onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/discovery/settings-chain.js

@@ -6,7 +6,8 @@ import { z } from "zod";
 import { normalizeLlmModelSwitcher, } from "../llm/model-switcher.js";
 import { createStructuredFailureRecord, } from "../review/failure-records.js";
 import { fileExists } from "../review/review-artifact-utils.js";
-import { assertSupportedModelRoutes, collectModelSelections, loadSupportedModelRegistry, SUPPORTED_MODELS_AUTHORITY_PATH, } from "./supported-models.js";
+import { assertSupportedModelRoutes, collectSupportedModelDispatches, loadSupportedModelRegistry, SUPPORTED_MODELS_AUTHORITY_PATH, } from "./supported-models.js";
+import { REVIEW_EXECUTION_UNIT_IDS } from "./review-execution-units.js";
 const LlmAuthModeSchema = z.enum(["api_key", "oauth", "local"]);
 const LlmProviderSchema = z.enum(["openai", "anthropic", "grok", "lmstudio"]);
 const LlmSettingsSchema = z
@@ -18,6 +19,10 @@ const LlmSettingsSchema = z
     effort: z.string().min(1).optional(),
     service_tier: z.string().min(1).optional(),
     api_key_env: z.string().min(1).optional(),
+    // Per-call CLI-worker timeout (ms) for the direct-call route
+    // (codex_cli/claude_code); absent → DEFAULT_WORKER_TIMEOUT_MS. Distinct from
+    // review `units[].timeout_ms` (worker-process bound). See LlmCallConfig.timeout_ms.
+    timeout_ms: z.number().int().min(1).optional(),
 })
     .strict();
 const FullLlmSettingsSchema = z
@@ -29,6 +34,10 @@ const FullLlmSettingsSchema = z
     effort: z.string().min(1).optional(),
     service_tier: z.string().min(1).optional(),
     api_key_env: z.string().min(1).optional(),
+    // Per-call CLI-worker timeout (ms) for the direct-call route
+    // (codex_cli/claude_code); absent → DEFAULT_WORKER_TIMEOUT_MS. Distinct from
+    // review `units[].timeout_ms` (worker-process bound). See LlmCallConfig.timeout_ms.
+    timeout_ms: z.number().int().min(1).optional(),
 })
     .strict();
 const ReviewActorLlmSettingsSchema = z
@@ -40,6 +49,10 @@ const ReviewActorLlmSettingsSchema = z
     effort: z.string().min(1).optional(),
     service_tier: z.string().min(1).optional(),
     api_key_env: z.string().min(1).optional(),
+    // Per-call CLI-worker timeout (ms) for the direct-call route
+    // (codex_cli/claude_code); absent → DEFAULT_WORKER_TIMEOUT_MS. Distinct from
+    // review `units[].timeout_ms` (worker-process bound). See LlmCallConfig.timeout_ms.
+    timeout_ms: z.number().int().min(1).optional(),
 })
     .strict();
 const LlmRefSchema = LlmSettingsSchema;
@@ -62,19 +75,10 @@ const ReviewArtifactGenerationRealizationSchema = z.enum([
 ]);
 const ReviewDeliberationSchema = z.enum(["controlled-lens-deliberation"]);
 const ReviewLensOutputFormatSchema = z.enum(["markdown", "sidecar"]);
-export const REVIEW_EXECUTION_UNIT_IDS = [
-    "lens",
-    "finding_ledger",
-    "finding_relation_graph",
-    "issue_ledger",
-    "issue_stance_matrix",
-    "deliberation_plan",
-    "problem_framing",
-    "issue_stance_response",
-    "deliberation_response",
-    "deliberation_resolution",
-    "synthesis_response",
-];
+// Unit-id vocabulary lives in a leaf module (review-execution-units.ts) so the
+// dispatch-role resolver (supported-models) can bound unit paths without an
+// import cycle; re-exported here so existing consumers keep their import site.
+export { REVIEW_EXECUTION_UNIT_IDS };
 const ReviewExecutionUnitIdSchema = z.enum(REVIEW_EXECUTION_UNIT_IDS);
 const ReviewToolModeSchema = z.enum(["auto", "native", "inline"]);
 const ReviewSubmitSalvageSettingsSchema = z
@@ -90,6 +94,46 @@ const ReviewSubmitSalvageSettingsSchema = z
     delta_completion: z.literal("unit_llm").optional(),
 })
     .strict();
+const ReviewUnitResubmitSettingsSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+})
+    .strict();
+/** Dispatch limit/transport circuit breaker settings shape (설계 B) — shared
+ * by the reconstruct semantic-map loop (`reconstruct.execution.dispatch_breaker`)
+ * and the review lens/stance pools (`review.execution.retry.dispatch_breaker`):
+ * one concept, one schema, per-pipeline wire keys. */
+const DispatchBreakerSettingsSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    systemic_threshold: z.number().int().min(1).optional(),
+    per_call_max_attempts: z.number().int().min(1).optional(),
+    backoff_initial_ms: z.number().int().min(0).optional(),
+    backoff_cap_ms: z.number().int().min(0).optional(),
+})
+    .strict();
+const DispatchFallbackLlmSettingsSchema = z
+    .object({
+    provider: z.enum(["openai", "anthropic"]),
+    auth: z.literal("api_key"),
+    model: z.string().min(1),
+    effort: z.string().min(1),
+    api_key_env: z.string().min(1),
+})
+    .strict();
+const DispatchFallbackSettingsSchema = z.discriminatedUnion("enabled", [
+    z.object({ enabled: z.literal(false) }).strict(),
+    z
+        .object({
+        enabled: z.literal(true),
+        trigger: z.literal("rate_limit"),
+        max_fallback_passes: z.literal(1),
+        per_dispatch_max_provider_attempts: z.literal(1),
+        systemic_failure_threshold: z.literal(1),
+        llm: DispatchFallbackLlmSettingsSchema,
+    })
+        .strict(),
+]);
 const ReviewRetrySettingsSchema = z
     .object({
     lens_max_retries: z.number().int().min(0).optional(),
@@ -98,6 +142,12 @@ const ReviewRetrySettingsSchema = z
     synthesis_max_retries: z.number().int().min(0).optional(),
     retry_initial_delay_ms: z.number().int().min(0).optional(),
     salvage: ReviewSubmitSalvageSettingsSchema.optional(),
+    resubmit: ReviewUnitResubmitSettingsSchema.optional(),
+    // NOTE: this schema is shared by the V3 INPUT parse and the merged
+    // NormalizedSettingsSchema re-validation (via ReviewSettingsSchema), so a
+    // key added here survives both — the #167 dual-schema gap class cannot
+    // recur for retry keys.
+    dispatch_breaker: DispatchBreakerSettingsSchema.optional(),
 })
     .strict();
 const ReviewUnitExecutionSettingsSchema = z
@@ -136,6 +186,26 @@ const DEFAULT_REVIEW_EXECUTION = {
     synthesize: { seat: "worker" },
     deliberation: "controlled-lens-deliberation",
 };
+export const DEFAULT_DISPATCH_BREAKER_SETTINGS = {
+    // opt-in: OFF = 현행 동작 보존 — 활성화는 settings로만.
+    enabled: false,
+    systemic_threshold: 3,
+    per_call_max_attempts: 3,
+    backoff_initial_ms: 3000,
+    backoff_cap_ms: 30000,
+};
+export function completeDispatchBreakerSettings(input) {
+    return {
+        enabled: input?.enabled ?? DEFAULT_DISPATCH_BREAKER_SETTINGS.enabled,
+        systemic_threshold: input?.systemic_threshold ??
+            DEFAULT_DISPATCH_BREAKER_SETTINGS.systemic_threshold,
+        per_call_max_attempts: input?.per_call_max_attempts ??
+            DEFAULT_DISPATCH_BREAKER_SETTINGS.per_call_max_attempts,
+        backoff_initial_ms: input?.backoff_initial_ms ??
+            DEFAULT_DISPATCH_BREAKER_SETTINGS.backoff_initial_ms,
+        backoff_cap_ms: input?.backoff_cap_ms ?? DEFAULT_DISPATCH_BREAKER_SETTINGS.backoff_cap_ms,
+    };
+}
 const DEFAULT_REVIEW_RETRY_SETTINGS = {
     lens_max_retries: 2,
     issue_artifact_max_retries: 2,
@@ -144,6 +214,10 @@ const DEFAULT_REVIEW_RETRY_SETTINGS = {
     retry_initial_delay_ms: 3000,
     // opt-in: 벤치마크 재현성 보호 — 활성화는 settings로만.
     salvage: { enabled: false, delta_completion: "unit_llm" },
+    // opt-in: OFF = 현행 halt 동작 보존 — 활성화는 settings로만.
+    resubmit: { enabled: false },
+    // opt-in: OFF = 현행 halt/배리어 동작 보존 — 활성화는 settings로만.
+    dispatch_breaker: DEFAULT_DISPATCH_BREAKER_SETTINGS,
 };
 const DEFAULT_REVIEW_UNIT_TIMEOUT_MS = 240000;
 const DEFAULT_REVIEW_SHORT_LLM_UNIT_TIMEOUT_MS = 180000;
@@ -255,11 +329,76 @@ const V3ReviewActorSettingsSchema = z
     llm: ReviewActorLlmSettingsSchema,
 })
     .strict();
+const ReconstructActorLlmRuntimeSettingsSchema = z
+    .object({
+    openai_responses_output_headroom_tokens: z.number().int().positive().safe(),
+})
+    .strict();
 const V3ReconstructActorSettingsSchema = z
     .object({
     llm: FullLlmSettingsSchema,
+    llm_runtime: ReconstructActorLlmRuntimeSettingsSchema.optional(),
 })
     .strict();
+/**
+ * Single source of the reconstruct actor-seat key set (INV-MODEL-1 role-aware
+ * design §5.1). The V3/Normalized zod shapes and the ReconstructSettings type
+ * are DERIVED from this constant, and the normalize/merge copy functions
+ * iterate it — so a new actor key added here flows through parse, normalize,
+ * merge, and the gate walk without touching a hand-enumerated whitelist (the
+ * silent-strip class F19 is closed by construction). `semantic_author` and
+ * `confirmation_provider` are REQUIRED seats for live direct_call execution
+ * (resolveReconstructActorLlmSettings); `semantic_map_synthesize` is an
+ * OPTIONAL per-role override seat (absent = inherit the semantic_author
+ * config; resolveOptionalReconstructActorLlmSettings).
+ */
+export const RECONSTRUCT_ACTOR_KEYS = [
+    "semantic_author",
+    "confirmation_provider",
+    "semantic_map_synthesize",
+];
+/**
+ * Declared reconstruct.execution-level scalar settings (design §5.1). Like the
+ * actor axis, the zod schemas' scalar entries are DERIVED from this constant
+ * (reconstructExecutionScalarsShape) and the type maps over it, so a
+ * schema-declared-but-constant-missing key cannot exist (no second key
+ * authority in either direction); the normalize/merge copy functions iterate
+ * this list, so a declared scalar survives the settings chain even when
+ * `actors` is absent. A key NOT declared here is rejected by the strict
+ * schemas (fail-loud), never silently dropped. Current scalars are all
+ * booleans; a future non-boolean scalar must extend the shape helper.
+ */
+export const RECONSTRUCT_EXECUTION_SCALAR_KEYS = [
+    "semantic_map_authoring",
+];
+/** zod actors shape derived from {@link RECONSTRUCT_ACTOR_KEYS} — the schema
+ * cannot drift from the constant (no second key authority). */
+function reconstructActorsShape(actorSchema) {
+    return Object.fromEntries(RECONSTRUCT_ACTOR_KEYS.map((key) => [key, actorSchema.optional()]));
+}
+function reconstructActorsSettingsSchema() {
+    return z
+        .object(reconstructActorsShape(V3ReconstructActorSettingsSchema))
+        .strict()
+        .superRefine((actors, ctx) => {
+        for (const key of RECONSTRUCT_ACTOR_KEYS) {
+            if (key !== "semantic_author" && actors[key]?.llm_runtime !== undefined) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [key, "llm_runtime"],
+                    message: "reconstruct actor llm_runtime is currently supported only on semantic_author.",
+                });
+            }
+        }
+    });
+}
+/** zod execution-scalar shape derived from
+ * {@link RECONSTRUCT_EXECUTION_SCALAR_KEYS} — same single-source rule as the
+ * actor axis, so the F19/F24 silent-strip class is closed by construction on
+ * BOTH axes. */
+function reconstructExecutionScalarsShape() {
+    return Object.fromEntries(RECONSTRUCT_EXECUTION_SCALAR_KEYS.map((key) => [key, z.boolean().optional()]));
+}
 const V3ReviewExecutionSettingsSchema = z
     .object({
     topology: ReviewExecutionModeSchema.optional(),
@@ -349,12 +488,13 @@ const V3ReconstructSettingsSchema = z
     execution: z
         .object({
         actors: z
-            .object({
-            semantic_author: V3ReconstructActorSettingsSchema.optional(),
-            confirmation_provider: V3ReconstructActorSettingsSchema.optional(),
-        })
-            .strict()
+            .lazy(reconstructActorsSettingsSchema)
             .optional(),
+        // Execution-level scalars (e.g. the semantic-map authoring opt-in,
+        // design §5.5) — entries DERIVED from the scalar constant (§5.1).
+        ...reconstructExecutionScalarsShape(),
+        dispatch_breaker: DispatchBreakerSettingsSchema.optional(),
+        dispatch_fallback: DispatchFallbackSettingsSchema.optional(),
     })
         .strict()
         .optional(),
@@ -377,18 +517,11 @@ const NormalizedSettingsSchema = z
         execution: z
             .object({
             actors: z
-                .object({
-                semantic_author: z
-                    .object({ llm: FullLlmSettingsSchema })
-                    .strict()
-                    .optional(),
-                confirmation_provider: z
-                    .object({ llm: FullLlmSettingsSchema })
-                    .strict()
-                    .optional(),
-            })
-                .strict()
+                .lazy(reconstructActorsSettingsSchema)
                 .optional(),
+            ...reconstructExecutionScalarsShape(),
+            dispatch_breaker: DispatchBreakerSettingsSchema.optional(),
+            dispatch_fallback: DispatchFallbackSettingsSchema.optional(),
         })
             .strict()
             .optional(),
@@ -411,6 +544,32 @@ export function resolveReconstructActorLlmSettings(settings, actorName) {
     normalizeLlmModelSwitcher(actor.llm);
     return actor.llm;
 }
+export function resolveReconstructSemanticAuthorLlmRuntimeSettings(settings) {
+    return settings.reconstruct?.execution?.actors?.semantic_author?.llm_runtime;
+}
+/**
+ * THE single reader of an OPTIONAL reconstruct actor seat for DISPATCH
+ * consumers (design §5.4) — live wiring, mock identity projection, and tests
+ * all consume this one post-chain projection so no second dispatch-side
+ * seat-reading authority can drift. (The supported-model gate walks the same
+ * post-chain settings object structurally via collectModelSelections; both
+ * therefore see one seat value.) Absent seat → undefined (the stage inherits
+ * the semantic_author config). Pure projection: normalizes the switcher shape
+ * only — no provider/auth resolution, so it is safe under mock realization.
+ */
+export function resolveOptionalReconstructActorLlmSettings(settings, actorName) {
+    const actor = settings.reconstruct?.execution?.actors?.[actorName];
+    if (!actor)
+        return undefined;
+    normalizeLlmModelSwitcher(actor.llm);
+    return actor.llm;
+}
+/** Production opt-in for the semantic-map authoring stage (design §5.5).
+ * Absent/false = off: the capability pair is not attached AND the synthesize
+ * seat is dormant (excluded from the gate walk — U6, salvage precedent). */
+export function isReconstructSemanticMapAuthoringEnabled(settings) {
+    return settings.reconstruct?.execution?.semantic_map_authoring === true;
+}
 export const SETTINGS_FILENAME = "settings.json";
 export const RETIRED_CONFIG_FILENAMES = [
     `config.${"yml"}`,
@@ -546,6 +705,15 @@ function definedReviewRetry(retry) {
         }
         out.salvage = salvage;
     }
+    // 정정 2026-07-05: resubmit이 이 복사 함수에서 누락되어 설정 파일의
+    // opt-in(true)이 정규화 단계에서 소실됐다(#163 관찰 모드가 불활성이던
+    // 원인). strict 파서가 이미 미지 키를 거른 뒤라 통복사가 안전하다.
+    if (retry.resubmit !== undefined) {
+        out.resubmit = { ...retry.resubmit };
+    }
+    if (retry.dispatch_breaker !== undefined) {
+        out.dispatch_breaker = { ...retry.dispatch_breaker };
+    }
     return Object.keys(out).length > 0 ? out : undefined;
 }
 function definedReviewUnitExecutionSettings(unit) {
@@ -601,6 +769,10 @@ export function completeReviewRetrySettings(retry) {
             delta_completion: retry?.salvage?.delta_completion ??
                 DEFAULT_REVIEW_RETRY_SETTINGS.salvage.delta_completion,
         },
+        resubmit: {
+            enabled: retry?.resubmit?.enabled ?? DEFAULT_REVIEW_RETRY_SETTINGS.resubmit.enabled,
+        },
+        dispatch_breaker: completeDispatchBreakerSettings(retry?.dispatch_breaker),
     };
 }
 function v3ActorSettings(actor) {
@@ -610,22 +782,47 @@ function v3ActorSettings(actor) {
     };
 }
 function v3ReconstructActorSettings(actor) {
-    return { llm: actor.llm };
+    return {
+        llm: actor.llm,
+        ...(actor.llm_runtime !== undefined
+            ? { llm_runtime: actor.llm_runtime }
+            : {}),
+    };
 }
-function v3ReconstructSettings(reconstruct) {
-    const actors = reconstruct?.execution?.actors;
-    if (!actors)
+/**
+ * Normalizes the parsed V3 reconstruct block into the runtime shape.
+ * STRUCTURE-PRESERVING by construction (design §5.1): actor copies iterate
+ * RECONSTRUCT_ACTOR_KEYS and execution-level scalars iterate
+ * RECONSTRUCT_EXECUTION_SCALAR_KEYS — no hand-enumerated whitelist, and no
+ * actors-absent early return (a scalar-only block survives).
+ * Exported for the unit-level drift-guard tests, which call the copy
+ * functions directly (bypassing the strict parser) so a missed copy fails.
+ */
+export function v3ReconstructSettings(reconstruct) {
+    const execution = reconstruct?.execution;
+    if (!execution)
         return undefined;
     const normalizedActors = {};
-    if (actors.semantic_author) {
-        normalizedActors.semantic_author = v3ReconstructActorSettings(actors.semantic_author);
+    for (const key of RECONSTRUCT_ACTOR_KEYS) {
+        const actor = execution.actors?.[key];
+        if (actor)
+            normalizedActors[key] = v3ReconstructActorSettings(actor);
+    }
+    const out = {};
+    if (Object.keys(normalizedActors).length > 0)
+        out.actors = normalizedActors;
+    for (const key of RECONSTRUCT_EXECUTION_SCALAR_KEYS) {
+        const value = execution[key];
+        if (value !== undefined)
+            out[key] = value;
     }
-    if (actors.confirmation_provider) {
-        normalizedActors.confirmation_provider = v3ReconstructActorSettings(actors.confirmation_provider);
+    if (execution.dispatch_breaker !== undefined) {
+        out.dispatch_breaker = execution.dispatch_breaker;
     }
-    return Object.keys(normalizedActors).length > 0
-        ? { execution: { actors: normalizedActors } }
-        : undefined;
+    if (execution.dispatch_fallback !== undefined) {
+        out.dispatch_fallback = execution.dispatch_fallback;
+    }
+    return Object.keys(out).length > 0 ? { execution: out } : undefined;
 }
 function normalizeV3Settings(settings) {
     const execution = settings.review?.execution;
@@ -814,6 +1011,25 @@ function mergeReviewRetrySettings(userRetry, projectRetry) {
                 },
             }
             : {}),
+        // resubmit merges deep for the same reason as salvage.
+        ...(userRetry?.resubmit !== undefined || projectRetry?.resubmit !== undefined
+            ? {
+                resubmit: {
+                    ...(userRetry?.resubmit ?? {}),
+                    ...(projectRetry?.resubmit ?? {}),
+                },
+            }
+            : {}),
+        // dispatch_breaker merges deep for the same reason as salvage/resubmit.
+        ...(userRetry?.dispatch_breaker !== undefined ||
+            projectRetry?.dispatch_breaker !== undefined
+            ? {
+                dispatch_breaker: {
+                    ...(userRetry?.dispatch_breaker ?? {}),
+                    ...(projectRetry?.dispatch_breaker ?? {}),
+                },
+            }
+            : {}),
     };
     return completeReviewRetrySettings(merged);
 }
@@ -872,15 +1088,44 @@ function mergeReviewUnits(defaultUnits, userUnits, projectUnits) {
 function mergeReconstructActorSettings(userActor, projectActor) {
     return projectActor ?? userActor;
 }
-function mergeReconstructSettings(user, project) {
-    const semanticAuthor = mergeReconstructActorSettings(user?.execution?.actors?.semantic_author, project?.execution?.actors?.semantic_author);
-    const confirmationProvider = mergeReconstructActorSettings(user?.execution?.actors?.confirmation_provider, project?.execution?.actors?.confirmation_provider);
+/**
+ * user+project merge of the reconstruct block. STRUCTURE-PRESERVING by
+ * construction (design §5.1): per-actor merge iterates RECONSTRUCT_ACTOR_KEYS
+ * (project > user per actor), execution-level scalars iterate
+ * RECONSTRUCT_EXECUTION_SCALAR_KEYS (project > user) and survive even when no
+ * actors are configured on either side. Exported for the unit-level
+ * drift-guard tests (direct calls, strict parser bypassed).
+ */
+export function mergeReconstructSettings(user, project) {
     const actors = {};
-    if (semanticAuthor)
-        actors.semantic_author = semanticAuthor;
-    if (confirmationProvider)
-        actors.confirmation_provider = confirmationProvider;
-    return Object.keys(actors).length > 0 ? { execution: { actors } } : undefined;
+    for (const key of RECONSTRUCT_ACTOR_KEYS) {
+        const merged = mergeReconstructActorSettings(user?.execution?.actors?.[key], project?.execution?.actors?.[key]);
+        if (merged)
+            actors[key] = merged;
+    }
+    const out = {};
+    if (Object.keys(actors).length > 0)
+        out.actors = actors;
+    for (const key of RECONSTRUCT_EXECUTION_SCALAR_KEYS) {
+        const value = project?.execution?.[key] ?? user?.execution?.[key];
+        if (value !== undefined)
+            out[key] = value;
+    }
+    // dispatch_breaker merges deep (salvage/resubmit precedent): a project
+    // layer that partially sets it must not clobber an inherited user opt-in.
+    const dispatchBreaker = user?.execution?.dispatch_breaker !== undefined ||
+        project?.execution?.dispatch_breaker !== undefined
+        ? {
+            ...(user?.execution?.dispatch_breaker ?? {}),
+            ...(project?.execution?.dispatch_breaker ?? {}),
+        }
+        : undefined;
+    if (dispatchBreaker !== undefined)
+        out.dispatch_breaker = dispatchBreaker;
+    const dispatchFallback = project?.execution?.dispatch_fallback ?? user?.execution?.dispatch_fallback;
+    if (dispatchFallback !== undefined)
+        out.dispatch_fallback = dispatchFallback;
+    return Object.keys(out).length > 0 ? { execution: out } : undefined;
 }
 function contextFromSettings(settings) {
     return definedReviewContext({
@@ -969,7 +1214,7 @@ function unitDefaultActorForSettingsValidation(unitId) {
  * the membership check fails loud on it.
  */
 export function collectEffectiveModelRoutes(settings) {
-    const nodes = collectModelSelections(settings);
+    const nodes = collectSupportedModelDispatches(settings);
     const providerAtPath = new Map();
     const modelAtPath = new Map();
     for (const node of nodes) {
@@ -1001,12 +1246,23 @@ export function collectEffectiveModelRoutes(settings) {
     // is disabled the model never runs, so validating it would be a false positive
     // that could block G7 or a live run on an unused setting.
     const salvageEnabled = settings.review?.execution?.retry?.salvage?.enabled === true;
+    // The synthesize seat dispatches only when semantic-map authoring is opted
+    // in (the capability pair is attached solely under the opt-in). A dormant
+    // seat (configured, opt-in off) never dispatches, so validating it would
+    // block every live run on an unused setting — same dispatch-conditioned
+    // exemption as salvage (design §5.1-7, U6 owner decision). Flipping the
+    // opt-in on brings the seat into the walk and fails loud then.
+    const semanticMapAuthoringEnabled = isReconstructSemanticMapAuthoringEnabled(settings);
+    const SYNTHESIZE_SEAT_PATH = "reconstruct.execution.actors.semantic_map_synthesize.llm";
     return nodes.flatMap((node) => {
         if (isSalvageTranscription(node.path)) {
             if (!salvageEnabled)
                 return []; // disabled salvage transcription never dispatches
             return [{ ...node, provider: node.provider ?? DEFAULT_TRANSCRIPTION_PROVIDER }];
         }
+        if (node.path === SYNTHESIZE_SEAT_PATH && !semanticMapAuthoringEnabled) {
+            return []; // dormant synthesize seat never dispatches (opt-in off)
+        }
         const unitId = reviewUnitOf(node.path);
         if (unitId) {
             // A review-unit override merges over its default actor llm
@@ -1017,6 +1273,7 @@ export function collectEffectiveModelRoutes(settings) {
                     provider: node.provider ?? providerAtPath.get(actorPath),
                     model: node.model ?? modelAtPath.get(actorPath),
                     path: node.path,
+                    requiredRole: node.requiredRole,
                 }];
         }
         // Actors, reconstruct actors, and the top-level llm are base seats: validated
@@ -1037,9 +1294,9 @@ export function collectEffectiveModelRoutes(settings) {
  * disagree. Mock/test paths that resolve settings without making real calls
  * never invoke it.
  */
-export function assertSettingsModelsSupported(settings) {
+export function assertSettingsModelsSupported(settings, options) {
     try {
-        assertSupportedModelRoutes(collectEffectiveModelRoutes(settings), loadSupportedModelRegistry());
+        assertSupportedModelRoutes(collectEffectiveModelRoutes(settings), loadSupportedModelRegistry(), options);
     }
     catch (error) {
         if (error instanceof OntoSettingsValidationError)
@@ -1163,6 +1420,8 @@ export function defaultReviewRetrySettings() {
     return {
         ...DEFAULT_REVIEW_RETRY_SETTINGS,
         salvage: { ...DEFAULT_REVIEW_RETRY_SETTINGS.salvage },
+        resubmit: { ...DEFAULT_REVIEW_RETRY_SETTINGS.resubmit },
+        dispatch_breaker: { ...DEFAULT_REVIEW_RETRY_SETTINGS.dispatch_breaker },
     };
 }
 function validateActorLlmRefs(settings) {