onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/reconstruct/mock-llm-realization.js

@@ -3,6 +3,44 @@ import { ontologySeedClaimProjections } from "./seed-claim-projections.js";
 export const RECONSTRUCT_MOCK_REALIZATION_ENV = REVIEW_MOCK_REALIZATION_ENV;
 export const RECONSTRUCT_MOCK_AUTHOR_ID = "reconstruct-mock-semantic-author";
 export const RECONSTRUCT_MOCK_CONFIRMATION_PROVIDER_ID = "reconstruct-mock-confirmation-provider";
+/**
+ * Layer-2 semantic-map author capability — MOCK realization (wiring design 20260702 §7-W5).
+ *
+ * Wraps a directive author with the deterministic capability PAIR (the production direct-call
+ * author deliberately does NOT implement it — real-LLM authoring is a separate owner-approved
+ * cut, so the live path stays default-off). Pure functions of their input:
+ *  - synthesize: one boundary at the node's first value-shape seam when one exists (reconciled
+ *    anchored) plus ALWAYS one at row_start — emission is unconditional; the deterministic
+ *    reconcile CLASSIFIES it (unanchored → adversarial verify path — whenever no seam lies
+ *    within ±1 of row_start, which holds for every non-seam-adjacent region start);
+ *  - verify: confirmed on even rows, refuted on odd (exercises kept AND disclosed dispositions).
+ * The two-path description above is the mock's FUNCTION CONTRACT given seam-ful input; the W5
+ * E2E fixture is seam-less through the production observer (adversary F1, probe-confirmed), so
+ * the E2E itself traverses only the unanchored→refuted path — anchored/confirmed execution
+ * coverage lives in semantic-map-stage.test.ts.
+ * Mock output verifies wiring/contracts only — never product semantic quality.
+ */
+export function withMockSemanticMapCapability(author) {
+    return {
+        ...author,
+        async synthesizeSemanticMapNode(input) {
+            const seam = input.value_shape_seams[0];
+            return {
+                semantic_summary: `mock ${input.node_ref.sheet}#${input.node_ref.column_index}:` +
+                    `${input.node_ref.row_start}-${input.node_ref.row_end} kids=${input.child_summaries.length}`,
+                boundaries: [
+                    ...(seam
+                        ? [{ row: seam.row, character_before: "seam-prev", character_after: "seam-next" }]
+                        : []),
+                    { row: input.node_ref.row_start, character_before: "prev", character_after: "next" },
+                ],
+            };
+        },
+        async verifySemanticMapBoundary(input) {
+            return input.boundary.row % 2 === 0 ? "adversarial_confirmed" : "adversarial_refuted";
+        },
+    };
+}
 export function isReconstructMockLlmRealizationEnabled(env = process.env) {
     return env[RECONSTRUCT_MOCK_REALIZATION_ENV] === "1";
 }
@@ -805,8 +843,52 @@ export function callReconstructMockLlm(systemPrompt, userPrompt) {
         });
     }
     else if (systemPrompt.includes("Author answer-support-ledger.yaml")) {
+        // Defect-3 G4: derive a deterministic direct_authority cluster from the
+        // prompt's frontier questions + prompt-visible observations. With the shared
+        // empty-frontier mock (questions:[]) this yields [] so the ~12 full-pipeline
+        // completion tests are unaffected; a non-empty-frontier fixture exercises the
+        // real G1/G2/G3 per-evidence-ref path (the path the empty mock hid).
+        const frontierQuestions = (input.questions ?? []);
+        const promptVisibleObservationIds = (input.prompt_visible_observation_ids ?? []);
+        const questionRefs = frontierQuestions
+            .map((question) => question.question_id)
+            .filter((id) => typeof id === "string" && id.length > 0);
+        if (questionRefs.length === 0 || promptVisibleObservationIds.length === 0) {
+            text = JSON.stringify({ evidence_clusters: [] });
+        }
+        else {
+            text = JSON.stringify({
+                evidence_clusters: [
+                    {
+                        evidence_cluster_id: "mock-evidence-cluster-1",
+                        question_refs: questionRefs,
+                        support_mode: "direct_authority",
+                        proposed_answer_summary: "Mock direct-authority support derived from the observed runtime-target source.",
+                        evidence_observation_ids: [promptVisibleObservationIds[0]],
+                        proof_refs: [],
+                        user_confirmation_refs: [],
+                        authority_response_refs: [],
+                        independence_basis: "Deterministic mock structural observation of the runtime-target source.",
+                        contradiction_refs: [],
+                        limitation_refs: [],
+                    },
+                ],
+            });
+        }
+    }
+    else if (systemPrompt.includes("Author answer-support-judgment.yaml")) {
+        // Mirrors the judge author payload shape: per-cluster
+        // {evidence_cluster_id, evidence_observation_ids}. Returns one supported
+        // judgment per cited evidence to exercise the supported path deterministically.
+        const judgeClusters = (input.evidence_clusters ?? []);
         text = JSON.stringify({
-            evidence_clusters: [],
+            judgments: judgeClusters.flatMap((cluster) => (cluster.evidence_observation_ids ?? []).map((observationId, index) => ({
+                judgment_id: `${cluster.evidence_cluster_id}-judgment-${index + 1}`,
+                evidence_cluster_ref: cluster.evidence_cluster_id,
+                evidence_observation_id: observationId,
+                supports: "supported",
+                rationale_ref: `rationale:${cluster.evidence_cluster_id}:${observationId}`,
+            }))),
         });
     }
     else if (systemPrompt.includes("Author maturation-answer-claims.yaml")) {
@@ -819,6 +901,43 @@ export function callReconstructMockLlm(systemPrompt, userPrompt) {
             expansions: [],
         });
     }
+    else if (systemPrompt.includes("Read provisional column labels for a low-confidence")) {
+        // P1-C2-A §11 R10 / P1-C2-B′ §3: the leaf-reader (CAPTURE) fixture branch. Returns one
+        // provisional label per known column PLUS a deterministic capture (role/note) so the generalized
+        // capture path is exercised. The mock model_id is a constant ("reconstruct-mock-model" in the
+        // result below), so the model-identity-rotation test must mutate the PRODUCTION LlmCallConfig,
+        // never this constant (avoids CG-2 contamination).
+        const columns = (input.columns ?? []);
+        // Deterministic role rotation across the bounded vocabulary (mock only — no domain meaning).
+        const mockRoles = ["category", "measure", "identifier", "free_text", "reference"];
+        text = JSON.stringify({
+            labels: columns.map((column, i) => ({
+                column_index: column.column_index,
+                tentative_label: `provisional column ${column.column_index}`,
+                semantic_role: mockRoles[i % mockRoles.length],
+                captured_note: `mock capture for column ${column.column_index}`,
+            })),
+            unread_columns: [],
+        });
+    }
+    else if (systemPrompt.includes("Select spreadsheet cell locations")) {
+        // Maturation value-read location pick (design §15.4). Echo the FIRST allowed grid scope so an
+        // incidental value-read exercises the cell-read path; an empty allowed set yields no pick (honest).
+        const allowed = (input.allowed_locations ?? []);
+        text = JSON.stringify({
+            picked_locations: allowed.length > 0 ? [allowed[0]] : [],
+        });
+    }
+    else if (systemPrompt.includes("Judge whether read spreadsheet cell values")) {
+        // Value-read judgment (design §15.4). Default INCONCLUSIVE so an incidental value-read in an
+        // existing full mock run discharges nothing (regression-0 / byte-parity — never flips a row to
+        // value_resolved). A dedicated value-read E2E drives `satisfied` via a stub llmCall, not this
+        // dispatcher. Honest "ran but discharged zero".
+        text = JSON.stringify({
+            satisfaction_status: "inconclusive",
+            rationale: "mock value-read judgment: read values do not decide the limitation",
+        });
+    }
     else if (systemPrompt.includes("writing the final reconstruct result")) {
         text = [
             "# Reconstruct Result",

package/dist/core-runtime/reconstruct/obligation-assertion.js

@@ -0,0 +1,18 @@
+/**
+ * G(a) — obligation recorder (INV-OBLIGATION-COVERAGE-1).
+ *
+ * A validator calls `assertObligation(acc, id)` at an UNCONDITIONAL position before each
+ * check-block's guard, accumulating the obligation ids whose enforcer block was reached.
+ * The accumulator is emitted as `asserted_obligation_ids: string[]` on the validation
+ * artifact (off the reuse-hash five). The obligation-coverage harvest test re-derives this
+ * set dynamically (deleting the call reds the harvest) and the gate proves every active
+ * `(validator_id, obligation_id)` is either recorded here or parked in the pending ledger.
+ *
+ * Scope honesty: this records that control REACHED the enforcer block — NOT that the
+ * enforcer is semantically correct. Idempotent: a repeat id is not pushed twice.
+ */
+export function assertObligation(asserted, obligationId) {
+    if (!asserted.includes(obligationId)) {
+        asserted.push(obligationId);
+    }
+}

package/dist/core-runtime/reconstruct/ontology-seed-validation.js

@@ -1,7 +1,9 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
 import { loadReconstructContractRegistry, } from "./contract-registry.js";
+import { assertObligation } from "./obligation-assertion.js";
 function isoNow() {
     return new Date().toISOString();
 }
@@ -88,6 +90,7 @@ function normalizeSourceRef(ref) {
     return path.resolve(ref);
 }
 function evidenceObservationById(sourceObservations) {
+    assertArrayField(sourceObservations.observations, "source-observations", "observations");
     return new Map(sourceObservations.observations.map((observation) => [
         observation.observation_id,
         observation,
@@ -179,9 +182,11 @@ function readEvidenceRefs(args) {
     return evidenceRefs;
 }
 function registryCandidateKindIds(registry) {
+    assertArrayField(registry.candidate_kind_registry, "contract-registry", "candidate_kind_registry");
     return new Set(registry.candidate_kind_registry.map((record) => record.candidate_kind_id));
 }
 function registryCandidateDispositionIds(registry) {
+    assertArrayField(registry.candidate_disposition_registry, "contract-registry", "candidate_disposition_registry");
     return new Set(registry.candidate_disposition_registry.map((record) => record.disposition_id));
 }
 function candidateValidationViolation(args) {
@@ -193,7 +198,19 @@ function candidateValidationViolation(args) {
     };
 }
 export function validateCandidateDisposition(args) {
+    assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
     const violations = [];
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1): record that control reached the
+    // per-candidate / per-disposition enforcement loops below. Unconditional, before any per-row
+    // guard so a zero-candidate/zero-disposition input still stamps. Only the four obligations with a
+    // distinct, name-matching enforcer are recorded; salience-scoped and surface/purpose/limitation/
+    // frontier obligations are PARKED (this validator is salience-blind and takes no purpose-frame or
+    // surface input) — see obligation-coverage-ledger.yaml.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_candidate_inventory_candidate_kind_against_candidate_kind_registry");
+    assertObligation(assertedObligationIds, "validate_candidate_disposition_against_candidate_disposition_registry");
+    assertObligation(assertedObligationIds, "require_rationale_and_evidence_refs_for_each_disposition");
+    assertObligation(assertedObligationIds, "validate_promoted_candidate_target_seed_refs_are_declared_for_promoted_dispositions");
     const addShapeViolation = (_code, message) => {
         violations.push(candidateValidationViolation({
             code: "schema_shape_invalid",
@@ -382,6 +399,7 @@ export function validateCandidateDisposition(args) {
         validation_results: violations.length === 0
             ? ["candidate_disposition_valid"]
             : ["candidate_disposition_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -726,10 +744,25 @@ function checkSourceRefs(args) {
     }
 }
 export function validateOntologySeed(args) {
+    assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
+    assertArrayField(args.registry.coverage_axis_registry, "contract-registry", "coverage_axis_registry");
     const violations = [];
     const addShapeViolation = (_code, message) => {
         violations.push(seedValidationViolation({ code: "schema_shape_invalid", message }));
     };
+    // G(a) slice 26: record the six obligations this validator FULLY enforces with a distinct,
+    // name-matching site (stamped before the per-root/per-row guards so a zero-row seed still records).
+    // Parked (see obligation-coverage-ledger.yaml notes): surface_dimension_closure / closure_status /
+    // mixed-member-lineage / dynamic_boundaries name fields this function never reads; the three
+    // purpose-projection/confirmation obligations are activation_gated_dormant (their conditional inputs
+    // — source-purpose-candidates-validation / purpose-confirmation-validation — are never received here).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "require_static_kinetic_dynamic_actionability_coverage_axes");
+    assertObligation(assertedObligationIds, "validate_purpose_required_element_seed_ref_refs_against_known_seed_refs");
+    assertObligation(assertedObligationIds, "validate_promoted_candidate_target_seed_refs_are_realized");
+    assertObligation(assertedObligationIds, "validate_instance_assertion_mapping_status");
+    assertObligation(assertedObligationIds, "require_limitation_ref_when_instance_availability_status_is_absent_or_unknown");
+    assertObligation(assertedObligationIds, "require_ready_ontology_handoff_mappings_to_have_substantive_content_or_limitation_refs");
     const seed = readRecord(args.ontologySeed, "ontology_seed", addShapeViolation);
     const disposition = readRecord(args.candidateDisposition, "candidate_disposition", addShapeViolation);
     const sessionId = optionalString(disposition?.session_id) ??
@@ -1907,22 +1940,20 @@ export function validateOntologySeed(args) {
         validation_results: violations.length === 0
             ? ["ontology_seed_valid"]
             : ["ontology_seed_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 async function readYamlDocument(filePath) {
     return parseYaml(await fs.readFile(filePath, "utf8"));
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 export async function writeCandidateDispositionValidationArtifact(args) {
     const [candidateInventory, candidateDisposition, sourceObservations, registry] = await Promise.all([
         readYamlDocument(args.candidateInventoryPath),
         readYamlDocument(args.candidateDispositionPath),
         readYamlDocument(args.sourceObservationsPath),
-        loadReconstructContractRegistry({ registryPath: args.registryPath }),
+        args.contractRegistry ??
+            loadReconstructContractRegistry({ registryPath: args.registryPath }),
     ]);
     const validation = validateCandidateDisposition({
         candidateInventory,
@@ -1942,7 +1973,8 @@ export async function writeOntologySeedValidationArtifact(args) {
         readYamlDocument(args.ontologySeedPath),
         readYamlDocument(args.candidateDispositionPath),
         readYamlDocument(args.sourceObservationsPath),
-        loadReconstructContractRegistry({ registryPath: args.registryPath }),
+        args.contractRegistry ??
+            loadReconstructContractRegistry({ registryPath: args.registryPath }),
     ]);
     const validation = validateOntologySeed({
         ontologySeed,

package/dist/core-runtime/reconstruct/output-budget.js

@@ -0,0 +1,6 @@
+export const RECONSTRUCT_SEMANTIC_AUTHOR_OUTPUT_CEILINGS = {
+    candidate_disposition: 4_000,
+    ontology_seed: 9_000,
+    json_parse_repair: 16_000,
+};
+export const RECONSTRUCT_SEMANTIC_AUTHOR_MAX_BASE_OUTPUT_TOKENS = Math.max(...Object.values(RECONSTRUCT_SEMANTIC_AUTHOR_OUTPUT_CEILINGS));

package/dist/core-runtime/reconstruct/pipeline-execution-ledger.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { PIPELINE_EXECUTION_LEDGER_SCHEMA_VERSION, buildLedgerTrust, buildOutputHashes, isTrustedLedgerUnit, normalizeLedgerRefs, } from "../pipeline-execution-ledger.js";
 import { terminalFailureMessageFromTelemetry } from "./execution-telemetry.js";
+import { DispatchFallbackOutcomeSchema, projectDispatchFallbackRecordBlock, } from "./dispatch-fallback-artifacts.js";
 const RECONSTRUCT_LEDGER_STAGE_SPECS = [
     {
         unitId: "run_control",
@@ -193,6 +194,23 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "source_observation_reentry_validation",
         ],
     },
+    {
+        // Layer-2 semantic_map stage (W3 review: codex W3-002 ≡ onto issue-001/002/006 — 4-lens
+        // convergence on audit-graph registration). The LIVE run does not consume this ledger (it is a
+        // post-hoc audit projection derived from the record), so this row is descriptive evidence, not
+        // continuation authority. Authored-artifact reuse still folds the stage fingerprint into the
+        // seed key; breaker recovery is stage-local and consumes dispatch-incomplete.yaml only after
+        // semantic-map-resume-validation.yaml validates retained census/sidecar rows. unitKind is NOT
+        // "semantic_map" — that kind name is already taken by claim_realization (pre-existing vocabulary
+        // collision).
+        unitId: "semantic_map",
+        unitKind: "semantic_map_accumulation",
+        owner: "host_llm",
+        artifactKey: "semantic_map_census",
+        // DATA dependency (ultracode audit E: the earlier lineage-validation edge was a false/temporal
+        // edge — the stage reads source_observations' inventory tiles, nothing from the lineage index).
+        upstreamUnitIds: ["source_observation"],
+    },
     {
         unitId: "source_purpose_candidates",
         unitKind: "semantic_source_purpose",
@@ -286,6 +304,16 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
         artifactKey: "seed_authoring_readiness_validation",
         upstreamUnitIds: ["seed_authoring_readiness"],
     },
+    {
+        // M3c: runtime snapshot of the pre-maturation seed-stage projected observations,
+        // captured at the seed-authoring gate; the conserved authority the resume truncation
+        // fallback measures. Runtime-owned, derived from the source-observation unit.
+        unitId: "seed_stage_prompt_source_observations",
+        unitKind: "source_observation_snapshot",
+        owner: "runtime",
+        artifactKey: "seed_stage_prompt_source_observations",
+        upstreamUnitIds: ["source_observation", "seed_authoring_readiness_validation"],
+    },
     {
         unitId: "ontology_seed",
         unitKind: "semantic_ontology_seed",
@@ -575,19 +603,40 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "source_safety_validation",
         ],
     },
+    {
+        unitId: "answer_support_judgment",
+        unitKind: "semantic_answer_support_judgment",
+        owner: "host_llm",
+        artifactKey: "answer_support_judgment",
+        upstreamUnitIds: ["answer_support_ledger_validation"],
+    },
+    {
+        unitId: "answer_support_judgment_validation",
+        unitKind: "runtime_validation",
+        owner: "runtime",
+        artifactKey: "answer_support_judgment_validation",
+        upstreamUnitIds: [
+            "answer_support_judgment",
+            "answer_support_ledger_validation",
+        ],
+    },
     {
         unitId: "maturation_answer_claims",
         unitKind: "semantic_answer_claims",
         owner: "host_llm",
         artifactKey: "maturation_answer_claims",
-        upstreamUnitIds: ["answer_support_ledger_validation"],
+        upstreamUnitIds: ["answer_support_judgment_validation"],
     },
     {
         unitId: "maturation_answer_claims_validation",
         unitKind: "runtime_validation",
         owner: "runtime",
         artifactKey: "maturation_answer_claims_validation",
-        upstreamUnitIds: ["maturation_answer_claims", "answer_support_ledger_validation"],
+        upstreamUnitIds: [
+            "maturation_answer_claims",
+            "answer_support_judgment_validation",
+            "answer_support_ledger_validation",
+        ],
     },
     {
         unitId: "ontology_expansion",
@@ -612,6 +661,7 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "baseline_actionability_matrix_validation",
             "maturation_answer_claims_validation",
             "ontology_expansion_validation",
+            "maturation_question_frontier_validation",
         ],
     },
     {
@@ -624,6 +674,7 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "maturation_baseline_validation",
             "maturation_answer_claims_validation",
             "ontology_expansion_validation",
+            "maturation_question_frontier_validation",
         ],
     },
     {
@@ -821,6 +872,19 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
         upstreamUnitIds: ["record_assembly"],
     },
 ];
+export function reconstructStageIdForArtifactRef(artifactRef) {
+    const artifactKey = path.basename(artifactRef, path.extname(artifactRef))
+        .replaceAll("-", "_");
+    return RECONSTRUCT_LEDGER_STAGE_SPECS.find((spec) => spec.artifactKey === artifactKey)?.unitId ?? null;
+}
+export function reconstructStageOwner(stageId) {
+    const owner = RECONSTRUCT_LEDGER_STAGE_SPECS.find((spec) => spec.unitId === stageId)?.owner;
+    if (owner === "runtime" || owner === "host_llm")
+        return owner;
+    if (owner === "user_or_host_mediated")
+        return "host_or_user";
+    return null;
+}
 const VALIDATION_GATE_BY_AUTHORED_UNIT = new Map([
     ["observation_directive", "observation_directive_validation"],
     ["source_frontier", "source_frontier_validation"],
@@ -837,6 +901,7 @@ const VALIDATION_GATE_BY_AUTHORED_UNIT = new Map([
     ["maturation_question_frontier", "maturation_question_frontier_validation"],
     ["maturation_closure_frontier", "maturation_closure_frontier_validation"],
     ["answer_support_ledger", "answer_support_ledger_validation"],
+    ["answer_support_judgment", "answer_support_judgment_validation"],
     ["maturation_answer_claims", "maturation_answer_claims_validation"],
     ["ontology_expansion", "ontology_expansion_validation"],
     ["maturation_source_delta", "maturation_source_delta_validation"],
@@ -907,6 +972,7 @@ const PRESENCE_INPUTS_BY_RUNTIME_VALIDATION = new Map([
         ["maturation_authority_response"],
     ],
     ["answer_support_ledger_validation", ["answer_support_ledger"]],
+    ["answer_support_judgment_validation", ["answer_support_judgment"]],
     ["maturation_answer_claims_validation", ["maturation_answer_claims"]],
     ["ontology_expansion_validation", ["ontology_expansion"]],
     [
@@ -1070,6 +1136,31 @@ export async function buildReconstructPipelineExecutionLedger(params) {
             }),
         ]),
     ]));
+    const dispatchFallback = params.reconstructRecord.dispatch_fallback;
+    if (dispatchFallback) {
+        const semanticMapManifestStep = manifestStepByUnitId.get("semantic_map");
+        if (!semanticMapManifestStep?.artifact_refs.includes(dispatchFallback.outcome_ref)) {
+            throw new Error("dispatch fallback record/manifest mismatch: semantic_map step must consume the completed outcome ref.");
+        }
+        const parsedOutcome = DispatchFallbackOutcomeSchema.safeParse(parseYaml(await fs.readFile(dispatchFallback.outcome_ref, "utf8")));
+        if (!parsedOutcome.success || parsedOutcome.data.status !== "completed") {
+            throw new Error("dispatch fallback record/ledger mismatch: outcome artifact is not a valid completed canonical outcome.");
+        }
+        const canonicalBlock = projectDispatchFallbackRecordBlock({
+            outcome: parsedOutcome.data,
+            outcomeIntegrity: {
+                path: dispatchFallback.outcome_ref,
+                sha256: dispatchFallback.outcome_sha256,
+            },
+        });
+        if (Object.entries(canonicalBlock).some(([key, value]) => JSON.stringify(dispatchFallback[key]) !== JSON.stringify(value))) {
+            throw new Error("dispatch fallback record/ledger mismatch: record block is not the canonical outcome projection.");
+        }
+        artifactRefsByUnitId.set("semantic_map", normalizeLedgerRefs([
+            ...(artifactRefsByUnitId.get("semantic_map") ?? []),
+            dispatchFallback.outcome_ref,
+        ]));
+    }
     const sourceDeltaFrontierKind = await sourceObservationDeltaFrontierKind(artifactRefsByUnitId.get("source_observation_delta") ?? []);
     const sourceObservationReentryPresent = (artifactRefsByUnitId.get("source_observation_reentry_validation") ?? [])
         .length > 0;
@@ -1088,6 +1179,12 @@ export async function buildReconstructPipelineExecutionLedger(params) {
         const outputRefs = artifactRefsByUnitId.get(spec.unitId) ?? [];
         const outputHashes = await buildOutputHashes(outputRefs);
         outputHashesByUnitId.set(spec.unitId, outputHashes);
+        if (spec.unitId === "semantic_map" &&
+            dispatchFallback &&
+            outputHashes[dispatchFallback.outcome_ref] !==
+                dispatchFallback.outcome_sha256) {
+            throw new Error("dispatch fallback record/ledger mismatch: outcome file hash does not match the completed record block.");
+        }
         if (spec.unitKind === "runtime_validation") {
             validationStatusesByUnitId.set(spec.unitId, await runtimeValidationOutputStatus(outputRefs));
         }
@@ -1114,12 +1211,22 @@ export async function buildReconstructPipelineExecutionLedger(params) {
                 }
                 return trustedUnitIds.has(unitId);
             });
+            // Pre-stage sessions (ultracode audit E, read-path): when a manifest IS provided but carries
+            // NO step for this unit, the run predates the unit's registration — the terminal validator
+            // (manifest_step_missing, W3-004) forces every CURRENT manifest to carry every stage, so an
+            // absent step can only mean "this run never had the stage". Reporting it "missing" would raise
+            // a false defect signal on every historical session each time a stage is added.
+            const predatesUnit = params.reconstructRunManifest != null &&
+                manifestStatus(params.reconstructRunManifest, spec.unitId) == null &&
+                !manifestStepByUnitId.has(spec.unitId);
             const status = manifestStatus(params.reconstructRunManifest, spec.unitId) ??
                 (outputPresent
                     ? "completed"
-                    : upstreamTrusted
-                        ? "missing"
-                        : "not_reached");
+                    : predatesUnit
+                        ? "not_reached"
+                        : upstreamTrusted
+                            ? "missing"
+                            : "not_reached");
             const trust = trustForReconstructUnit({
                 spec,
                 status,