onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/cli/run-review-prompt-execution.js

@@ -13,7 +13,7 @@ import { lensIdFromRound1ArtifactPath, readValidatedLensSidecarArtifact, writeLe
 import { allLensOutputsAreSidecars, renderRuntimeFindingLedgerPacket, writeFindingLedgerFromLensSidecars, } from "../review/lens-sidecar-ledger.js";
 import { effectiveReviewUnitLlmRef } from "../review/review-execution-profile.js";
 import { buildInitialExecutionResultScaffold, computeReviewFrontier, mergeUnitResultIntoExecutionResult, validateUnitSeatToResult, } from "../review/review-execution-steps.js";
-import { isTrustedLedgerUnit } from "../pipeline-execution-ledger.js";
+import { isResolvedLedgerUnit, } from "../pipeline-execution-ledger.js";
 import { buildReviewExecutionRoute, buildReviewRuntimeRouteArtifactProjection, } from "../review/review-execution-route.js";
 import { buildIssueScopedDeliberationWorklist, buildIssueScopedLensDeliberationPrompt, buildNoPlannedDeliberationResolution, buildRuntimeIssueDeliberationUnavailableResponse, buildRuntimeUnavailableDeliberationResolution, buildTeamleadIssueResolutionPrompt, deliberationResolutionPath, renderDeliberationMarkdownProjection, validateDeliberationResolutionObject, validateIssueDeliberationResponseObject, } from "../review/controlled-lens-deliberation.js";
 import { computeLensCompletionBarrier, resolveRequiredParticipatingLensCount, } from "../review/lens-completion-policy.js";
@@ -29,6 +29,11 @@ import { renderReviewUnitBoundaryDetailsSection, } from "../review/unit-boundary
 import { renderIssueSynthesisPrompt, buildRuntimeIssueSynthesisUnavailableResponse, synthesisLedgerPath, synthesisWorkItemsPath, validateIssueSynthesisResponseOnDisk, writeReviewSynthesisLedger, writeReviewSynthesisWorkItems, writeSynthesisMarkdownFromLedger, } from "../review/synthesis-map-reduce.js";
 import { isDirectModelCallSelection, normalizeLlmModelSwitcher, } from "../llm/model-switcher.js";
 import { parseRuntimeIssueDeliberationSchemaContext } from "./runtime-submit-context.js";
+import { parseRuntimeIssueStanceSchemaContext } from "./runtime-submit-context.js";
+import { parseRuntimeIssueSynthesisSchemaContext } from "./runtime-submit-context.js";
+import { salvageInputPathFor } from "./submit-salvage.js";
+import { DispatchBreakerState, TRANSIENT_TRANSPORT_MESSAGE_PATTERNS, buildDispatchIncompleteArtifact, classifySystemicDispatchFailure, dispatchIncompleteArtifactPath, } from "../llm/dispatch-breaker.js";
+import { CORRELATED_VALIDATION_HALT_REASON, applyResubmitErrorSpecToPacket, buildResubmitErrorSpec, classifyUnsupportedEvidenceRefFailure, classifyDeliberationUnsupportedEvidenceRefFailure, classifySynthesisUnsupportedSourceRefFailure, isUnsupportedEvidenceRefFailureMessage, correlatedValidationExceeded, } from "./unit-resubmit.js";
 import { isReviewArtifactGenerationRealization, semanticQualityEvidenceForArtifactGeneration, } from "../review/artifact-generation-realization.js";
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -204,11 +209,21 @@ class ReviewUnitOutputContractError extends Error {
 class ReviewIssueArtifactDispatchError extends Error {
     outcome;
     originalError;
-    constructor(message, outcome, originalError) {
+    /** Explicit halt_reason override (e.g. `correlated_validation: …`);
+     * null keeps the default `Issue artifact generation failed: …` phrasing. */
+    haltReason;
+    /** 설계 B 트립 전용: halt 시점까지 기록된 배치 outcome 전체(완료+최종
+     * 실패). 완료 유닛의 행이 execution-result에 남아야 continuation ledger가
+     * 그 유닛을 재디스패치하지 않는다 — 회복 집합 == 미완료 집합 (규칙 5).
+     * 트립 외 halt 경로는 빈 배열(현행 동작 보존). */
+    batchOutcomes;
+    constructor(message, outcome, originalError, haltReason = null, batchOutcomes = []) {
         super(message);
         this.name = "ReviewIssueArtifactDispatchError";
         this.outcome = outcome;
         this.originalError = originalError;
+        this.haltReason = haltReason;
+        this.batchOutcomes = batchOutcomes;
     }
 }
 function issueArtifactOutcomeFromError(error) {
@@ -944,18 +959,15 @@ function failureKindFromError(error) {
         return failureKindFromMessage(error.message);
     return "unknown";
 }
+// Shared transient-transport vocabulary is single-sourced in the dispatch
+// breaker module; this consumer adds only its executor-specific extra.
+const TRANSIENT_EXECUTOR_FAILURE_PATTERNS = [
+    ...TRANSIENT_TRANSPORT_MESSAGE_PATTERNS,
+    "responses_retry",
+];
 function isTransientExecutorFailureMessage(message) {
     const normalized = message.toLowerCase();
-    return [
-        "stream disconnected before completion",
-        "connection reset by peer",
-        "error sending request",
-        "failed to connect to websocket",
-        "transport channel closed",
-        "http/request failed",
-        "request failed after",
-        "responses_retry",
-    ].some((pattern) => normalized.includes(pattern));
+    return TRANSIENT_EXECUTOR_FAILURE_PATTERNS.some((pattern) => normalized.includes(pattern));
 }
 function failureKindFromMessage(message) {
     const normalized = message.toLowerCase();
@@ -992,16 +1004,48 @@ function failureKindFromMessage(message) {
     }
     return "executor_exit";
 }
-function shouldRetryUnitFailure(args) {
+export function shouldRetryUnitFailure(args) {
     if (args.attempt >= args.maxRetries)
         return false;
     const failureKind = failureKindFromError(args.error);
-    if (failureKind === "empty_output" ||
-        failureKind === "output_contract") {
+    if (failureKind === "empty_output")
         return false;
+    if (failureKind === "output_contract") {
+        // §4-2c structural retry gate: an output_contract failure is normally
+        // terminal, but a resubmit-correctable whitelist rejection is
+        // substring-misclassified as output_contract when its message contains an
+        // envelope field name (synthesis: always; deliberation: rare hallucinated
+        // ref). Route it back to a corrective retry only when resubmit will actually
+        // fire on it — otherwise keep the terminal, byte-identical behavior.
+        return isResubmitCorrectableRetry(args);
     }
     return true;
 }
+/**
+ * Allow an output_contract retry iff resubmit is enabled AND the unit is
+ * gate-eligible AND the precise structural classifier matches — making the
+ * gate's activation a strict subset of the resubmit strategy's activation
+ * (design §10: F-1 retry ⟺ strategy fires). Reads the shared
+ * RESUBMIT_UNIT_ROUTING table so the gate and dispatcher cannot diverge (M-1).
+ * OFF (resubmit disabled) → false → byte-identical to output_contract being
+ * terminal. Issue-stance is gate-eligible as of the rare-poison hardening cut:
+ * final stance demote/correlated decisions still read the terminal outcome, so
+ * an infra final failure remains a whole-run halt rather than being
+ * reinterpreted as validation.
+ */
+function isResubmitCorrectableRetry(args) {
+    if (args.reviewExecutionProfile?.retry?.resubmit?.enabled !== true) {
+        return false;
+    }
+    const outputFormat = args.dispatch.output_format;
+    const routing = outputFormat
+        ? RESUBMIT_UNIT_ROUTING[outputFormat]
+        : undefined;
+    if (!routing || !routing.gateEligible)
+        return false;
+    const message = args.error instanceof Error ? args.error.message : String(args.error);
+    return routing.classify(message) !== null;
+}
 function retryTimeoutMs(baseTimeoutMs, attempt) {
     const multiplier = attempt + 1;
     const expanded = baseTimeoutMs * multiplier;
@@ -1009,6 +1053,369 @@ function retryTimeoutMs(baseTimeoutMs, attempt) {
         ? Math.floor(expanded)
         : baseTimeoutMs;
 }
+/**
+ * 설계 B: 리뷰 fan-out 풀(lens/stance)의 dispatch breaker (opt-in,
+ * `review.execution.retry.dispatch_breaker`). 리뷰는 per-unit bounded retry가
+ * 이미 있으므로 backoff 재시도는 얹지 않는다(규칙 1은 기존 유닛 재시도
+ * 예산으로 충족; policy의 backoff_* 필드는 리뷰 배선에서 미소비) — 최종
+ * outcome 기록 + 계통 임계 감지 + 배치 halt + 미완료 아티팩트만 추가한다.
+ * OFF(기본) = 현행 halt/배리어 동작 보존.
+ */
+function reviewDispatchBreakerFromProfile(profile, args) {
+    const policy = profile?.retry?.dispatch_breaker;
+    // Review lens/stance pools can be Promise.all fan-outs, so completion order
+    // must not decide poison-vs-outage recovery classification. This is
+    // runtime-owned; it is deliberately not a user-facing settings key.
+    return policy?.enabled === true
+        ? new DispatchBreakerState({ ...policy, concurrent: args.concurrent })
+        : null;
+}
+/** 리뷰 경로는 `invokeExecutor` 직행이라 dispatch 마커가 없다 — 최종
+ * failure.message 기반 분류를 쓴다. stderr 기반이라 content-derived 오분류
+ * 리스크는 낮으나 잔여 리스크로 기록 (handoff §3.2). */
+function reviewSystemicFailureClassFromOutcome(outcome) {
+    return classifySystemicDispatchFailure(outcome.failure?.message);
+}
+/** §4-1: record a nested-pool unit's FINAL outcome to the dispatch breaker.
+ *
+ * A batch-window SUCCESS (`nestedBatchWindow` + success) is recorded as skipped:
+ * completed for the recovery set, but no proof the provider lane is alive THIS
+ * run, so it must not reset a systemic streak. A FAILURE — whether from the
+ * batch window or a real flat dispatch — is classified like the flat path
+ * (item-local → dead-letter, systemic → recovery victim); it is never skipped
+ * (교차검증 F2/Finding A: skipping a failure mis-labels it completed and drops
+ * it from the recovery set, diverging from the flat path). A real flat success
+ * drives `recordItemSuccess`. Returns the trip state on the threshold crossing so
+ * the caller can freeze halt attribution to it. */
+export function recordNestedUnitOutcomeToBreaker(breaker, outcome) {
+    if (outcome.nestedBatchWindow && outcome.success) {
+        breaker.recordItemSkipped(outcome.dispatch.unit_id);
+        return null;
+    }
+    if (outcome.success) {
+        breaker.recordItemSuccess(outcome.dispatch.unit_id);
+        return null;
+    }
+    return breaker.recordItemFailure({
+        item_id: outcome.dispatch.unit_id,
+        failure_class: reviewSystemicFailureClassFromOutcome(outcome),
+        failure_message: outcome.failure?.message ?? "unknown error",
+        attempt_count: outcome.attemptCount ?? 1,
+    });
+}
+/** halt_reason vocabulary for a review-side breaker trip — the prefix is the
+ * grep/consumer key (reconstruct의 DispatchBreakerTrippedError 문구와 동형). */
+export const REVIEW_DISPATCH_BREAKER_HALT_REASON_PREFIX = "dispatch_breaker";
+function reviewDispatchBreakerHaltReason(trip, incompleteArtifactPath) {
+    return `${REVIEW_DISPATCH_BREAKER_HALT_REASON_PREFIX}: ${trip.failure_class} failed ${trip.consecutive_item_count} consecutive units (threshold ${trip.threshold}) — batch halted, incomplete units persisted for exact re-dispatch (${incompleteArtifactPath})`;
+}
+/** 규칙 6 관측 상시화 + 규칙 5 정확 재디스패치 집합: breaker-ON 배치는
+ * 트립이든 완주든 end-state를 리뷰 세션 루트에 영속한다 (reconstruct의
+ * persistDispatchIncompleteArtifact 동형; 경로는 breaker 모듈이 단일소스). */
+async function persistReviewDispatchIncompleteArtifact(args) {
+    const artifactPath = dispatchIncompleteArtifactPath(args.sessionRoot);
+    await writeYamlDocument(artifactPath, buildDispatchIncompleteArtifact({
+        pipeline: "review",
+        batchLabel: args.batchLabel,
+        createdAt: isoFromTimestamp(Date.now()),
+        plannedItemIds: args.plannedItemIds,
+        state: args.state,
+    }));
+    return artifactPath;
+}
+/**
+ * 설계 A (bounded resubmit): before the next retry of an issue-stance unit
+ * whose submit was rejected by the `issue_evidence_refs` whitelist, inject
+ * the error spec into the unit's packet so the retry is a corrective
+ * resubmit instead of a blind re-run. The retry budget itself is unchanged
+ * (`issue_artifact_max_retries`); only the packet content differs. Opt-in
+ * via `review.execution.retry.resubmit.enabled`; returns true when a spec
+ * was applied.
+ */
+async function applyStanceResubmitErrorSpec(args) {
+    if (args.reviewExecutionProfile?.retry?.resubmit?.enabled !== true) {
+        return false;
+    }
+    if (args.dispatch.output_format !== "issue-stance-response")
+        return false;
+    const violation = classifyUnsupportedEvidenceRefFailure(args.error instanceof Error ? args.error.message : String(args.error)) ?? (await readFrozenUnsupportedRefViolation(args.dispatch.output_path));
+    if (!violation)
+        return false;
+    let packetText;
+    try {
+        packetText = await fs.readFile(args.dispatch.packet_path, "utf8");
+    }
+    catch {
+        return false;
+    }
+    let allowedRefs = [];
+    try {
+        const context = parseRuntimeIssueStanceSchemaContext(packetText);
+        allowedRefs = context.issue_evidence_refs[violation.issueId] ?? [];
+    }
+    catch {
+        allowedRefs = [];
+    }
+    const resubmitAttempt = args.attempt + 1;
+    await fs.writeFile(args.dispatch.packet_path, applyResubmitErrorSpecToPacket(packetText, buildResubmitErrorSpec({
+        violation,
+        allowedEvidenceRefs: allowedRefs,
+        resubmitAttempt,
+    })), "utf8");
+    await appendExecutionProgress(args.errorLogPath, `runner stance resubmit: ${args.dispatch.unit_id}`, [
+        `resubmit_attempt: ${resubmitAttempt}`,
+        `issue_id: ${violation.issueId}`,
+        `unsupported_ref: ${violation.evidenceRef}`,
+    ]);
+    return true;
+}
+/** Worker adapters exit before stderr reliably carries the validation text;
+ * the per-attempt frozen salvage input is the structural evidence source. */
+async function readFrozenUnsupportedRefViolation(outputPath) {
+    try {
+        const raw = await fs.readFile(salvageInputPathFor(outputPath), "utf8");
+        const frozen = JSON.parse(raw);
+        return typeof frozen.error === "string"
+            ? classifyUnsupportedEvidenceRefFailure(frozen.error)
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const RESUBMIT_UNIT_ROUTING = Object.freeze({
+    "issue-stance-response": {
+        classify: classifyUnsupportedEvidenceRefFailure,
+        apply: applyStanceResubmitErrorSpec,
+        gateEligible: true,
+    },
+    "issue-deliberation-response": {
+        classify: classifyDeliberationUnsupportedEvidenceRefFailure,
+        apply: applyDeliberationResubmitErrorSpec,
+        gateEligible: true,
+    },
+    "issue-synthesis-response": {
+        classify: classifySynthesisUnsupportedSourceRefFailure,
+        apply: applySynthesisResubmitErrorSpec,
+        gateEligible: true,
+    },
+});
+/**
+ * 설계 A / §4-6a / §4-2c: unit-agnostic entry for bounded resubmit error-spec
+ * injection. Routes by `output_format` through the shared routing table to the
+ * per-unit strategy; unrouted formats (ledgers, lenses, …) are a no-op, so the
+ * retry stays blind for units without a classifiable, spec-correctable
+ * validation rejection. The opt-in gate is re-checked here so OFF returns before
+ * any per-unit work.
+ */
+export async function applyResubmitErrorSpec(args) {
+    if (args.reviewExecutionProfile?.retry?.resubmit?.enabled !== true) {
+        return false;
+    }
+    const outputFormat = args.dispatch.output_format;
+    const routing = outputFormat
+        ? RESUBMIT_UNIT_ROUTING[outputFormat]
+        : undefined;
+    const applied = routing ? await routing.apply(args) : false;
+    if (applied && args.executionPlan !== undefined) {
+        await refreshManifestPacketHash({
+            executionPlan: args.executionPlan,
+            packetPath: args.dispatch.packet_path,
+        });
+    }
+    return applied;
+}
+/** K2 (20260712-stance-ref-vocabulary-unification-design.md §5): re-pin the
+ * manifest packet_sha256 after a legitimate runtime-owned packet mutation
+ * (resubmit error spec). No-op when the packet has no manifest ref yet. */
+async function refreshManifestPacketHash(args) {
+    let manifestPath;
+    let manifest;
+    try {
+        ({ manifestPath, manifest } = await readReviewContextManifest(args.executionPlan));
+    }
+    catch {
+        // No materialized manifest (e.g. unit-scoped test harnesses) → nothing is
+        // pinned, so there is nothing to re-pin.
+        return;
+    }
+    const resolvedPacketPath = path.resolve(args.packetPath);
+    const entry = manifest.packet_refs.find((ref) => path.resolve(ref.packet_ref) === resolvedPacketPath);
+    if (!entry)
+        return;
+    const packetSha256 = await optionalFileDigest(args.packetPath);
+    if (!packetSha256 || packetSha256 === entry.packet_sha256)
+        return;
+    const updatedManifest = {
+        ...manifest,
+        packet_refs: manifest.packet_refs.map((ref) => path.resolve(ref.packet_ref) === resolvedPacketPath
+            ? { ...ref, packet_sha256: packetSha256 }
+            : ref),
+    };
+    await writeYamlDocument(manifestPath, updatedManifest);
+}
+/** deliberation unit_id is `deliberation:<issueId>:<lensId>` (the live colon
+ * form built by buildIssueScopedLensDeliberationPrompt); mirrors the split
+ * convention in haltLensIdFromOutcome. */
+function deliberationUnitIdParts(unitId) {
+    if (!unitId.startsWith("deliberation:"))
+        return null;
+    const [, issueId, lensId] = unitId.split(":");
+    if (!issueId || !lensId)
+        return null;
+    return { issueId, lensId };
+}
+/**
+ * §4-6a deliberation strategy: inject the evidence_refs error spec before the
+ * next retry of a deliberation-response unit whose submit was rejected by the
+ * `allowed_evidence_refs` whitelist. The deliberation throw carries only the
+ * ref, so issue_id/lens_id come from the dispatch unit_id and the allowed set
+ * from the packet's runtime projection (flat, single-(issue,lens) scope).
+ * Cap exhaustion keeps deliberation's existing non-halting degrade
+ * (completeUnavailableDeliberationResponseUnit) — no demotion machinery.
+ */
+async function applyDeliberationResubmitErrorSpec(args) {
+    if (args.reviewExecutionProfile?.retry?.resubmit?.enabled !== true) {
+        return false;
+    }
+    if (args.dispatch.output_format !== "issue-deliberation-response") {
+        return false;
+    }
+    const violation = classifyDeliberationUnsupportedEvidenceRefFailure(args.error instanceof Error ? args.error.message : String(args.error)) ??
+        (await readFrozenDeliberationUnsupportedRefViolation(args.dispatch.output_path));
+    if (!violation)
+        return false;
+    const parts = deliberationUnitIdParts(args.dispatch.unit_id);
+    if (!parts)
+        return false;
+    let packetText;
+    try {
+        packetText = await fs.readFile(args.dispatch.packet_path, "utf8");
+    }
+    catch {
+        return false;
+    }
+    let allowedRefs = [];
+    try {
+        allowedRefs =
+            parseRuntimeIssueDeliberationSchemaContext(packetText).allowed_evidence_refs;
+    }
+    catch {
+        allowedRefs = [];
+    }
+    const resubmitAttempt = args.attempt + 1;
+    await fs.writeFile(args.dispatch.packet_path, applyResubmitErrorSpecToPacket(packetText, buildResubmitErrorSpec({
+        violation: {
+            stanceIndex: null,
+            issueId: parts.issueId,
+            evidenceRef: violation.evidenceRef,
+        },
+        allowedEvidenceRefs: allowedRefs,
+        resubmitAttempt,
+        unit: { kind: "deliberation", lensId: parts.lensId },
+    })), "utf8");
+    await appendExecutionProgress(args.errorLogPath, `runner deliberation resubmit: ${args.dispatch.unit_id}`, [
+        `resubmit_attempt: ${resubmitAttempt}`,
+        `issue_id: ${parts.issueId}`,
+        `lens_id: ${parts.lensId}`,
+        `unsupported_ref: ${violation.evidenceRef}`,
+    ]);
+    return true;
+}
+/** Deliberation counterpart of readFrozenUnsupportedRefViolation: the salvage
+ * freeze is output_format-agnostic, so a deliberation submit rejection is
+ * recoverable from the frozen error even when the adapter swallowed stderr. */
+async function readFrozenDeliberationUnsupportedRefViolation(outputPath) {
+    try {
+        const raw = await fs.readFile(salvageInputPathFor(outputPath), "utf8");
+        const frozen = JSON.parse(raw);
+        return typeof frozen.error === "string"
+            ? classifyDeliberationUnsupportedEvidenceRefFailure(frozen.error)
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** synthesis unit_id is `synthesis:<issueId>` (workItem.work_item_id, built in
+ * synthesis-map-reduce as `synthesis:${issue_id}`); the source_refs_used
+ * rejection text carries no issue_id, so it is recovered here. */
+function synthesisIssueIdFromUnitId(unitId) {
+    if (!unitId.startsWith("synthesis:"))
+        return null;
+    const issueId = unitId.slice("synthesis:".length);
+    return issueId.length > 0 ? issueId : null;
+}
+/**
+ * §4-2c/2-A synthesis strategy: inject the source_refs_used error spec before
+ * the next retry of a synthesis-response unit whose submit was rejected by the
+ * `allowed_source_refs` whitelist (bad ref) or the "must include at least one"
+ * guard. issue_id comes from the dispatch unit_id, the allowed set from the
+ * packet's runtime projection. Cap exhaustion keeps synthesis's existing
+ * non-halting degrade (completeUnavailableSynthesisResponseUnit) — no demotion
+ * machinery. In-loop retry reachability depends on the structural retry gate
+ * (shouldRetryUnitFailure), because the synthesis rejection message always
+ * substring-classifies as output_contract.
+ */
+async function applySynthesisResubmitErrorSpec(args) {
+    if (args.reviewExecutionProfile?.retry?.resubmit?.enabled !== true) {
+        return false;
+    }
+    if (args.dispatch.output_format !== "issue-synthesis-response")
+        return false;
+    const violation = classifySynthesisUnsupportedSourceRefFailure(args.error instanceof Error ? args.error.message : String(args.error)) ??
+        (await readFrozenSynthesisUnsupportedRefViolation(args.dispatch.output_path));
+    if (!violation)
+        return false;
+    const issueId = synthesisIssueIdFromUnitId(args.dispatch.unit_id);
+    if (!issueId)
+        return false;
+    let packetText;
+    try {
+        packetText = await fs.readFile(args.dispatch.packet_path, "utf8");
+    }
+    catch {
+        return false;
+    }
+    let allowedRefs = [];
+    try {
+        allowedRefs =
+            parseRuntimeIssueSynthesisSchemaContext(packetText).allowed_source_refs;
+    }
+    catch {
+        allowedRefs = [];
+    }
+    const resubmitAttempt = args.attempt + 1;
+    await fs.writeFile(args.dispatch.packet_path, applyResubmitErrorSpecToPacket(packetText, buildResubmitErrorSpec({
+        violation: {
+            stanceIndex: null,
+            issueId,
+            evidenceRef: violation.sourceRef ?? "",
+        },
+        allowedEvidenceRefs: allowedRefs,
+        resubmitAttempt,
+        unit: { kind: "synthesis", issueId },
+    })), "utf8");
+    await appendExecutionProgress(args.errorLogPath, `runner synthesis resubmit: ${args.dispatch.unit_id}`, [
+        `resubmit_attempt: ${resubmitAttempt}`,
+        `issue_id: ${issueId}`,
+        `unsupported_ref: ${violation.sourceRef ?? "(none — must cite >=1 allowed source ref)"}`,
+    ]);
+    return true;
+}
+/** Synthesis counterpart of readFrozenUnsupportedRefViolation. */
+async function readFrozenSynthesisUnsupportedRefViolation(outputPath) {
+    try {
+        const raw = await fs.readFile(salvageInputPathFor(outputPath), "utf8");
+        const frozen = JSON.parse(raw);
+        return typeof frozen.error === "string"
+            ? classifySynthesisUnsupportedSourceRefFailure(frozen.error)
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseExecutorRunMetadata(stdout) {
     const trimmed = stdout.trim();
     if (!trimmed.startsWith("{") || !trimmed.endsWith("}"))
@@ -1358,7 +1765,10 @@ extraArgs = []) {
     });
     return parseExecutorRunMetadata(stdout);
 }
-function toUnitExecutionResult(outcome) {
+// Exported for the resubmit-marker falsifiability tests (review-cert/v2
+// §5.3): the outcome→unit-result projection is where the marker would be
+// silently dropped if the wiring regressed.
+export function toUnitExecutionResult(outcome) {
     if (outcome.preservedResult) {
         return normalizePreservedUnitExecutionResult(outcome.preservedResult);
     }
@@ -1379,6 +1789,7 @@ function toUnitExecutionResult(outcome) {
         ...(outcome.attemptCount !== undefined
             ? { attempt_count: outcome.attemptCount }
             : {}),
+        ...(outcome.resubmitApplied ? { resubmit_applied: true } : {}),
         ...(outcome.packetBytes !== undefined
             ? { packet_bytes: outcome.packetBytes }
             : {}),
@@ -1656,6 +2067,7 @@ function inferFailureLensId(artifact, result) {
     return null;
 }
 function collectFailedUnits(artifact) {
+    const includeAttemptCount = artifact.retry_policy?.resubmit?.enabled === true;
     return allUnitExecutionResults(artifact)
         .filter((result) => result.status === "failed")
         .map((result) => ({
@@ -1666,6 +2078,9 @@ function collectFailedUnits(artifact) {
         output_path: result.output_path,
         failure_kind: result.failure_kind ?? null,
         failure_message: result.failure_message ?? "unknown failure",
+        ...(includeAttemptCount && result.attempt_count !== undefined
+            ? { attempt_count: result.attempt_count }
+            : {}),
     }));
 }
 function degradationKindsFor(artifact, failedUnits) {
@@ -2427,6 +2842,9 @@ async function resetExecutionOutputs(executionPlan) {
         executionPlan.final_output_path,
         executionPlan.lens_completion_barrier_path ??
             path.join(executionPlan.session_root, "lens-completion-barrier.yaml"),
+        // 설계 B: 이전 run의 breaker end-state는 폐기되는 run의 기록이다 —
+        // 남기면 fresh 재실행(특히 breaker OFF)이 낡은 트립/회복 집합을 주장한다.
+        dispatchIncompleteArtifactPath(executionPlan.session_root),
         executionPlan.teamlead_deliberation_prompt_packet_path,
         ...executionPlan.lens_execution_seats.map((seat) => seat.output_path),
         ...executionPlan.lens_execution_seats
@@ -2511,8 +2929,23 @@ async function runSingleDispatchWithRetries(args) {
         dispatch,
         fallback: unitTimeoutMs,
     });
+    let resubmitApplied = false;
     for (let attempt = 0; attempt <= effectiveMaxRetries; attempt += 1) {
         attemptsUsed = attempt + 1;
+        if (attempt === 0) {
+            // 설계 A: nested-batch 1차 시도 실패의 flat 폴백과 halted 세션 resume은
+            // 이 루프 밖에서 실패해 frozen salvage input만 남는다 — 그 구조적
+            // 근거가 있으면 첫 flat 시도 전에 오류 명세를 주입해 blind 재실행을
+            // 막는다. (스위치 OFF·미지원 output_format·freeze 부재 시 no-op)
+            resubmitApplied = (await applyResubmitErrorSpec({
+                dispatch,
+                error: null,
+                attempt: 0,
+                reviewExecutionProfile,
+                errorLogPath: executionPlan.error_log_path,
+                executionPlan,
+            })) || resubmitApplied;
+        }
         try {
             const executorMetadata = await invokeExecutor(executorConfig, projectRoot, sessionRoot, executionPlan, dispatch, retryTimeoutMs(effectiveUnitTimeoutMs, attempt), reviewExecutionProfile);
             const completedAtMs = Date.now();
@@ -2528,6 +2961,7 @@ async function runSingleDispatchWithRetries(args) {
                 startedAtMs,
                 completedAtMs,
                 attemptCount: attempt + 1,
+                ...(resubmitApplied ? { resubmitApplied: true } : {}),
                 ...(executorMetadata !== undefined ? { executorMetadata } : {}),
                 artifactGenerationRealization: executorMetadata?.artifact_generation_realization ??
                     artifactGenerationRealization,
@@ -2538,7 +2972,7 @@ async function runSingleDispatchWithRetries(args) {
         }
         catch (error) {
             lastError = error;
-            if (shouldRetryUnitFailure({ error, attempt, maxRetries: effectiveMaxRetries })) {
+            if (shouldRetryUnitFailure({ error, attempt, maxRetries: effectiveMaxRetries, dispatch, reviewExecutionProfile })) {
                 const retryDelay = effectiveRetryInitialDelayMs * (attempt + 1);
                 console.log(`[review runner] ${dispatch.unit_id} attempt ${attempt + 1} failed, retrying in ${retryDelay}ms...`);
                 await appendExecutionProgress(executionPlan.error_log_path, `runner dispatch retry: ${dispatch.unit_id}`, [
@@ -2546,6 +2980,14 @@ async function runSingleDispatchWithRetries(args) {
                     `retry_delay_ms: ${retryDelay}`,
                     `error: ${error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200)}`,
                 ]);
+                resubmitApplied = (await applyResubmitErrorSpec({
+                    dispatch,
+                    error,
+                    attempt,
+                    reviewExecutionProfile,
+                    errorLogPath: executionPlan.error_log_path,
+                    executionPlan,
+                })) || resubmitApplied;
                 if (dispatch.unit_kind === "synthesize") {
                     await appendExecutionProgress(executionPlan.error_log_path, `runner synthesize retry: ${dispatch.unit_id}`, [
                         `attempt: ${attempt + 1}/${effectiveMaxRetries}`,
@@ -2555,7 +2997,7 @@ async function runSingleDispatchWithRetries(args) {
                 }
                 await sleep(retryDelay);
             }
-            if (!shouldRetryUnitFailure({ error, attempt, maxRetries: effectiveMaxRetries }))
+            if (!shouldRetryUnitFailure({ error, attempt, maxRetries: effectiveMaxRetries, dispatch, reviewExecutionProfile }))
                 break;
         }
     }
@@ -2624,6 +3066,7 @@ async function runSingleDispatchWithRetries(args) {
                     completedAtMs: Date.now(),
                     attemptCount: attemptsUsed + 1,
                     recovery: "salvaged_submit",
+                    ...(resubmitApplied ? { resubmitApplied: true } : {}),
                     childOutcomes: [failedOutcome],
                     ...(executorMetadata !== undefined ? { executorMetadata } : {}),
                     artifactGenerationRealization: executorMetadata?.artifact_generation_realization ??
@@ -2651,6 +3094,7 @@ async function runSingleDispatchWithRetries(args) {
         startedAtMs,
         completedAtMs,
         attemptCount: attemptsUsed,
+        ...(resubmitApplied ? { resubmitApplied: true } : {}),
         packetBytes,
         outputBytes,
         failure,
@@ -2767,6 +3211,12 @@ export async function runNestedStageFirstAttempt(args) {
  *   - batch fail + remaining budget → flat retries (effective - 1);
  *   - batch fail + zero budget → finalize the failure (no extra attempt —
  *     an explicit zero-retry policy means exactly one attempt).
+ *
+ * The two batch-window branches (batch ok, zero-budget fail) carry
+ * `nestedBatchWindow: true` marking them as not directly observed. A breaker
+ * skips a batch-window SUCCESS (completed, no streak reset) but still records a
+ * batch-window FAILURE as a failure (see recordNestedUnitOutcomeToBreaker) —
+ * the flat-retry branch is a real dispatch and stays untagged (§4-1).
  */
 export async function unitOutcomeWithNestedFirstAttempt(args) {
     const runFlat = args.runFlat ?? runSingleDispatchWithRetries;
@@ -2791,6 +3241,7 @@ export async function unitOutcomeWithNestedFirstAttempt(args) {
             startedAtMs: args.batch.startedAtMs,
             completedAtMs: args.batch.completedAtMs,
             attemptCount: 1,
+            nestedBatchWindow: true,
             artifactGenerationRealization,
             semanticQualityEvidence,
             packetBytes: await fileSizeIfPresent(dispatch.packet_path),
@@ -2825,6 +3276,7 @@ export async function unitOutcomeWithNestedFirstAttempt(args) {
         startedAtMs: args.batch.startedAtMs,
         completedAtMs: args.batch.completedAtMs,
         attemptCount: 1,
+        nestedBatchWindow: true,
         packetBytes,
         outputBytes,
         failure,
@@ -2880,8 +3332,14 @@ export async function executeIssueStanceUnit(args) {
         };
         await removeFileIfExists(dispatch.output_path);
         await appendExecutionFailure(ctx.executionPlan.error_log_path, failure, ctx.executionPlan.effective_boundary_state);
+        // §4-1: an on-disk validation failure is a directly-observed unit failure,
+        // not a batch-window outcome — drop the nested-batch tag so the breaker
+        // records it as a failure (dead-letter), consistent with the flat path.
+        // (A batch-ok→validation-fail unit would otherwise spread
+        // `nestedBatchWindow: true` and be mis-recorded as skipped/completed.)
+        const { nestedBatchWindow: _batchWindow, ...observed } = outcome;
         return {
-            ...outcome,
+            ...observed,
             success: false,
             completedAtMs: Date.now(),
             outputBytes: await fileSizeIfPresent(dispatch.output_path),
@@ -3275,22 +3733,38 @@ async function runIssueStanceMatrixCollectionDispatch(args) {
             packetPath: dispatch.packet_path,
         });
     }));
+    // Continuation per-unit gate: run-owing 유닛만 디스패치 대상이다.
+    // preserved 유닛은 완료된 prior result에서 outcome을 복원한다 (아래 워커).
+    const owesStanceRun = (unitId) => args.runUnitIds === undefined || args.runUnitIds.has(unitId);
+    const runOwingDispatches = dispatches.filter((dispatch) => owesStanceRun(dispatch.unit_id));
     // nested-workers: attempt #1 for the whole stage goes through ONE outer
     // nesting batch worker (waves capped at the flat pool width); failed
-    // units fall back to the flat per-unit retry loop below.
+    // units fall back to the flat per-unit retry loop below. preserved 유닛은
+    // 배치에 넣지 않는다 — 디스패치를 빚지지 않은 유닛이다.
     const stanceNestedBatch = await runNestedStageFirstAttempt({
         stageLabel: "issue-stance",
         projectRoot: args.projectRoot,
         sessionRoot: args.sessionRoot,
         executionPlan: args.executionPlan,
         executorConfig: args.executorConfig,
-        dispatches,
+        dispatches: runOwingDispatches,
         dispatchWidth: maxConcurrentIssueStanceResponses,
         unitTimeoutMs: args.unitTimeoutMs,
         reviewExecutionProfile: args.reviewExecutionProfile,
     });
     const outcomes = new Array(dispatches.length);
     let nextDispatchIndex = 0;
+    // 설계 B + §4-1: stance 풀 breaker — 유닛의 최종 outcome(per-unit bounded
+    // retry 소진 후)을 관찰 단위로 기록한다. nested 1차 배치가 실행돼도 생성한다:
+    // 배치-창 SUCCESS는 실 디스패치가 아니므로 recordItemSkipped로 완료만 집계해
+    // 과거 배치 창의 생존 증거가 현재 계통 실패 streak을 오리셋하지 못하게 하고
+    // (#166 결함 클래스 재유입 차단), 배치-창 FAILURE는 flat 경로처럼 실패로 기록
+    // 한다(item-local→dead-letter, 계통→회복 victim). 배치-실패 유닛이 flat 재시도
+    // 예산을 쓰면 그 실 관측이 streak을 구동한다.
+    const breakerState = reviewDispatchBreakerFromProfile(args.reviewExecutionProfile, {
+        concurrent: Math.min(maxConcurrentIssueStanceResponses, runOwingDispatches.length) > 1,
+    });
+    let breakerTripOutcome = null;
     async function runIssueStanceWorker() {
         while (true) {
             const dispatchIndex = nextDispatchIndex;
@@ -3298,7 +3772,39 @@ async function runIssueStanceMatrixCollectionDispatch(args) {
             if (dispatchIndex >= dispatches.length)
                 return;
             const dispatch = dispatches[dispatchIndex];
-            outcomes[dispatchIndex] = await executeIssueStanceUnit({
+            if (!owesStanceRun(dispatch.unit_id)) {
+                // preserved/continuation 유닛: 디스패치 없이 완료 증거를 복원한다.
+                // breaker에는 기록하지 않는다 — planned 집합 자체가 run-owing
+                // 유닛으로 계산된다 (lens 풀과 동일 규약). 트립 여부와 무관하게
+                // 기록해야 완료 증거가 결과 아티팩트에서 유실되지 않는다.
+                const prior = args.preservedResultsByUnitId?.get(dispatch.unit_id);
+                if (!prior || prior.status !== "completed") {
+                    throw new Error(`Cannot preserve continuation unit without a completed prior result: ${dispatch.unit_id}`);
+                }
+                outcomes[dispatchIndex] = outcomeFromPreviousResult(prior);
+                continue;
+            }
+            // 트립 이후엔 새 flat 디스패치를 빚지는 유닛만 건너뛴다 — 그런 유닛은
+            // 미디스패치로 incomplete 집합에 남아 회복 재디스패치 대상이 된다(규칙 5).
+            // 배치-성공(디스패치 안 빚음)과 zero-retry 배치-실패(예산 소진 → 새 flat
+            // 디스패치 없음)는 트립 후에도 처리해 recordNested…로 기록·분류한다:
+            // 미기록 시 incomplete로 오집계되고, item-local 배치-실패는 dead-letter
+            // 여야 하는데 스킵하면 incomplete로 오분류된다(교차검증 — lens 풀과 대칭,
+            // 계약의 nested 균일 규칙 준수). return이 아닌 continue: 뒤 인덱스
+            // preserved 복원도 마저 소진.
+            if (breakerState?.tripped()) {
+                const batchOutcome = stanceNestedBatch?.byUnitId.get(dispatch.unit_id);
+                const owesNewDispatch = batchOutcome?.ok !== true &&
+                    (batchOutcome === undefined ||
+                        maxRetriesForDispatch({
+                            profile: args.reviewExecutionProfile,
+                            dispatch,
+                            fallback: args.retryPolicy.issueArtifactMaxRetries,
+                        }) >= 1);
+                if (owesNewDispatch)
+                    continue;
+            }
+            const outcome = await executeIssueStanceUnit({
                 ctx: {
                     projectRoot: args.projectRoot,
                     sessionRoot: args.sessionRoot,
@@ -3312,22 +3818,105 @@ async function runIssueStanceMatrixCollectionDispatch(args) {
                 participatingLensIds,
                 nestedBatch: stanceNestedBatch,
             });
+            outcomes[dispatchIndex] = outcome;
+            if (breakerState) {
+                // §4-1: 배치-창 결과는 skipped(완료만, 계통 streak 불변), 실 flat
+                // 디스패치는 성공/실패로 반영한다. 첫 임계 도달이 트립 권위 — halt
+                // 귀속을 그 유닛의 outcome으로 고정한다.
+                const trip = recordNestedUnitOutcomeToBreaker(breakerState, outcome);
+                if (trip !== null)
+                    breakerTripOutcome = outcome;
+            }
         }
     }
     await Promise.all(Array.from({
         length: Math.min(maxConcurrentIssueStanceResponses, dispatches.length),
     }, async () => runIssueStanceWorker()));
     const completedOutcomes = outcomes.filter((outcome) => outcome !== undefined);
-    const failedOutcome = completedOutcomes.find((outcome) => !outcome.success);
-    if (failedOutcome) {
-        throw new ReviewIssueArtifactDispatchError(`Issue stance response failed: ${failedOutcome.failure?.message ?? "unknown error"}`, failedOutcome, failedOutcome.failure?.message ?? "unknown error");
+    const failedOutcomes = completedOutcomes.filter((outcome) => !outcome.success);
+    const resubmitEnabled = args.reviewExecutionProfile?.retry?.resubmit?.enabled === true;
+    const stanceDispatchError = (outcome, haltReason = null, batchOutcomes = []) => {
+        const message = outcome.failure?.message ?? "unknown error";
+        return new ReviewIssueArtifactDispatchError(`Issue stance response failed: ${message}`, outcome, message, haltReason, batchOutcomes);
+    };
+    if (breakerState) {
+        // 규칙 6: 트립이든 완주든 배치 end-state를 영속 — 회복 절차가 항상
+        // 정확한 재디스패치 집합을 갖는다. 트립이 아니어도 아래의 기존
+        // 강등/halt 규칙은 그대로 진행된다 (breaker는 구제하지 않는다).
+        const incompleteArtifactPath = await persistReviewDispatchIncompleteArtifact({
+            sessionRoot: args.sessionRoot,
+            batchLabel: "issue-stance",
+            // planned = 이번 run이 실제 디스패치를 빚진 유닛 집합 (preserved 제외).
+            plannedItemIds: runOwingDispatches.map((dispatch) => dispatch.unit_id),
+            state: breakerState,
+        });
+        const trip = breakerState.tripped();
+        if (trip) {
+            // 규칙 4: 계통 실패 임계 도달 — 배치 halt + 사용자 공지(halt_reason에
+            // 미완료 목록 경로 포함). 설계 A의 halt 배관(4번째 인자 haltReason →
+            // haltAfterIssueArtifactFailure → halted_partial)을 재사용한다.
+            const haltReason = reviewDispatchBreakerHaltReason(trip, incompleteArtifactPath);
+            await appendExecutionProgress(args.executionPlan.error_log_path, "runner issue stance dispatch breaker tripped", [
+                `failure_class: ${trip.failure_class}`,
+                `consecutive_unit_count: ${trip.consecutive_item_count}`,
+                `threshold: ${trip.threshold}`,
+                `dispatch_incomplete_path: ${incompleteArtifactPath}`,
+            ]);
+            throw stanceDispatchError(breakerTripOutcome ?? failedOutcomes[0], haltReason, 
+            // halt 시점까지의 배치 진실 전체 — 완료 유닛의 행이 남아야 회복
+            // 재디스패치 집합이 dispatch-incomplete의 미완료 집합과 일치한다.
+            completedOutcomes);
+        }
     }
+    let demotedLensIds = [];
+    if (failedOutcomes.length > 0) {
+        // 검증-거부 분류는 두 근거를 모두 본다: in-process 경로는 실패 메시지
+        // (submit-시점·on-disk 검증기 양쪽 문구), worker 경로는 stderr가 검증
+        // 문구를 보장하지 않으므로 frozen salvage input을 구조적 근거로 읽는다.
+        const validationFailures = [];
+        if (resubmitEnabled) {
+            for (const outcome of failedOutcomes) {
+                const classified = isUnsupportedEvidenceRefFailureMessage(outcome.failure?.message) ||
+                    (await readFrozenUnsupportedRefViolation(outcome.dispatch.output_path)) !== null;
+                if (classified)
+                    validationFailures.push(outcome);
+            }
+        }
+        if (resubmitEnabled &&
+            correlatedValidationExceeded({
+                validationFailedUnitCount: validationFailures.length,
+                totalUnitCount: dispatches.length,
+            })) {
+            // 설계 A 상관 에스컬레이션: 같은 검증 클래스가 stance 유닛 과반에서
+            // 실패하면 구조 결함(프롬프트/스키마/컨텍스트 조립)이므로 whole-run
+            // halt를 보존한다.
+            throw stanceDispatchError(validationFailures[0], `${CORRELATED_VALIDATION_HALT_REASON}: evidence_refs validation rejected ${validationFailures.length}/${dispatches.length} stance units`);
+        }
+        const demotable = resubmitEnabled && validationFailures.length === failedOutcomes.length;
+        if (!demotable) {
+            // 현행 승격 규칙 보존: 인프라 실패(timeout/transport/…)와 OFF 경로는
+            // 지금처럼 whole-run halt.
+            throw stanceDispatchError(failedOutcomes[0]);
+        }
+        // 설계 A 유닛 강등: resubmit cap을 소진한 검증-거부 유닛만
+        // complete-with-failure로 남긴다. 실패 outcome은 집계 outcome의 failed
+        // child로 유지되어 degradation-summary와 상태 강등이 자동 전파되고,
+        // 리뷰는 생존 렌즈의 stance로 계속한다.
+        demotedLensIds = validationFailures.map((outcome) => outcome.dispatch.unit_id.slice("issue-stance:".length));
+        await appendExecutionProgress(args.executionPlan.error_log_path, "runner stance units demoted (bounded resubmit exhausted)", demotedLensIds.map((lensId) => `lens_id: ${lensId}`));
+    }
+    const survivorLensIds = participatingLensIds.filter((lensId) => !demotedLensIds.includes(lensId));
+    const survivorResponsePaths = [
+        ...new Set(survivorLensIds
+            .map((lensId) => responsePathsByLensId.get(lensId))
+            .filter((value) => value !== undefined)),
+    ];
     await fs.mkdir(path.dirname(seat.packet_path), { recursive: true });
     await fs.writeFile(seat.packet_path, `${renderRuntimeIssueStanceMatrixPacket({
         projectRoot: args.projectRoot,
         sessionId: args.executionPlan.session_id,
         outputPath: seat.output_path,
-        responsePaths: Array.from(responsePathsByLensId.values()),
+        responsePaths: survivorResponsePaths,
     }).trimEnd()}\n`, "utf8");
     await registerGeneratedPromptPacketRefForDispatch({
         executionPlan: args.executionPlan,
@@ -3338,7 +3927,8 @@ async function runIssueStanceMatrixCollectionDispatch(args) {
         executionPlan: args.executionPlan,
         projectRoot: args.projectRoot,
         responsePathsByLensId,
-        participatingLensIds,
+        participatingLensIds: survivorLensIds,
+        demotedLensIds,
         outputPath: seat.output_path,
     });
     return {
@@ -3371,6 +3961,8 @@ async function runIssueArtifactDispatch(args) {
             unitTimeoutMs: args.unitTimeoutMs,
             retryPolicy: args.retryPolicy,
             reviewExecutionProfile: args.reviewExecutionProfile,
+            runUnitIds: args.runUnitIds,
+            preservedResultsByUnitId: args.preservedResultsByUnitId,
         });
     }
     const seat = await writeIssueArtifactPromptPacket({
@@ -4533,6 +5125,23 @@ export async function executeReviewPromptExecution(params) {
     }
     const executionOutcomes = new Array(lensDispatches.length);
     let nextLensIndex = 0;
+    // A-path 스코프 판별을 호이스트: 초기 lens 페이즈가 nested 배치로 가는
+    // 조건 (continuation/repair 패스는 항상 flat per-unit 루프).
+    const nestedLensWorkerExecutor = !continuationMode &&
+        params.reviewExecutionProfile?.mode === "nested-workers" &&
+        (params.reviewExecutionProfile.worker_executor === "codex" ||
+            params.reviewExecutionProfile.worker_executor === "claude_code")
+        ? params.reviewExecutionProfile.worker_executor
+        : null;
+    // 설계 B + §4-1: lens 풀 breaker — flat per-unit 루프(runLensWorker)와 nested
+    // 1차 배치의 flat-fallback이 최종 outcome을 관찰 단위로 기록한다. nested
+    // 배치-성공 유닛은 실 디스패치가 아니므로 recordItemSkipped로 완료만
+    // 집계하고(미기록 시 incomplete로 오집계, 배치-창 생존이 계통 streak을
+    // 오리셋하는 것 차단), 배치-실패 유닛의 flat 재시도만 streak을 구동한다.
+    const lensBreakerState = reviewDispatchBreakerFromProfile(params.reviewExecutionProfile, {
+        concurrent: Math.min(maxConcurrentLenses, lensDispatches.filter((dispatch) => shouldRunUnit(dispatch.unit_id))
+            .length) > 1,
+    });
     async function haltForCancellation(args) {
         const completedLensOutcomes = executionOutcomes.filter(isSuccessfulOutcome);
         const successfulLensDispatches = completedLensOutcomes.map((outcome) => outcome.dispatch);
@@ -4626,9 +5235,21 @@ export async function executeReviewPromptExecution(params) {
                 return;
             }
             if (!shouldRunUnit(dispatch.unit_id)) {
+                // preserved/continuation 유닛은 breaker에 기록하지 않는다 — planned
+                // 집합 자체가 "이번 run이 실제 디스패치하는 유닛"으로 계산된다.
+                // 트립 여부와 무관하게 기록한다: 디스패치가 필요 없는 완료 증거를
+                // 빼먹으면 barrier/execution-result가 완료 lens를 missing으로
+                // 기록해 다음 continuation이 이미 완료된 lens를 재디스패치한다.
                 executionOutcomes[currentIndex] = preservedOutcomeForDispatch(dispatch);
                 continue;
             }
+            // 설계 B: 트립 이후 새 lens를 디스패치하지 않는다 — 남은 실행 유닛은
+            // 미디스패치로 incomplete 집합에 남아 회복 재디스패치 대상이 된다
+            // (규칙 5). return이 아닌 continue: 뒤 인덱스의 preserved 유닛 기록을
+            // 마저 소진해야 한다.
+            if (lensBreakerState?.tripped()) {
+                continue;
+            }
             console.log(`[review runner] starting ${dispatch.unit_kind}: ${dispatch.unit_id}`);
             await appendExecutionProgress(executionPlan.error_log_path, `runner dispatch started: ${dispatch.unit_id}`, [
                 `unit_id: ${dispatch.unit_id}`,
@@ -4669,6 +5290,8 @@ export async function executeReviewPromptExecution(params) {
                         error,
                         attempt,
                         maxRetries: effectiveMaxRetries,
+                        dispatch,
+                        reviewExecutionProfile: params.reviewExecutionProfile,
                     })) {
                         const retryDelay = effectiveRetryInitialDelayMs * (attempt + 1);
                         console.log(`[review runner] ${dispatch.unit_id} attempt ${attempt + 1} failed, retrying in ${retryDelay}ms...`);
@@ -4683,6 +5306,8 @@ export async function executeReviewPromptExecution(params) {
                         error,
                         attempt,
                         maxRetries: effectiveMaxRetries,
+                        dispatch,
+                        reviewExecutionProfile: params.reviewExecutionProfile,
                     }))
                         break;
                 }
@@ -4705,6 +5330,8 @@ export async function executeReviewPromptExecution(params) {
                     packetBytes: await fileSizeIfPresent(dispatch.packet_path),
                     outputBytes: await fileSizeIfPresent(dispatch.output_path),
                 };
+                // 실 디스패치 성공만 프로바이더 생존 증거다 (breaker 규칙 2).
+                lensBreakerState?.recordItemSuccess(dispatch.unit_id);
             }
             else {
                 const completedAtMs = Date.now();
@@ -4720,7 +5347,7 @@ export async function executeReviewPromptExecution(params) {
                 const outputBytes = await fileSizeIfPresent(dispatch.output_path);
                 await removeFileIfExists(dispatch.output_path);
                 await appendExecutionFailure(executionPlan.error_log_path, failure, executionPlan.effective_boundary_state);
-                executionOutcomes[currentIndex] = {
+                const outcome = {
                     dispatch,
                     success: false,
                     startedAtMs,
@@ -4730,6 +5357,16 @@ export async function executeReviewPromptExecution(params) {
                     outputBytes,
                     failure,
                 };
+                executionOutcomes[currentIndex] = outcome;
+                // 유닛의 최종 실패(per-unit retry 소진)를 관찰 단위로 기록. 계통
+                // 클래스가 아니면(dead-letter) streak에 닿지 않고, 트립 여부는 루프
+                // 상단 체크가 소비한다 — halt는 배리어 뒤 epilogue가 수행.
+                lensBreakerState?.recordItemFailure({
+                    item_id: dispatch.unit_id,
+                    failure_class: reviewSystemicFailureClassFromOutcome(outcome),
+                    failure_message: failure.message,
+                    attempt_count: attemptsUsed,
+                });
             }
         }
     }
@@ -4737,18 +5374,15 @@ export async function executeReviewPromptExecution(params) {
     // scope). Continuation/repair passes re-dispatch remaining units through
     // the flat per-unit loop — same unit-executor invocation, same artifact
     // contract, so the seat truth is identical either way.
-    if (!continuationMode &&
-        params.reviewExecutionProfile?.mode === "nested-workers" &&
-        (params.reviewExecutionProfile.worker_executor === "codex" ||
-            params.reviewExecutionProfile.worker_executor === "claude_code")) {
-        const nestedBrand = params.reviewExecutionProfile.worker_executor === "codex"
+    if (nestedLensWorkerExecutor !== null) {
+        const nestedBrand = nestedLensWorkerExecutor === "codex"
             ? "codex"
             : "claude";
-        console.log(`[review runner] mode=nested-workers worker_executor=${params.reviewExecutionProfile.worker_executor}`);
+        console.log(`[review runner] mode=nested-workers worker_executor=${nestedLensWorkerExecutor}`);
         await appendExecutionProgress(executionPlan.error_log_path, "runner profile dispatch: nested-workers", [
-            `teamlead_seat: ${params.reviewExecutionProfile.teamlead.seat}`,
-            `lens_seat: ${params.reviewExecutionProfile.lens.seat}`,
-            `worker_executor: ${params.reviewExecutionProfile.worker_executor}`,
+            `teamlead_seat: ${params.reviewExecutionProfile?.teamlead.seat}`,
+            `lens_seat: ${params.reviewExecutionProfile?.lens.seat}`,
+            `worker_executor: ${nestedLensWorkerExecutor}`,
             `planned_lens_count: ${lensDispatches.length}`,
         ]);
         const nestedStartedAtMs = Date.now();
@@ -4834,15 +5468,22 @@ export async function executeReviewPromptExecution(params) {
                         `unit_kind: ${dispatch.unit_kind}`,
                         `output_path: ${dispatch.output_path}`,
                     ]);
-                    executionOutcomes[i] = {
+                    const okOutcome = {
                         dispatch,
                         success: true,
                         startedAtMs: nestedStartedAtMs,
                         completedAtMs: nestedCompletedAtMs,
                         attemptCount: 1,
+                        nestedBatchWindow: true,
                         packetBytes: await fileSizeIfPresent(dispatch.packet_path),
                         outputBytes: await fileSizeIfPresent(dispatch.output_path),
                     };
+                    executionOutcomes[i] = okOutcome;
+                    // §4-1: 배치-성공은 실 디스패치가 아니다 — 헬퍼가 skipped로 완료만
+                    // 집계(계통 streak 불변). 미기록 시 incomplete로 오집계된다.
+                    if (lensBreakerState) {
+                        recordNestedUnitOutcomeToBreaker(lensBreakerState, okOutcome);
+                    }
                     continue;
                 }
                 catch (error) {
@@ -4863,6 +5504,11 @@ export async function executeReviewPromptExecution(params) {
                 fallback: maxRetries,
             });
             if (effectiveLensMaxRetries >= 1) {
+                // §4-1: 트립 이후에는 새 flat 재시도를 디스패치하지 않는다 — 이 유닛은
+                // 미디스패치로 incomplete 집합에 남아 회복 재디스패치 대상이 된다
+                // (규칙 5). 앞선 배치-성공 유닛은 이미 skipped로 기록됐다.
+                if (lensBreakerState?.tripped())
+                    continue;
                 // Batch consumed attempt #1 — clear the dead seat and spend the
                 // remaining budget through the flat loop (same executor config
                 // derivation as the flat lens path: invokeExecutor applies the
@@ -4872,7 +5518,7 @@ export async function executeReviewPromptExecution(params) {
                     `batch_failure: ${batchFailureMessage}`,
                     `remaining_max_retries: ${effectiveLensMaxRetries - 1}`,
                 ]);
-                executionOutcomes[i] = await runSingleDispatchWithRetries({
+                const flatOutcome = await runSingleDispatchWithRetries({
                     projectRoot,
                     sessionRoot,
                     executionPlan,
@@ -4884,6 +5530,14 @@ export async function executeReviewPromptExecution(params) {
                     reviewExecutionProfile: params.reviewExecutionProfile,
                     maxRetriesOverride: effectiveLensMaxRetries - 1,
                 });
+                executionOutcomes[i] = flatOutcome;
+                // flat 재시도는 실 디스패치 관측이다 — 성공/실패를 breaker에 반영
+                // (§4-1; flatOutcome은 배치-창 태그가 없어 skipped로 빠지지 않는다).
+                // lens 트립 halt는 배리어 뒤 epilogue가 tripped()로 수행하므로 반환
+                // trip은 소비하지 않는다.
+                if (lensBreakerState) {
+                    recordNestedUnitOutcomeToBreaker(lensBreakerState, flatOutcome);
+                }
                 continue;
             }
             const failure = {
@@ -4898,7 +5552,7 @@ export async function executeReviewPromptExecution(params) {
             const outputBytes = await fileSizeIfPresent(dispatch.output_path);
             await removeFileIfExists(dispatch.output_path);
             await appendExecutionFailure(executionPlan.error_log_path, failure, executionPlan.effective_boundary_state);
-            executionOutcomes[i] = {
+            const failureOutcome = {
                 dispatch,
                 success: false,
                 startedAtMs: nestedStartedAtMs,
@@ -4908,6 +5562,13 @@ export async function executeReviewPromptExecution(params) {
                 outputBytes,
                 failure,
             };
+            executionOutcomes[i] = failureOutcome;
+            // §4-1 (교차검증 F2/Finding A): zero-retry 배치 실패는 flat 경로처럼
+            // 실패로 기록한다 — 검증 실패(item-local)는 dead-letter, 계통 실패는
+            // 회복 victim(incomplete). skipped(완료 오집계)가 아니다.
+            if (lensBreakerState) {
+                recordNestedUnitOutcomeToBreaker(lensBreakerState, failureOutcome);
+            }
         }
         // Capture outer teamlead halt_reason for the post-dispatch halt check
         // (synthesize may still run if enough lenses participated, matching the
@@ -4919,6 +5580,19 @@ export async function executeReviewPromptExecution(params) {
     else {
         await Promise.all(Array.from({ length: Math.min(maxConcurrentLenses, lensDispatches.length) }, async (_, workerIndex) => runLensWorker(workerIndex)));
     }
+    // 설계 B 규칙 6: breaker-ON lens 배치는 트립이든 완주든 end-state를
+    // 영속한다 — 회복 절차가 항상 정확한 재디스패치 집합을 갖는다.
+    let lensDispatchIncompletePath = null;
+    if (lensBreakerState) {
+        lensDispatchIncompletePath = await persistReviewDispatchIncompleteArtifact({
+            sessionRoot,
+            batchLabel: "lens",
+            plannedItemIds: lensDispatches
+                .filter((dispatch) => shouldRunUnit(dispatch.unit_id))
+                .map((dispatch) => dispatch.unit_id),
+            state: lensBreakerState,
+        });
+    }
     const postLensCancelRequest = await readReviewCancelRequest(sessionRoot);
     if (postLensCancelRequest) {
         return haltForCancellation({
@@ -4941,10 +5615,21 @@ export async function executeReviewPromptExecution(params) {
         successfulLensDispatches,
         executionFailures,
     });
-    if (!lensCompletionBarrier.downstream_allowed) {
-        const haltReason = successfulLensDispatches.length === 0
-            ? "No participating lens outputs were produced."
-            : `Selected lens completion barrier failed: ${lensCompletionBarrier.completed_lens_ids.length}/${lensCompletionBarrier.planned_lens_ids.length} planned lenses completed.`;
+    // 설계 B 규칙 4: lens 트립은 배리어 판정과 무관하게 무조건 halt한다
+    // (트립 시점 이후 유닛은 미디스패치라 배리어가 우연히 downstream을 허용해도
+    // 배치는 이미 불완전하다). 배리어 아티팩트는 위에서 정상 기록되어
+    // continuation frontier가 미완료 lens를 재제안할 수 있다. lens 풀은
+    // 실패를 throw하지 않고 outcome으로만 기록하므로(전파 캐치 없음), 트립
+    // halt도 기존 배리어 halt와 같은 구조화 블록으로 수행한다.
+    const lensBreakerTrip = lensBreakerState?.tripped() ?? null;
+    if (lensBreakerTrip !== null || !lensCompletionBarrier.downstream_allowed) {
+        const haltReason = lensBreakerTrip !== null
+            ? reviewDispatchBreakerHaltReason(lensBreakerTrip, lensDispatchIncompletePath ??
+                dispatchIncompleteArtifactPath(sessionRoot))
+            : successfulLensDispatches.length === 0
+                ? "No participating lens outputs were produced."
+                : `Selected lens completion barrier failed: ${lensCompletionBarrier.completed_lens_ids.length}/${lensCompletionBarrier.planned_lens_ids.length} planned lenses completed.`;
+        const haltPhase = lensBreakerTrip !== null ? "lens_dispatch_breaker" : "lens_completion_barrier";
         await appendMarkdownLogEntry(executionPlan.error_log_path, "runner halted before synthesize", `${haltReason}\n\n[effective_boundary_state]\n${renderEffectiveBoundaryStateLog(executionPlan.effective_boundary_state)}`);
         const degradedLensIds = executionFailures
             .filter((failure) => failure.unit_kind === "lens")
@@ -4976,7 +5661,7 @@ export async function executeReviewPromptExecution(params) {
             synthesis_executed: false,
             deliberation_status: "not_performed",
             halt_reason: haltReason,
-            ...haltArtifactFields("lens_completion_barrier", null),
+            ...haltArtifactFields(haltPhase, null),
             error_log_path: executionPlan.error_log_path,
             lens_completion_barrier_ref: executionPlan.lens_completion_barrier_path ??
                 path.join(sessionRoot, "lens-completion-barrier.yaml"),
@@ -4996,12 +5681,23 @@ export async function executeReviewPromptExecution(params) {
             synthesis_executed: false,
             error_log_path: executionPlan.error_log_path,
             halt_reason: haltReason,
-            ...haltArtifactFields("lens_completion_barrier", null),
+            ...haltArtifactFields(haltPhase, null),
         };
     }
     const issueArtifactOutcomes = [];
     const lensOutputPaths = successfulLensDispatches.map((dispatch) => dispatch.output_path);
     const haltAfterIssueArtifactFailure = async (args) => {
+        // 설계 B 트립: halt 시점까지의 배치 outcome 전체(완료 포함)를 결과
+        // 아티팩트에 보존한다 — 완료 stance 유닛 행이 없으면 continuation
+        // ledger가 missing으로 도출해 이미 지불한 완료분을 재디스패치한다.
+        const batchOutcomes = args.error instanceof ReviewIssueArtifactDispatchError
+            ? args.error.batchOutcomes
+            : [];
+        for (const outcome of batchOutcomes) {
+            if (!issueArtifactOutcomes.some((existing) => existing.dispatch.unit_id === outcome.dispatch.unit_id)) {
+                issueArtifactOutcomes.push(outcome);
+            }
+        }
         const failureOutcome = issueArtifactOutcomeFromError(args.error);
         if (failureOutcome &&
             !issueArtifactOutcomes.some((outcome) => outcome.dispatch.unit_id === failureOutcome.dispatch.unit_id)) {
@@ -5013,7 +5709,10 @@ export async function executeReviewPromptExecution(params) {
             .filter((failure) => failure.unit_kind === "lens")
             .map((failure) => failure.unit_id);
         const executionCompletedAtMs = Date.now();
-        const haltReason = `Issue artifact generation failed: ${failureMessage}`;
+        const haltReasonOverride = args.error instanceof ReviewIssueArtifactDispatchError
+            ? args.error.haltReason
+            : null;
+        const haltReason = haltReasonOverride ?? `Issue artifact generation failed: ${failureMessage}`;
         await writeExecutionResultArtifact(executionPlan, {
             session_id: executionPlan.session_id,
             session_root: sessionRoot,
@@ -5119,6 +5818,15 @@ export async function executeReviewPromptExecution(params) {
                 unitTimeoutMs,
                 retryPolicy,
                 reviewExecutionProfile: params.reviewExecutionProfile,
+                // Continuation: stance 수집 스테이지가 run-owing 유닛만 디스패치하고
+                // 완료 유닛은 prior result에서 복원한다 (규칙 5 — 회복 재디스패치
+                // 집합 == 미완료 집합).
+                ...(continuationMode
+                    ? {
+                        runUnitIds: continuationRunUnitIds,
+                        preservedResultsByUnitId: previousResultsByUnitId,
+                    }
+                    : {}),
             }));
             return null;
         }
@@ -5351,7 +6059,9 @@ export async function executeReviewPromptExecution(params) {
             throw new Error("post-lens frontier loop did not converge (max iterations)");
         }
         const frontier = await computeReviewFrontier(sessionRoot);
-        if (frontier.unitLedger.units.every((unit) => isTrustedLedgerUnit(unit))) {
+        // Convergence = no unit owes work: trusted output OR terminally
+        // resolved (demoted complete-with-failure — 설계 A).
+        if (frontier.unitLedger.units.every((unit) => isResolvedLedgerUnit(unit))) {
             break;
         }
         const ready = frontier.frontierUnits.filter((unit) => unit.dispatchDecision !== "skip");