onto-mcp 0.4.11 → 0.4.13

package/.onto/processes/reconstruct/reconstruct-contract-registry.yaml

@@ -67,11 +67,11 @@ source_profile_records:
     target_material_kind: spreadsheet
     is_default_for_kind: true
     definition_ref: .onto/processes/reconstruct/source-profiles/spreadsheet.md
-    definition_sha256: 35fa949f3fc680b52f3e8ff78eeb9754b86d068e6b20dca51f4107ba881b868f
+    definition_sha256: 6b543ab5621ef169312c1632fa6e446950a72621a974c29130695039cea7b51b
     contract_status: active
-    runtime_implementation_status: planned
+    runtime_implementation_status: partially_wired
     schema_version: 1
-    profile_version: 2
+    profile_version: 3
     migration_status: current
     supersedes: []
     replaced_by: []
@@ -872,6 +872,11 @@ artifact_authorities:
   reconstruct_run_control_validation:
     authority_ref: reconstruct-run-control-validation.yaml
     validation_ref: null
+  llm_dispatch_failures:
+    authority_ref: llm-dispatch-failures/*.yaml
+    validation_ref: reconstruct-run-control-validation.yaml
+    registry_ref: src/core-runtime/reconstruct/llm-dispatch-failure.ts
+    projection_policy: runtime_owned_provider_incomplete_evidence_projected_only_through_bounded_failed_status
   reconstruct_run_control_pre_publication_validation:
     authority_ref: reconstruct-run-control.pre-publication-validation.yaml
     validation_ref: null
@@ -900,10 +905,40 @@ artifact_authorities:
   source_observations:
     authority_ref: source-observations.yaml
     validation_ref: source-observation-directive-validation.yaml
+  seed_stage_prompt_source_observations:
+    authority_ref: seed-stage-prompt-source-observations.yaml
+    validation_ref: null
+    projection_policy: pre_maturation_seed_stage_projected_observation_snapshot_for_resume_truncation_conservation
+  dispatch_incomplete:
+    authority_ref: dispatch-incomplete.yaml
+    validation_ref: semantic-map-resume-validation.yaml
+    projection_policy: full_batch_dispatch_partition_for_stage_local_semantic_map_recovery
+  semantic_map_census:
+    authority_ref: comprehension/semantic-map-census.yaml
+    validation_ref: null
+    projection_policy: semantic_map_observation_partition_and_spend_census
+  semantic_map_sidecar:
+    authority_ref: comprehension/semantic-map.yaml
+    validation_ref: null
+    projection_policy: semantic_map_projection_sidecar_for_map_present_observations
+  semantic_map_resume_validation:
+    authority_ref: semantic-map-resume-validation.yaml
+    validation_ref: null
+    projection_policy: runtime_owned_validation_of_same_batch_semantic_map_recovery_frontier
+  dispatch_fallback_activation:
+    authority_ref: dispatch-fallback-activation.yaml
+    validation_ref: null
+    registry_ref: src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts
+    projection_policy: create_once_lineage_claim_for_originating_initial_semantic_map_rate_limit_fallback
+  dispatch_fallback_outcome:
+    authority_ref: dispatch-fallback-outcome.yaml
+    validation_ref: null
+    registry_ref: src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts
+    projection_policy: terminal_commit_marker_for_one_same_call_exact_incomplete_fallback_pass
   source_safety_ledger:
     authority_ref: source-safety-ledger.yaml
     validation_ref: source-safety-ledger-validation.yaml
-    projection_policy: six_axis_source_safety_and_derived_visibility_by_observation_id_and_intended_consumption
+    projection_policy: four_axis_source_safety_and_derived_visibility_by_observation_id_and_intended_consumption
   source_safety_ledger_validation:
     authority_ref: source-safety-ledger-validation.yaml
     validation_ref: null
@@ -1124,6 +1159,12 @@ artifact_authorities:
   answer_support_ledger_validation:
     authority_ref: answer-support-ledger-validation.yaml
     validation_ref: null
+  answer_support_judgment:
+    authority_ref: answer-support-judgment.yaml
+    validation_ref: answer-support-judgment-validation.yaml
+  answer_support_judgment_validation:
+    authority_ref: answer-support-judgment-validation.yaml
+    validation_ref: null
   maturation_authority_response:
     authority_ref: maturation-authority-response.yaml
     validation_ref: maturation-authority-response-validation.yaml
@@ -1229,14 +1270,6 @@ planned_artifact_authorities:
     authority_ref: required-when-evaluation-validation.yaml
     validation_ref: null
     activation_condition: registry_predicate_evaluator_runtime_is_implemented
-  answer_support_judgment:
-    authority_ref: answer-support-judgment.yaml
-    validation_ref: answer-support-judgment-validation.yaml
-    activation_condition: answer_support_judge_runtime_is_implemented
-  answer_support_judgment_validation:
-    authority_ref: answer-support-judgment-validation.yaml
-    validation_ref: null
-    activation_condition: answer_support_judge_runtime_is_implemented
 
 validation_gate_catalog:
   - gate_id: reconstruct_run_control_gate
@@ -1275,6 +1308,9 @@ validation_gate_catalog:
   - gate_id: source_scout_pack_post_maturation_gate
     validation_artifact_ref: source-scout-pack-validation.post-maturation.yaml
     required_when: source_scout_pack_post_maturation_snapshot_exists
+  - gate_id: semantic_map_resume_gate
+    validation_artifact_ref: semantic-map-resume-validation.yaml
+    required_when: semantic_map_resume_validation_exists
   - gate_id: source_purpose_candidates_gate
     validation_artifact_ref: source-purpose-candidates-validation.yaml
     required_when: seed_validity_or_seed_iteration_readiness_is_projected
@@ -1339,6 +1375,9 @@ validation_gate_catalog:
   - gate_id: answer_support_gate
     validation_artifact_ref: answer-support-ledger-validation.yaml
     required_when: answer_support_ledger_exists
+  - gate_id: answer_support_judgment_gate
+    validation_artifact_ref: answer-support-judgment-validation.yaml
+    required_when: answer_support_judgment_required_minimal
   - gate_id: maturation_answer_claim_gate
     validation_artifact_ref: maturation-answer-claims-validation.yaml
     required_when: maturation_answer_claims_exist
@@ -1396,12 +1435,6 @@ planned_validation_gate_catalog:
     validation_artifact_ref: required-when-evaluation-validation.yaml
     required_when: always
     activation_condition: registry_predicate_evaluator_runtime_is_implemented
-  - gate_id: answer_support_judgment_gate
-    validation_artifact_ref: answer-support-judgment-validation.yaml
-    required_when: answer_support_judgment_required
-    activation_condition: answer_support_judge_runtime_is_implemented
-    activation_prerequisites:
-      - answer_support_ledger_validation_is_valid
 
 required_when_predicate_family_catalog:
   - predicate_family_id: frontier_observation_use_by_downstream_artifact
@@ -1448,6 +1481,11 @@ required_when_predicate_catalog:
     truth_expression: "artifact_exists(source-scout-pack.post-maturation.yaml)"
     unknown_projection: blocked
     explanation_template: "An immutable post-maturation SourceScoutPack snapshot exists and requires snapshot-scoped validation before post-maturation audit or replay use."
+  - predicate_id: semantic_map_resume_validation_exists
+    input_authority_refs: [semantic-map-resume-validation.yaml]
+    truth_expression: "artifact_exists(semantic-map-resume-validation.yaml)"
+    unknown_projection: blocked
+    explanation_template: "A semantic-map resume validation artifact exists and must be valid before handoff consumption."
   - predicate_id: source_frontier_observation_delta
     gate_instance_scope: per_round
     input_authority_refs: [rounds/<round-id>/source-observation-delta.yaml]
@@ -1529,20 +1567,6 @@ required_when_predicate_catalog:
     truth_expression: "source_observation_delta_validation.validation_status == valid and answer_support_ledger_refs_delta_observation_ids"
     unknown_projection: not_applicable
     explanation_template: "Answer support ledger cites observation ids from a frontier-triggered observation delta."
-  - predicate_id: answer_support_judgment_uses_frontier_observation
-    predicate_family_id: frontier_observation_use_by_downstream_artifact
-    gate_instance_scope: per_round
-    downstream_artifact_ref: answer-support-judgment.yaml
-    downstream_validation_ref: answer-support-judgment-validation.yaml
-    input_authority_refs: [rounds/<round-id>/source-observation-delta.yaml, rounds/<round-id>/source-observation-delta-validation.yaml, answer-support-judgment.yaml]
-    truth_expression: "source_observation_delta_validation.validation_status == valid and answer_support_judgment_refs_delta_observation_ids"
-    unknown_projection: not_applicable
-    explanation_template: "Answer support judgment cites observation ids from a frontier-triggered observation delta."
-  - predicate_id: answer_support_judgment_required
-    input_authority_refs: [answer-support-ledger.yaml, answer-support-ledger-validation.yaml]
-    truth_expression: "artifact_exists(answer-support-ledger.yaml) and answer_support_ledger_has_convergent_source_evidence_cluster"
-    unknown_projection: not_applicable
-    explanation_template: "A judge confirmation is required when answer support uses convergent source evidence."
   - predicate_id: maturation_answer_claims_use_frontier_observation
     predicate_family_id: frontier_observation_use_by_downstream_artifact
     gate_instance_scope: per_round
@@ -1738,6 +1762,11 @@ required_when_predicate_catalog:
     truth_expression: "artifact_exists(answer-support-ledger.yaml)"
     unknown_projection: not_applicable
     explanation_template: "An answer support ledger exists and requires support-ledger validation."
+  - predicate_id: answer_support_judgment_required_minimal
+    input_authority_refs: [answer-support-judgment.yaml]
+    truth_expression: "artifact_exists(answer-support-judgment.yaml)"
+    unknown_projection: not_applicable
+    explanation_template: "An answer support judgment exists and requires judgment validation. Convergent-source-evidence necessity and sufficiency are enforced by the maturation-answer-claims validator (B-6)."
   - predicate_id: maturation_authority_response_exists
     input_authority_refs: [maturation-authority-response.yaml]
     truth_expression: "artifact_exists(maturation-authority-response.yaml)"
@@ -1993,6 +2022,16 @@ readiness_projection:
   conflict_rule: When supporting artifacts project different canonical values, choose the first value in strictness_order_high_to_low that appears among contributing artifacts; lower list index is stricter and wins. Cite every contributing artifact.
 
 validator_records:
+  - validator_id: semantic-map-resume-validator
+    gate_ids: [semantic_map_resume_gate]
+    validator_version: 1
+    input_authority_refs:
+      - dispatch-incomplete.yaml
+      - comprehension/semantic-map-census.yaml
+      - comprehension/semantic-map.yaml
+      - source-observations.yaml
+    validation_obligations: []
+    output_ref: semantic-map-resume-validation.yaml
   - validator_id: reconstruct-run-control-validator
     gate_ids: [reconstruct_run_control_gate]
     validator_version: 1
@@ -2111,10 +2150,9 @@ validator_records:
       - source-observations.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
-      - validate_exactly_six_canonical_source_safety_axes
+      - validate_exactly_four_canonical_source_safety_axes
       - validate_every_observation_has_source_safety_rows_for_each_intended_consumption
       - validate_visibility_tier_is_derived_not_independent_authority
-      - fail_when_nested_redaction_evidence_contradicts_top_level_axis_state
       - validate_source_safety_subject_refs_against_observed_source_refs
       - preserve_prompt_context_evidence_support_public_output_replay_and_material_claim_consumption_boundaries
     output_ref: source-safety-ledger-validation.yaml
@@ -2541,7 +2579,7 @@ validator_records:
   - validator_id: revision-proposal-validator
     gate_ids: [revision_proposal_gate]
     validator_version: 1
-    input_authority_refs: [revision-proposal.yaml, failure-classification.yaml, failure-classification-validation.yaml, reconstruct-contract-registry.yaml]
+    input_authority_refs: [revision-proposal.yaml, failure-classification.yaml, failure-classification-validation.yaml, ontology-seed.yaml, reconstruct-contract-registry.yaml]
     output_ref: revision-proposal-validation.yaml
   - validator_id: maturation-baseline-validator
     gate_ids: [maturation_baseline_gate]
@@ -2578,6 +2616,7 @@ validator_records:
       - reject_matrix_rows_without_baseline_row_ref
       - validate_matrix_row_ids_are_stable_and_baseline_row_refs_close
       - preserve_frontier_seed_state_before_question_frontier_authoring
+      - reject_blocking_question_refs_before_question_frontier_authoring
     output_ref: baseline-actionability-matrix-validation.yaml
   - validator_id: actionability-matrix-validator
     gate_ids: [actionability_matrix_gate]
@@ -2589,6 +2628,8 @@ validator_records:
       - maturation-answer-claims-validation.yaml
       - ontology-expansion.yaml
       - ontology-expansion-validation.yaml
+      - maturation-question-frontier.yaml
+      - maturation-question-frontier-validation.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
       - support_zero_delta_baseline_only_matrix_when_no_maturation_deltas_exist
@@ -2597,6 +2638,7 @@ validator_records:
       - validate_matrix_row_ids_are_stable_and_baseline_row_refs_close
       - validate_maturity_level_against_supporting_refs_blocking_questions_and_limitations
       - require_blocker_and_high_rows_to_be_l4_limitation_backed_or_continuation_blocking
+      - validate_blocking_question_refs_against_validated_question_frontier
     output_ref: actionability-matrix-validation.yaml
   - validator_id: maturation-question-frontier-validator
     gate_ids: [maturation_question_frontier_gate]
@@ -2684,7 +2726,7 @@ validator_records:
     output_ref: answer-support-ledger-validation.yaml
   - validator_id: maturation-answer-claims-validator
     gate_ids: [maturation_answer_claim_gate]
-    validator_version: 1
+    validator_version: 2
     input_authority_refs:
       - maturation-answer-claims.yaml
       - answer-support-ledger-validation.yaml
@@ -2692,6 +2734,10 @@ validator_records:
       - ontology-seed.yaml
       - reconstruct-contract-registry.yaml
     conditional_input_authority_refs:
+      - artifact_ref: answer-support-judgment.yaml
+        activation_condition: answer_support_judge_runtime_is_implemented
+        consumed_for:
+          - require_convergent_source_evidence_claims_to_have_two_independent_judge_confirmed_supports
       - artifact_ref: answer-support-judgment-validation.yaml
         activation_condition: answer_support_judge_runtime_is_implemented
         consumed_for:
@@ -2704,8 +2750,22 @@ validator_records:
     conditional_validation_obligations:
       - obligation_id: require_convergent_source_evidence_claims_to_have_two_independent_judge_confirmed_supports
         activation_condition: answer_support_judge_runtime_is_implemented
-        input_authority_refs: [answer-support-judgment-validation.yaml]
+        input_authority_refs: [answer-support-judgment.yaml, answer-support-judgment-validation.yaml]
     output_ref: maturation-answer-claims-validation.yaml
+  - validator_id: answer-support-judgment-validator
+    gate_ids: [answer_support_judgment_gate]
+    validator_version: 1
+    input_authority_refs:
+      - answer-support-judgment.yaml
+      - answer-support-ledger.yaml
+      - answer-support-ledger-validation.yaml
+      - reconstruct-contract-registry.yaml
+    validation_obligations:
+      - validate_judgment_refs_resolve_to_answer_support_ledger_clusters_and_evidence
+      - require_supports_enum_for_each_judgment
+      - require_rationale_ref_for_each_judgment
+      - require_convergent_clusters_to_judge_every_cited_evidence_ref
+    output_ref: answer-support-judgment-validation.yaml
   - validator_id: ontology-expansion-validator
     gate_ids: [ontology_expansion_gate]
     validator_version: 1
@@ -2752,6 +2812,8 @@ validator_records:
       - maturation-authority-response-validation.yaml
       - ontology-expansion-validation.yaml
       - maturation-convergence-ledger-validation.yaml
+      - revision-proposal.yaml
+      - revision-proposal-validation.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
       - validate_continuation_state_against_validated_actionability_matrix_and_frontier_state
@@ -2759,6 +2821,10 @@ validator_records:
       - validate_continue_ask_user_or_blocked_state_against_available_next_authority
       - validate_limitation_refs_and_row_scope_for_actionable_limited_state
       - reject_actionable_ready_until_final_requestion_convergence_is_proven
+      - validate_revision_blocker_limitation_refs_against_validated_revision_proposal
+      - require_revision_blocker_refs_in_continuation_limitation_refs
+      - reject_actionable_ready_when_unresolved_revision_blockers_remain
+      - bind_revision_proposal_validation_to_consumed_revision_proposal
     output_ref: maturation-continuation-decision-validation.yaml
   - validator_id: actionable-ontology-validator
     gate_ids: [actionable_ontology_gate]
@@ -2943,18 +3009,6 @@ validator_records:
     output_ref: handoff-decision-validation.yaml
 
 planned_validator_records:
-  - validator_id: answer-support-judgment-validator
-    gate_ids: [answer_support_judgment_gate]
-    validator_version: 1
-    input_authority_refs:
-      - answer-support-judgment.yaml
-      - answer-support-ledger-validation.yaml
-      - reconstruct-contract-registry.yaml
-    validation_obligations:
-      - validate_judgment_refs_resolve_to_answer_support_ledger_clusters_and_evidence
-      - require_supports_enum_for_each_judgment
-      - require_rationale_ref_for_each_judgment
-    output_ref: answer-support-judgment-validation.yaml
   - validator_id: maturation-promotion-request-validator
     gate_ids: [maturation_promotion_request_gate]
     validator_version: 1
@@ -3196,3 +3250,102 @@ version_policy:
     - query access contract registry changes
     - readiness projection changes
     - validator record changes
+
+# G(b) prompt-projection field-parity (INV-SCHEMA-1). Declares the EXACT field/budget
+# surface of each governed runtime prompt projection so a registry-shape drift (a field or
+# budget added or dropped in the runtime contract without a registry home, or vice versa) is
+# caught in CI. Runtime SSOT for the competency-question assessment contract is
+# src/core-runtime/reconstruct/competency-projection-contract.ts; the parity guard
+# scripts/check-prompt-projection-parity.ts asserts this node equals that module's contract
+# surface (exact-set on payload_fields/policy_fields, exact-value on budget_fields) and that
+# run.ts consumes the extracted module rather than a duplicated local copy. Every element
+# declared here is guard-checked (no unguarded declared data).
+prompt_projection_contracts:
+  competency_question_assessment:
+    # Top-level keys of competencyQuestionAssessmentProjectionContract().
+    payload_fields:
+      - projection_kind
+      - projection_contract_version
+      - semantic_authority
+      - prompt_char_limit
+      - question_projection
+      - evidence_projection
+      - source_evidence_projection
+      - source_evidence_excerpt_char_limit
+      - source_evidence_reserve_derivation
+      - validation_projection
+      - claim_realization_projection
+      - runtime_derivations
+      - batching_policy
+      - fail_loud_policy
+    # Keys of the nested batching_policy object.
+    policy_fields:
+      - mode
+      - order
+      - build_budget_reserve_chars
+      - single_question_overflow
+    # The named budget constants the contract OUTPUT embeds (NOT the internal
+    # EVIDENCE_CANDIDATE_LIMIT runaway guard, which never enters the contract surface).
+    budget_fields:
+      prompt_char_limit: 50000
+      source_evidence_excerpt_char_limit: 4000
+      build_budget_reserve_chars: 1000
+
+# G(c) final-output append-section parity (INV-SCHEMA-1). Declares the canonical identity of
+# every section the reconstruct final output emits — section_id (hyphen; also the load-bearing
+# required_fragments text), heading (the provenance gate's match key), prompt_policy_id (the
+# underscore id in deterministic_runtime_append_sections; null for conditional sections),
+# emit_owner (emission surface: always_section vs conditional_markdown — distinct from the
+# binding flag), provenance_binding_required (whether the final-output provenance gate checks
+# it), and activation. Runtime SSOT is src/core-runtime/reconstruct/final-output-sections.ts;
+# the parity guard scripts/check-final-output-sections-parity.ts (G9) asserts this node equals
+# that module exactly and that run.ts consumes the module rather than inline heading literals.
+final_output_append_sections:
+  - section_id: seed-answerability
+    heading: Seed Answerability
+    prompt_policy_id: seed_answerability
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: artifact-truth
+    heading: Artifact Truth
+    prompt_policy_id: artifact_truth
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: claim-projection
+    heading: Claim Projection
+    prompt_policy_id: claim_projection
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: runtime-artifact-truth-footer
+    heading: Runtime Artifact Truth Footer
+    prompt_policy_id: provenance_footer
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: runtime-provenance-bindings
+    heading: Runtime Provenance Bindings
+    prompt_policy_id: provenance_bindings
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: source-projection-truncation
+    heading: Source Projection Truncation
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: document_projection_truncation_nonempty
+  - section_id: workbook-inventory-projection-truncation
+    heading: Workbook Inventory Projection Truncation
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: workbook_inventory_projection_truncation_nonempty
+  - section_id: unresolved-revision-proposals
+    heading: Unresolved Revision Proposals
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: disclosed_revision_proposals_nonempty

package/.onto/processes/reconstruct/reconstruct-execution-ux-contract.md

@@ -161,9 +161,78 @@ If a run halts, the output should still be useful:
 
 A halted run may provide candidate Seed content only if the corresponding
 artifact and validation refs exist. It may not imply seed confirmation, CQ
-  assessment, failure classification, revision proposal, terminal seed iteration readiness, or
+assessment, failure classification, revision proposal, terminal seed iteration readiness, or
 final ontology direction unless those artifacts exist.
 
+### 6.1 Provider output-ceiling failure
+
+When an OpenAI Responses direct-API semantic-author call ends with
+`incomplete_details.reason=max_output_tokens`, the runtime does not parse,
+repair, continue, or accept the partial output. It persists the provider evidence
+under `llm-dispatch-failures/*.yaml`, links that source artifact to the owning
+attempt through a committed run-control transaction, marks the attempt `failed`,
+and releases the session lock.
+
+The headroom route is pinned to the public OpenAI Responses endpoint. A custom
+actor `base_url` is rejected before dispatch, and ambient `OPENAI_BASE_URL` does
+not redirect this route. Failure publication is serialized with every other
+run-control mutation. It writes and fsyncs a scratch file, atomically promotes
+it to a hash-prefixed pending file, records the prepared transaction, publishes
+the canonical sidecar, and commits the transaction/failed attempt/released lock.
+A valid untracked pending file may be adopted only when its bytes, hash-prefix,
+session, attempt, and held owner lock all match. Scratch, malformed, truncated,
+ambiguous, wrong-prefix, wrong-owner, or wrong-hash remnants abandon the current
+attempt, release its lock, and require `blocked_partial_write` recovery.
+
+`onto_reconstruct`, `onto_reconstruct_read`, the compatibility status/result
+tools, and the Core API must return a record-less discriminated branch when the
+run-control validator trusts the latest failed terminal. A latest trusted failed
+attempt supersedes an older non-terminal preparation record. The branch has
+`status: failed`, `reconstructRecord: null`, run-control and validation refs, the
+failure artifact ref, stage progress, and a bounded failure summary. The summary
+may expose the stable failure code, stage/artifact identity, provider status and
+incomplete reason, base/headroom/effective output caps, provider token counts,
+and request-count observability. Provider request/response ids, endpoint, and
+partial-output hash remain source-artifact-only fields; raw partial output is not
+persisted.
+
+Failed progress does not infer semantic counts from the existence of a sidecar:
+`failureCount` is `null`. Run-control and run-control-validation are completed
+control stages. The failed semantic stage is halted. Other stages are completed
+only when a committed transaction owned by the latest failed attempt still
+matches the current regular-file bytes inside the real session root; otherwise
+they remain pending. `reusableArtifactRefs` contains only that same bounded,
+hash-verified latest-owner set, excludes the failure sidecar, and may be empty.
+
+### 6.2 Semantic-map provider fallback
+
+`reconstruct.execution.dispatch_fallback` is an explicit default-off capability
+for the spreadsheet semantic-map stage. It may activate only in the originating
+fresh initial attempt after a sealed direct SDK route supplies structured
+rate-limit evidence and the current attempt still owns the held session lock.
+Arbitrary diagnostic text is not trigger evidence.
+
+An activated run writes the direct-child
+`dispatch-fallback-activation.yaml` claim before alternate-provider work. It
+then reuses the existing semantic-map stage for exactly the persisted incomplete
+observation set, with one fallback pass and one physical SDK request per logical
+dispatch. Retained primary observations are not sent again.
+
+`dispatch-fallback-outcome.yaml` is the terminal commit marker after the final
+`dispatch-incomplete.yaml`, semantic-map census, and semantic-map sidecar have
+been securely published and indexed in run control. A completed outcome is
+projected into the completed reconstruct record and semantic-map manifest step.
+A halted outcome is disclosed through the current breaker error and does not
+create a completed record or manifest. Any session lineage with an activation,
+including a crash between activation and outcome, requires a new session for a
+later entry. A `running` attempt with a `held` session lock cannot be taken over
+based on `lease_expires_at` alone.
+
+The TypeScript schema, validators, path constructors, secure publishers, and
+record projection for both artifacts are owned by
+`src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts`; prose and the
+contract registry do not duplicate their machine schema.
+
 ## 7. Runtime Payload Expectations
 
 Future status/result payloads should expose enough facts for the host LLM to
@@ -175,6 +244,8 @@ render this contract without scraping prose:
 - stage state: pending, running, completed, skipped, or halted
 - skipped/deferred stage reason and `authority_impact`
 - stage artifact refs and owner
+- record-less trusted provider failure status, bounded failure summary, and
+  failure/run-control refs
 - liveness state and recommended polling interval
 - deterministic count summaries from the latest completed artifacts
 - latest source frontier summary and reusable trusted observation refs

package/.onto/processes/reconstruct/source-profiles/spreadsheet.md

@@ -30,6 +30,10 @@ Workbook, sheet, named range, table, or used range.
 - named ranges
 - hidden rows and columns
 - macros or VBA presence
+- protected ranges and sheet protection
+- filters and auto-filter state
+- charts, images, and object anchors
+- external links and data connections to other workbooks or sources
 
 ## Correct Observation Examples
 
@@ -47,6 +51,18 @@ Workbook, sheet, named range, table, or used range.
 
 > The formula is a cost-recognition policy.
 
+> The `#REF!` in `B2` is a bug caused by a deleted column.
+
+> The date in `C5` is stored as text, so it is wrong.
+
+## Static Inspection Boundary
+
+Static structural inspection reveals how formulas and structure were written, but
+it cannot prove computed results. Record an observed formula or value as structure
+inspected only; do not assert that a formula's output is correct unless an engine
+recalculated it. Note unresolved external data, links, or connections as
+unresolved rather than assuming their current values.
+
 ## Detail Location Format
 
 ```text
@@ -93,6 +109,19 @@ outside this list, record it in the `PurposeAdequacyFrame` with evidence and
 promote it to this profile only after repeated real-source runs justify the
 refinement.
 
+## Large Workbook Inspection Strategy
+
+Inspect structure before converting the workbook to another format. Do not flatten
+a workbook into a single table or dataframe before checking whether structure --
+formulas, merged ranges, named ranges, and cross-sheet references -- carries
+meaning.
+
+For large workbooks, prefer narrow, targeted reads around the relevant ranges over
+loading every sheet in full. Read the workbook's own structural index first -- the
+sheet list, per-sheet dimensions, named ranges, and table definitions -- and use a
+read-only or streaming inspection path so the used range and formula cells can be
+observed without materializing the entire workbook.
+
 ## Scan Targets
 
 - sheet list and used range per sheet
@@ -104,3 +133,9 @@ refinement.
 - data validation rules
 - macro/VBA presence
 - external data connections
+- protected ranges and sheet protection
+- filters and auto-filter state
+- charts, images, and object anchors
+- external links to other workbooks
+- formula-error cells, recorded as literal tokens such as `#REF!`, `#N/A`, or `#VALUE!`
+- structural-risk signals recorded literally and without diagnosis: cross-sheet references whose target sheet or range is absent, dates stored as text, empty cells inside a calculation chain, and lookup keys whose stored type differs from the target column

package/.onto/processes/review/nesting-batch-worker-contract.md

@@ -36,7 +36,7 @@ outer의 유일한 역할: **script를 `bash -s`로 실행하고 stdout을 verba
 | brand | spawn | 비고 |
 |---|---|---|
 | codex (`codex-nesting-batch-worker.ts`) | `codex exec --sandbox danger-full-access --ephemeral`, prompt는 stdin | outer가 subprocess를 spawn해야 하므로 non-seatbelt; inner unit executor는 자체 read-only sandbox 유지 |
-| claude (`claude-nesting-batch-worker.ts`) | `claude -p <prompt positional> --allowedTools Bash --permission-mode bypassPermissions --strict-mcp-config`(빈 MCP) | prompt는 **positional**(stdin 무시됨). `--effort` 지원, service_tier 표면 없음(API 전용). `ONTO_CLAUDE_BIN` 오버라이드 |
+| claude (`claude-nesting-batch-worker.ts`) | `claude -p <prompt positional> --allowedTools Bash --permission-mode bypassPermissions --strict-mcp-config`(빈 MCP) | prompt는 **positional**(stdin 무시됨). `--effort` 지원, service_tier 표면 없음(API 전용). 바이너리는 `resolveClaudeBin()`로 해석(`ONTO_CLAUDE_BIN` 오버라이드 → PATH → 일반 설치 위치) |
 
 outer(teamlead seat) model/effort는 settings `review.execution.teamlead.llm`에서 brand adapter(codex_cli/claude_code) 일치 시에만 해석된다. **inner unit의 LLM 설정은 outer 설정이 아니라 호출자가 구성한 inner argv에 실린다**(flat 동등).
 

package/.onto/processes/review/productized-live-path.md

@@ -198,17 +198,21 @@ canonical requirement:
 현재 repo-local TS bounded path에서 실행 가능한 `ReviewExecutionProfile` mode는 아래다.
 
 - `main-workers`: main이 teamlead 역할을 수행하고 worker가 lens를 실행한다.
+- `nested-workers`: external OAuth worker executor(`codex` 또는 `claude_code`)가
+  outer seat에서 ready unit batch를 fan-out하고, 각 inner unit은 flat 경로와
+  동일한 unit-executor CLI/seat/검증 계약을 따른다. `direct_call` executor와
+  조합되면 outer worker seat가 없으므로 fail-closed한다.
 - `synthesize.llm`: deliberation 이후 별도 synthesize unit에 적용된다. synthesize는 모든 lens output, issue artifacts, deliberation, problem framing을 통합하므로 높은 effort가 기본적으로 적합하다.
 
-`nested-workers`는 concept/profile shape로 남아 있지만 현재 active live path에서는
-pre-dispatch에서 fail-loud한다. 기존 nested bridge가 sidecar structured output,
-read-only lens execution, settings-owned bounded dispatch를 강제하지 못하기 때문이다.
-이 mode는 inner lens 실행이 동일한 structured runner 계약을 따를 때만 다시 실행
-가능한 경로가 될 수 있다.
+`nested-workers`의 canonical 계약은 `nesting-batch-worker-contract.md`가 소유한다.
+과거 raw provider-CLI inner bridge는 retired 경로이며, 현재 runtime path는
+sidecar structured output, read-only unit execution, settings-owned bounded dispatch를
+동일 unit executor 공유로 보존한다.
 
 worker executor는 profile resolution에서 아래 중 하나로 고정된다.
 
 - `codex`: host-bound OAuth 또는 Codex worker path.
+- `claude_code`: host-bound Claude Code worker path.
 - `direct_call`: `api_key` 또는 `local` provider path.
 
 중요한 점은 host-specific naming이 아니라: