏れたものは内部故障と別の記録になる（ADR 0196）。
 function observeInternalFailure(error, commandKind) {
-  pendingObservation = import('../src/runtime-errors.mjs').then(({ observeRuntimeError, runtimeErrorSafeContext }) => {
-    observeRuntimeError('LATTICE.CLI_INTERNAL_FAILED', {
-      version: packageJson.version, safeContext: runtimeErrorSafeContext({ commandKind, error }),
-    });
+  pendingObservation = import('../src/runtime-errors.mjs').then(({ observeEscapedCliFailure }) => {
+    observeEscapedCliFailure({ error, commandKind, version: packageJson.version });
   }).catch(() => {});
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/bridge-hub-heartbeat.mjs

@@ -16,22 +16,21 @@
  */
 
 import { randomBytes } from 'node:crypto';
-import { hostname } from 'node:os';
 import { link, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 
 import { bridgeConfigPaths } from './bridge-config.mjs';
 import { BRIDGE_HUB_HEARTBEAT_INTERVAL_MS, validateBridgeHubRegistrationRequest } from './bridge-hub-protocol.mjs';
+import { TERMINAL_IDENTIFIER, TERMINAL_IDENTITY_SCHEMA, terminalIdentityPath, terminalPublicLabel } from './terminal-identity.mjs';
 import { readServedTodoDashboardProjectIds } from './todo-dashboard-registry.mjs';
 
 export { BRIDGE_HUB_HEARTBEAT_INTERVAL_MS };
 
-const TERMINAL_IDENTITY_SCHEMA = 'lattice.bridge_hub_terminal_identity.v1';
 const HEARTBEAT_RESULT_SCHEMA = 'lattice.bridge_hub_heartbeat_result.v1';
 const REGISTRATION_REQUEST_SCHEMA = 'lattice.bridge_hub_registration_request.v1';
 const REGISTER_PATH = '__lattice/hub/register';
 const DEFAULT_TIMEOUT_MS = 5_000;
-const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const IDENTIFIER = TERMINAL_IDENTIFIER;
 
 export class BridgeHubHeartbeatError extends Error {
   constructor(code, message, detail = undefined, cause = undefined) {
@@ -42,10 +41,6 @@ export class BridgeHubHeartbeatError extends Error {
   }
 }
 
-function terminalIdentityPath(env) {
-  return path.join(bridgeConfigPaths(env).root, 'bridge-hub-terminal.json');
-}
-
 /**
  * This terminal's stable bridge-hub identity, created once and reused across
  * restarts. It must survive restarts: registration is a full-state
@@ -85,13 +80,15 @@ export async function readOrCreateBridgeHubTerminalId({ env = process.env } = {}
 }
 
 /**
- * The terminal's own display name, shown for every project it registers
- * (registry entries are per-project but `display_name` is terminal-wide —
- * ADR 0162 Decision 2). Hostname, not a project name: the active project set
- * changes heartbeat to heartbeat but the terminal's identity does not.
+ * The name this terminal registers under (ADR 0197). It is the public label
+ * derived from the terminal id, never the OS hostname: the hub landing is
+ * served to anyone, and a hostname routinely holds its owner's name. Still
+ * terminal-wide (ADR 0162 Decision 2) — the active project set changes
+ * heartbeat to heartbeat but the terminal's identity does not.
  */
-function terminalDisplayName() {
-  return hostname().slice(0, 128) || 'terminal';
+function terminalDisplayName(terminalId) {
+  // 不正なidはここで名付けず、下のrequest検証に型付きで落とさせる。
+  return typeof terminalId === 'string' && IDENTIFIER.test(terminalId) ? terminalPublicLabel(terminalId) : 'terminal';
 }
 
 /** Build and validate one registration/heartbeat request. Throws rather than
@@ -100,7 +97,7 @@ export function buildBridgeHubRegistrationRequest({ terminalId, port, projectIds
   const request = {
     schema: REGISTRATION_REQUEST_SCHEMA,
     terminal_id: terminalId,
-    display_name: terminalDisplayName(),
+    display_name: terminalDisplayName(terminalId),
     port,
     project_ids: [...new Set(projectIds)].sort((left, right) => left.localeCompare(right, 'en')),
     adopt: [...adopt],

package/src/bridge-hub-server.mjs

@@ -36,6 +36,7 @@ import {
   projectBridgeHubRegistry, validateBridgeHubRegistryEntry,
 } from './bridge-hub-protocol.mjs';
 import { escapeHtml, renderBridgeHubLanding } from './bridge-hub-landing.mjs';
+import { terminalPublicLabel } from './terminal-identity.mjs';
 
 const LOOPBACK = '127.0.0.1';
 const HUB_HTTP_ERROR_SCHEMA = 'lattice.bridge_hub_http_error.v1';
@@ -310,27 +311,43 @@ function validRegistryDocument(value) {
     && value.entries.every(validateBridgeHubRegistryEntry);
 }
 
+/** What a terminal is called on the public listing (ADR 0197). Never its self-reported name. */
+function publicTerminalName(terminalId, terminalDisplayNames) {
+  const label = terminalPublicLabel(terminalId);
+  return Object.hasOwn(terminalDisplayNames, label) ? terminalDisplayNames[label] : label;
+}
+
 const EMPTY_VISIBILITY = Object.freeze({
   hidden_project_ids: Object.freeze([]), hidden_terminal_ids: Object.freeze([]), display_names: Object.freeze({}),
+  terminal_display_names: Object.freeze({}),
 });
 
 function validVisibilityDocument(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value)
     && value.schema === HUB_PUBLIC_VISIBILITY_SCHEMA
     && Object.keys(value).every((key) =>
-      ['schema', 'hidden_project_ids', 'hidden_terminal_ids', 'display_names'].includes(key))
+      ['schema', 'hidden_project_ids', 'hidden_terminal_ids', 'display_names', 'terminal_display_names']
+        .includes(key))
     && Array.isArray(value.hidden_project_ids)
     && value.hidden_project_ids.every((entry) => typeof entry === 'string')
     && Array.isArray(value.hidden_terminal_ids)
     && value.hidden_terminal_ids.every((entry) => typeof entry === 'string')
     && value.display_names !== null && typeof value.display_names === 'object'
     && !Array.isArray(value.display_names)
-    && Object.values(value.display_names).every((entry) => typeof entry === 'string');
+    && Object.values(value.display_names).every((entry) => typeof entry === 'string')
+    // 任意（ADR 0197）。無い旧fileはそのまま読め、端末は導出labelで出る。
+    && (value.terminal_display_names === undefined
+      || (value.terminal_display_names !== null && typeof value.terminal_display_names === 'object'
+        && !Array.isArray(value.terminal_display_names)
+        && Object.values(value.terminal_display_names)
+          .every((entry) => typeof entry === 'string' && entry.length > 0 && entry === entry.trim())));
 }
 
 /**
  * Read the operator's public-visibility file (ADR 0164 Decision 3): which
- * projects/terminals stay off the public listing, and how project ids render.
+ * projects/terminals stay off the public listing, how project ids render, and
+ * what each terminal is called in public (`terminal_display_names`, keyed by
+ * the terminal's public label — ADR 0197).
  * Hot-read per request so edits apply without a hub restart. A missing file
  * hides nothing; a malformed file is a typed error, never a silent republish
  * of an internal terminal.
@@ -352,6 +369,7 @@ export async function readBridgeHubPublicVisibility({ env = process.env } = {})
     hidden_project_ids: document.hidden_project_ids,
     hidden_terminal_ids: document.hidden_terminal_ids,
     display_names: document.display_names,
+    terminal_display_names: document.terminal_display_names ?? EMPTY_VISIBILITY.terminal_display_names,
   };
 }
 
@@ -478,10 +496,18 @@ export async function startBridgeHubServer({
     // the codebase's existing posture of not leaking topology to public
     // responses (bridge-server.mjs's public bridge-health strips pid/address
     // the same way).
+    //
+    // `display_name` is the exception that proved the rule: it used to be the
+    // terminal's self-reported name, which was its OS hostname, published to
+    // anyone (ADR 0197). The public name is now the hub's to give — the
+    // operator's entry in `terminal_display_names`, else the label derived
+    // from the terminal id. What a terminal reports about itself stays in the
+    // registry, so a terminal still running an older Lattice cannot put its
+    // hostname back on the page, and neither can a stale offline entry.
     const view = projected.map((entry) => ({
       schema: HUB_PUBLIC_PROJECT_SCHEMA,
       project_id: entry.project_id,
-      display_name: entry.display_name,
+      display_name: publicTerminalName(entry.terminal_id, visibility.terminal_display_names),
       status: entry.status,
       last_seen_at: entry.last_seen_at,
     }));

package/src/cli-command-kind.mjs

@@ -12,6 +12,12 @@ const RUNTIME_SURFACES = Object.freeze({
   event: Object.freeze(['verify']),
 });
 
+/**
+ * storeも端末の状態も書き換えないと確かめた面（ADR 0196）。通信の失敗が漏れた記録の重大度を決める時に使う
+ * ——ここに在る面は、落ちても失うものが無く、打ち直せば戻る。確かめていない面は載せない。
+ */
+export const READ_ONLY_COMMAND_KINDS = new Set(['run.list', 'todo.status', 'todo.verify']);
+
 export function cliCommandKind(argv, surfaces = RUNTIME_SURFACES) {
   if (!Array.isArray(argv)) return 'other';
   const [surface, subcommand] = argv;

package/src/cli-failure-class.mjs

@@ -0,0 +1,34 @@
+/**
+ * typed契約の外へ漏れた例外を、取消・通信の失敗・それ以外に分ける（ADR 0196）。
+ *
+ * runtime error記録の入口が使う。取消は故障として記録しない。通信の失敗が漏れたものは、内部故障とは
+ * 別の記録にする——原因が通信でも、型つきの答えにできず落ちたのは製品の対処不良で、直すのは回線ではなく
+ * その面の通信失敗の受け方である。
+ */
+
+// Nodeとundiciが通信の失敗に付けるcode。端末内のportの取り合い（EADDRINUSE）と、子processとのpipeでも
+// 起きるEPIPEは、通信の失敗に数えない。
+const TRANSPORT_CODES = new Set([
+  'ECONNREFUSED', 'ECONNRESET', 'ECONNABORTED', 'ETIMEDOUT', 'EHOSTUNREACH', 'EHOSTDOWN', 'ENETUNREACH',
+  'ENETDOWN', 'ENOTFOUND', 'EAI_AGAIN', 'ENOTCONN',
+  'ERR_SOCKET_CONNECTION_TIMEOUT', 'ERR_SOCKET_CLOSED',
+  'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT', 'UND_ERR_SOCKET', 'UND_ERR_CLOSED',
+]);
+const CAUSE_DEPTH = 4;
+
+/** 例外と、その`cause`の連なり。`fetch failed`（TypeError）は、通信のcodeを`cause`の側に持つ。 */
+export function failureCauseChain(error) {
+  const chain = [];
+  for (let current = error; current !== null && typeof current === 'object' && chain.length < CAUSE_DEPTH;
+    current = current.cause) chain.push(current);
+  return chain;
+}
+
+/** `cancelled`（利用者や呼び出し元の取消）・`transport`（通信の失敗）・`internal`（それ以外）。 */
+export function cliFailureClass(error) {
+  const chain = failureCauseChain(error);
+  if (chain.some((entry) => entry.name === 'AbortError' || entry.code === 'ABORT_ERR')) return 'cancelled';
+  // `AbortSignal.timeout`の時間切れは`TimeoutError`で届く。
+  if (chain.some((entry) => entry.name === 'TimeoutError' || TRANSPORT_CODES.has(entry.code))) return 'transport';
+  return 'internal';
+}

package/src/runtime-errors.mjs

@@ -5,6 +5,8 @@ import {
 import { homedir, platform as hostPlatform, arch as hostArch } from 'node:os';
 import { dirname, join } from 'node:path';
 
+import { READ_ONLY_COMMAND_KINDS } from './cli-command-kind.mjs';
+import { cliFailureClass, failureCauseChain } from './cli-failure-class.mjs';
 import {
   daclIsOwnerOnly, daclIsProtected, isAclScratchName, readWindowsDacl, restrictWindowsDirToOwner, windowsSelfSid,
 } from './windows-owner-only.mjs';
@@ -40,6 +42,9 @@ const definitions = Object.freeze({
   'LATTICE.RUN_STORE_IO_FAILED': { component: 'run_store', severity: 'high', template: 'Lattice run store IO failed' },
   'LATTICE.EVENT_CHAIN_INTEGRITY_FAILED': { component: 'event_store', severity: 'high', template: 'Lattice run event chain integrity check failed' },
   'LATTICE.CLI_INTERNAL_FAILED': { component: 'cli', severity: 'high', template: 'Lattice CLI crashed outside the typed error contract' },
+  // 通信の失敗が型つき契約の外へ漏れた記録（ADR 0196）。直すのは回線ではなく、その面の通信失敗の受け方。
+  // 重大度は下の`severityOf`が、落ちた面で失うものがあるかで決める。
+  'LATTICE.CLI_TRANSPORT_UNHANDLED': { component: 'cli', severity: 'high', template: 'Lattice CLI let a communication failure escape the typed error contract' },
   'LATTICE.MCP_SERVER_FAILED': { component: 'mcp', severity: 'high', template: 'Lattice MCP server failed' },
 });
 
@@ -169,13 +174,28 @@ const validSafeContext = (value) => plain(value) && exact(value, SAFE_CONTEXT_KE
  */
 export function runtimeErrorSafeContext({ commandKind, error } = {}) {
   const errorKind = error?.constructor?.name;
+  // `fetch failed`のように、codeを`cause`の側に持つ例外がある。連なりの中で最初に語彙へ合うcodeを載せる。
+  const causeCode = failureCauseChain(error).map((entry) => entry.code)
+    .find((code) => typeof code === 'string' && CAUSE_CODE.test(code));
   return {
     command_kind: validCommandKind(commandKind) ? commandKind : 'other',
     error_kind: ERROR_KINDS.has(errorKind) ? errorKind : 'other',
-    cause_code: typeof error?.code === 'string' && CAUSE_CODE.test(error.code) ? error.code : 'none',
+    cause_code: causeCode ?? 'none',
   };
 }
 
+/**
+ * 記録の重大度。error_codeだけでは決めない記録がある（ADR 0196）: 通信の失敗が漏れた記録は、落ちた面が
+ * 何も書き換えないと確かめてある時だけ`warn`——その1回が止まっただけで、失うものが無く、打ち直せば戻る。
+ * 書き換える面と、確かめていない面は`high`のまま（結果が分からず、不整合や重複を否定できない）。
+ * 分類と面から決まる値なので、同じfingerprintの記録は必ず同じ重大度になる。
+ */
+function severityOf(code, safeContext = null) {
+  if (code === 'LATTICE.CLI_TRANSPORT_UNHANDLED' && safeContext !== null
+    && READ_ONLY_COMMAND_KINDS.has(safeContext.command_kind)) return 'warn';
+  return definitions[code].severity;
+}
+
 /**
  * 旧記録（safe_context無し）はerror_codeだけで決まる式のまま。新しい記録は3つの分類も含める
  * ——原因が違えば別の記録になる。式はdotagentsのadapterが再計算して照合する契約で、
@@ -269,7 +289,7 @@ function validate(store) {
     const definition = definitions[record.error_code];
     if (!definition || record.product !== PRODUCT || !validVersion(record.product_version)
       || record.component !== definition.component || record.message_template !== definition.template
-      || record.severity !== definition.severity || record.fingerprint !== fingerprintOf(record.error_code, safeContext)
+      || record.severity !== severityOf(record.error_code, safeContext) || record.fingerprint !== fingerprintOf(record.error_code, safeContext)
       || seen.has(record.fingerprint) || !Number.isSafeInteger(record.count) || record.count < 1
       || !validTime(record.first_seen) || !validTime(record.last_seen)
       || Date.parse(record.first_seen) > Date.parse(record.last_seen)
@@ -442,7 +462,7 @@ export function recordRuntimeError(code, options = {}) {
       if (store.records.length >= MAX_RECORDS) throw Error('store_overflow');
       store.records.push({
         product: PRODUCT, product_version: version, component: definition.component, error_code: code,
-        message_template: definition.template, severity: definition.severity, fingerprint: key,
+        message_template: definition.template, severity: severityOf(code, safeContext), fingerprint: key,
         count: 1, first_seen: time, last_seen: time, state_schema_version: STATE_VERSION,
         os, arch, status: 'open', resolved_at: null, reason_code: null, sequence,
         safe_context: { ...safeContext },
@@ -462,6 +482,17 @@ export function observeRuntimeError(code, options = {}) {
   }
 }
 
+/**
+ * CLIのtyped契約の外へ漏れた例外を記録する（process境界のbinが呼ぶ）。取消は故障ではないので記録しない。
+ * 通信の失敗が漏れたものは内部故障と別の記録にし、重大度を面で決める（ADR 0196）。
+ */
+export function observeEscapedCliFailure({ error, commandKind, ...options }) {
+  const failureClass = cliFailureClass(error);
+  if (failureClass === 'cancelled') return;
+  observeRuntimeError(failureClass === 'transport' ? 'LATTICE.CLI_TRANSPORT_UNHANDLED' : 'LATTICE.CLI_INTERNAL_FAILED',
+    { ...options, safeContext: runtimeErrorSafeContext({ commandKind, error }) });
+}
+
 export function acknowledgeRuntimeErrors(cursor, options = {}) {
   requireCursor(cursor);
   if (!collectionEnabled(options)) return snapshot({ ...options, afterCursor: cursor });

package/src/terminal-identity.mjs

@@ -0,0 +1,93 @@
+/**
+ * This terminal's identity and the label it shows to others (ADR 0197).
+ *
+ * The identity is a random id kept in the Lattice config root. It was born as
+ * the bridge-hub's routing key (`bridge-hub-heartbeat.mjs`, ADR 0162) and stays
+ * that: the id itself never leaves the terminal↔hub wire.
+ *
+ * The label is what leaves. Todo journals are committed into public
+ * repositories and the hub landing is served to anyone, so neither may carry
+ * the OS hostname — a hostname is free text the operating system chose, and
+ * it routinely holds its owner's name. The label is derived one-way from the
+ * id: stable per terminal, so records and the landing still tell terminals
+ * apart, and it says nothing about the machine or the person.
+ */
+
+import { createHash, randomBytes } from 'node:crypto';
+import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { bridgeConfigPaths } from './bridge-config.mjs';
+
+export const TERMINAL_IDENTITY_SCHEMA = 'lattice.bridge_hub_terminal_identity.v1';
+export const TERMINAL_IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+
+const LABEL_DOMAIN = 'lattice.terminal_public_label.v1';
+const LABEL_HEX_LENGTH = 12;
+
+export function terminalIdentityPath(env = process.env) {
+  return path.join(bridgeConfigPaths(env).root, 'bridge-hub-terminal.json');
+}
+
+/**
+ * The label a terminal is shown under in journals and on the hub landing.
+ * One-way: the routing id cannot be recovered from it, so publishing the label
+ * does not hand out the key the hub reconciles registrations by.
+ */
+export function terminalPublicLabel(terminalId) {
+  if (typeof terminalId !== 'string' || !TERMINAL_IDENTIFIER.test(terminalId)) {
+    throw new TypeError('terminal id is invalid');
+  }
+  const digest = createHash('sha256').update(`${LABEL_DOMAIN}\0${terminalId}`).digest('hex');
+  return `terminal-${digest.slice(0, LABEL_HEX_LENGTH)}`;
+}
+
+/**
+ * Synchronous twin of `readOrCreateBridgeHubTerminalId`: same file, same
+ * schema, same no-overwrite publish. The todo CLI resolves its actor
+ * synchronously on every mutation, and both paths must agree on one id per
+ * terminal — a second file would give the journal and the landing two
+ * different labels for the same machine.
+ *
+ * Returns `null` when the id can be neither read nor created (read-only or
+ * missing home, invalid file). The caller decides what an unidentified
+ * terminal is called; this function never invents an id it could not persist,
+ * because an unpersisted id would change on every call.
+ */
+export function readOrCreateTerminalIdSync({ env = process.env } = {}) {
+  let ref;
+  try {
+    ref = terminalIdentityPath(env);
+    mkdirSync(path.dirname(ref), { recursive: true, mode: 0o700 });
+  } catch {
+    return null;
+  }
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const value = JSON.parse(readFileSync(ref, 'utf8'));
+      return value?.schema === TERMINAL_IDENTITY_SCHEMA && TERMINAL_IDENTIFIER.test(value.terminal_id)
+        ? value.terminal_id : null;
+    } catch (error) {
+      if (error?.code !== 'ENOENT') return null;
+    }
+    const terminalId = randomBytes(16).toString('hex');
+    const temporary = `${ref}.${terminalId}.tmp`;
+    try {
+      writeFileSync(temporary, `${JSON.stringify({ schema: TERMINAL_IDENTITY_SCHEMA, terminal_id: terminalId })}\n`,
+        { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    } catch {
+      return null;
+    }
+    try {
+      // 完成済みのbytesだけを、既存のIDを上書きせず公開する。
+      linkSync(temporary, ref);
+      return terminalId;
+    } catch (error) {
+      if (error?.code !== 'EEXIST') return null;
+      // 同時生成の勝者が公開した完成済みIDを読む。
+    } finally {
+      try { unlinkSync(temporary); } catch { /* 一時fileは残っても識別子を壊さない */ }
+    }
+  }
+  return null;
+}

package/src/todo-cli.mjs

@@ -1,9 +1,7 @@
 import { cliCommandKind } from './cli-command-kind.mjs';
+import { cliFailureClass } from './cli-failure-class.mjs';
 import { gitSync } from './git-process.mjs';
 import { createHash } from 'node:crypto';
-import {
-  hostname,
-} from 'node:os';
 import {
   lstat, mkdir, readFile, realpath, writeFile,
 } from 'node:fs/promises';
@@ -38,6 +36,7 @@ import {
   ensureTodoDashboardActivity,
   removeTodoDashboardProject,
 } from './todo-dashboard-registry.mjs';
+import { readOrCreateTerminalIdSync, terminalPublicLabel } from './terminal-identity.mjs';
 import { readProjectExternalPane, resolveProjectIdentity } from './project-identity.mjs';
 import { layoutTodoGantt } from './todo-gantt-layout.mjs';
 import { TODO_GANTT_SCOPES } from './todo-gantt-scope.mjs';
@@ -562,6 +561,16 @@ function sanitizeActorIdentifier(raw, fallback) {
   return isTodoIdentifier(compact) ? compact : fallback;
 }
 
+/**
+ * 名乗りの無い操作のhost（ADR 0197）。journalは公開repositoryへcommitされるので、OSのhost名は
+ * 書かない——host名はOSが決めた自由文で、持ち主の名前を含むことがある。端末ごとの識別子から
+ * 一方向に導いたlabelを使い、端末の区別は保つ。識別子を読めず作れない端末は`host`になる。
+ */
+function defaultActorHost(env) {
+  const terminalId = readOrCreateTerminalIdSync({ env });
+  return terminalId === null ? 'host' : terminalPublicLabel(terminalId);
+}
+
 function mutationActor(env) {
   const provided = ACTOR_ENV_KEYS.map((key) => ({ key, value: env[key] }));
   const invalidEnvironment = provided
@@ -578,7 +587,7 @@ function mutationActor(env) {
   return {
     host: isTodoIdentifier(env.LATTICE_TODO_ACTOR_HOST)
       ? env.LATTICE_TODO_ACTOR_HOST
-      : sanitizeActorIdentifier(hostname(), 'host'),
+      : defaultActorHost(env),
     session: isTodoIdentifier(env.LATTICE_TODO_ACTOR_SESSION)
       ? env.LATTICE_TODO_ACTOR_SESSION
       : 'session',
@@ -4253,7 +4262,8 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env,
   } catch (error) {
     if (error instanceof TodoStoreError || (typeof error?.code === 'string'
       && error.detail !== null && typeof error.detail === 'object')) return typedFailure(stderr, error);
-    if (error instanceof TypeError) {
+    // 漏れた`fetch failed`もTypeErrorで届く。呼び出し側の契約違反と答えず、内部故障として観測口へ渡す。
+    if (error instanceof TypeError && cliFailureClass(error) !== 'transport') {
       return typedFailure(stderr, {
         code: 'CONTRACT_VIOLATION',
         message: error.message,