onto-mcp 0.4.12 → 0.4.13

package/.onto/processes/reconstruct/reconstruct-contract-registry.yaml

@@ -67,11 +67,11 @@ source_profile_records:
     target_material_kind: spreadsheet
     is_default_for_kind: true
     definition_ref: .onto/processes/reconstruct/source-profiles/spreadsheet.md
-    definition_sha256: 35fa949f3fc680b52f3e8ff78eeb9754b86d068e6b20dca51f4107ba881b868f
+    definition_sha256: 6b543ab5621ef169312c1632fa6e446950a72621a974c29130695039cea7b51b
     contract_status: active
-    runtime_implementation_status: planned
+    runtime_implementation_status: partially_wired
     schema_version: 1
-    profile_version: 2
+    profile_version: 3
     migration_status: current
     supersedes: []
     replaced_by: []
@@ -872,6 +872,11 @@ artifact_authorities:
   reconstruct_run_control_validation:
     authority_ref: reconstruct-run-control-validation.yaml
     validation_ref: null
+  llm_dispatch_failures:
+    authority_ref: llm-dispatch-failures/*.yaml
+    validation_ref: reconstruct-run-control-validation.yaml
+    registry_ref: src/core-runtime/reconstruct/llm-dispatch-failure.ts
+    projection_policy: runtime_owned_provider_incomplete_evidence_projected_only_through_bounded_failed_status
   reconstruct_run_control_pre_publication_validation:
     authority_ref: reconstruct-run-control.pre-publication-validation.yaml
     validation_ref: null
@@ -900,10 +905,40 @@ artifact_authorities:
   source_observations:
     authority_ref: source-observations.yaml
     validation_ref: source-observation-directive-validation.yaml
+  seed_stage_prompt_source_observations:
+    authority_ref: seed-stage-prompt-source-observations.yaml
+    validation_ref: null
+    projection_policy: pre_maturation_seed_stage_projected_observation_snapshot_for_resume_truncation_conservation
+  dispatch_incomplete:
+    authority_ref: dispatch-incomplete.yaml
+    validation_ref: semantic-map-resume-validation.yaml
+    projection_policy: full_batch_dispatch_partition_for_stage_local_semantic_map_recovery
+  semantic_map_census:
+    authority_ref: comprehension/semantic-map-census.yaml
+    validation_ref: null
+    projection_policy: semantic_map_observation_partition_and_spend_census
+  semantic_map_sidecar:
+    authority_ref: comprehension/semantic-map.yaml
+    validation_ref: null
+    projection_policy: semantic_map_projection_sidecar_for_map_present_observations
+  semantic_map_resume_validation:
+    authority_ref: semantic-map-resume-validation.yaml
+    validation_ref: null
+    projection_policy: runtime_owned_validation_of_same_batch_semantic_map_recovery_frontier
+  dispatch_fallback_activation:
+    authority_ref: dispatch-fallback-activation.yaml
+    validation_ref: null
+    registry_ref: src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts
+    projection_policy: create_once_lineage_claim_for_originating_initial_semantic_map_rate_limit_fallback
+  dispatch_fallback_outcome:
+    authority_ref: dispatch-fallback-outcome.yaml
+    validation_ref: null
+    registry_ref: src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts
+    projection_policy: terminal_commit_marker_for_one_same_call_exact_incomplete_fallback_pass
   source_safety_ledger:
     authority_ref: source-safety-ledger.yaml
     validation_ref: source-safety-ledger-validation.yaml
-    projection_policy: six_axis_source_safety_and_derived_visibility_by_observation_id_and_intended_consumption
+    projection_policy: four_axis_source_safety_and_derived_visibility_by_observation_id_and_intended_consumption
   source_safety_ledger_validation:
     authority_ref: source-safety-ledger-validation.yaml
     validation_ref: null
@@ -1273,6 +1308,9 @@ validation_gate_catalog:
   - gate_id: source_scout_pack_post_maturation_gate
     validation_artifact_ref: source-scout-pack-validation.post-maturation.yaml
     required_when: source_scout_pack_post_maturation_snapshot_exists
+  - gate_id: semantic_map_resume_gate
+    validation_artifact_ref: semantic-map-resume-validation.yaml
+    required_when: semantic_map_resume_validation_exists
   - gate_id: source_purpose_candidates_gate
     validation_artifact_ref: source-purpose-candidates-validation.yaml
     required_when: seed_validity_or_seed_iteration_readiness_is_projected
@@ -1443,6 +1481,11 @@ required_when_predicate_catalog:
     truth_expression: "artifact_exists(source-scout-pack.post-maturation.yaml)"
     unknown_projection: blocked
     explanation_template: "An immutable post-maturation SourceScoutPack snapshot exists and requires snapshot-scoped validation before post-maturation audit or replay use."
+  - predicate_id: semantic_map_resume_validation_exists
+    input_authority_refs: [semantic-map-resume-validation.yaml]
+    truth_expression: "artifact_exists(semantic-map-resume-validation.yaml)"
+    unknown_projection: blocked
+    explanation_template: "A semantic-map resume validation artifact exists and must be valid before handoff consumption."
   - predicate_id: source_frontier_observation_delta
     gate_instance_scope: per_round
     input_authority_refs: [rounds/<round-id>/source-observation-delta.yaml]
@@ -1979,6 +2022,16 @@ readiness_projection:
   conflict_rule: When supporting artifacts project different canonical values, choose the first value in strictness_order_high_to_low that appears among contributing artifacts; lower list index is stricter and wins. Cite every contributing artifact.
 
 validator_records:
+  - validator_id: semantic-map-resume-validator
+    gate_ids: [semantic_map_resume_gate]
+    validator_version: 1
+    input_authority_refs:
+      - dispatch-incomplete.yaml
+      - comprehension/semantic-map-census.yaml
+      - comprehension/semantic-map.yaml
+      - source-observations.yaml
+    validation_obligations: []
+    output_ref: semantic-map-resume-validation.yaml
   - validator_id: reconstruct-run-control-validator
     gate_ids: [reconstruct_run_control_gate]
     validator_version: 1
@@ -2097,10 +2150,9 @@ validator_records:
       - source-observations.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
-      - validate_exactly_six_canonical_source_safety_axes
+      - validate_exactly_four_canonical_source_safety_axes
       - validate_every_observation_has_source_safety_rows_for_each_intended_consumption
       - validate_visibility_tier_is_derived_not_independent_authority
-      - fail_when_nested_redaction_evidence_contradicts_top_level_axis_state
       - validate_source_safety_subject_refs_against_observed_source_refs
       - preserve_prompt_context_evidence_support_public_output_replay_and_material_claim_consumption_boundaries
     output_ref: source-safety-ledger-validation.yaml
@@ -2527,7 +2579,7 @@ validator_records:
   - validator_id: revision-proposal-validator
     gate_ids: [revision_proposal_gate]
     validator_version: 1
-    input_authority_refs: [revision-proposal.yaml, failure-classification.yaml, failure-classification-validation.yaml, reconstruct-contract-registry.yaml]
+    input_authority_refs: [revision-proposal.yaml, failure-classification.yaml, failure-classification-validation.yaml, ontology-seed.yaml, reconstruct-contract-registry.yaml]
     output_ref: revision-proposal-validation.yaml
   - validator_id: maturation-baseline-validator
     gate_ids: [maturation_baseline_gate]
@@ -2564,6 +2616,7 @@ validator_records:
       - reject_matrix_rows_without_baseline_row_ref
       - validate_matrix_row_ids_are_stable_and_baseline_row_refs_close
       - preserve_frontier_seed_state_before_question_frontier_authoring
+      - reject_blocking_question_refs_before_question_frontier_authoring
     output_ref: baseline-actionability-matrix-validation.yaml
   - validator_id: actionability-matrix-validator
     gate_ids: [actionability_matrix_gate]
@@ -2575,6 +2628,8 @@ validator_records:
       - maturation-answer-claims-validation.yaml
       - ontology-expansion.yaml
       - ontology-expansion-validation.yaml
+      - maturation-question-frontier.yaml
+      - maturation-question-frontier-validation.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
       - support_zero_delta_baseline_only_matrix_when_no_maturation_deltas_exist
@@ -2583,6 +2638,7 @@ validator_records:
       - validate_matrix_row_ids_are_stable_and_baseline_row_refs_close
       - validate_maturity_level_against_supporting_refs_blocking_questions_and_limitations
       - require_blocker_and_high_rows_to_be_l4_limitation_backed_or_continuation_blocking
+      - validate_blocking_question_refs_against_validated_question_frontier
     output_ref: actionability-matrix-validation.yaml
   - validator_id: maturation-question-frontier-validator
     gate_ids: [maturation_question_frontier_gate]
@@ -2670,7 +2726,7 @@ validator_records:
     output_ref: answer-support-ledger-validation.yaml
   - validator_id: maturation-answer-claims-validator
     gate_ids: [maturation_answer_claim_gate]
-    validator_version: 1
+    validator_version: 2
     input_authority_refs:
       - maturation-answer-claims.yaml
       - answer-support-ledger-validation.yaml
@@ -2756,6 +2812,8 @@ validator_records:
       - maturation-authority-response-validation.yaml
       - ontology-expansion-validation.yaml
       - maturation-convergence-ledger-validation.yaml
+      - revision-proposal.yaml
+      - revision-proposal-validation.yaml
       - reconstruct-contract-registry.yaml
     validation_obligations:
       - validate_continuation_state_against_validated_actionability_matrix_and_frontier_state
@@ -2763,6 +2821,10 @@ validator_records:
       - validate_continue_ask_user_or_blocked_state_against_available_next_authority
       - validate_limitation_refs_and_row_scope_for_actionable_limited_state
       - reject_actionable_ready_until_final_requestion_convergence_is_proven
+      - validate_revision_blocker_limitation_refs_against_validated_revision_proposal
+      - require_revision_blocker_refs_in_continuation_limitation_refs
+      - reject_actionable_ready_when_unresolved_revision_blockers_remain
+      - bind_revision_proposal_validation_to_consumed_revision_proposal
     output_ref: maturation-continuation-decision-validation.yaml
   - validator_id: actionable-ontology-validator
     gate_ids: [actionable_ontology_gate]
@@ -3188,3 +3250,102 @@ version_policy:
     - query access contract registry changes
     - readiness projection changes
     - validator record changes
+
+# G(b) prompt-projection field-parity (INV-SCHEMA-1). Declares the EXACT field/budget
+# surface of each governed runtime prompt projection so a registry-shape drift (a field or
+# budget added or dropped in the runtime contract without a registry home, or vice versa) is
+# caught in CI. Runtime SSOT for the competency-question assessment contract is
+# src/core-runtime/reconstruct/competency-projection-contract.ts; the parity guard
+# scripts/check-prompt-projection-parity.ts asserts this node equals that module's contract
+# surface (exact-set on payload_fields/policy_fields, exact-value on budget_fields) and that
+# run.ts consumes the extracted module rather than a duplicated local copy. Every element
+# declared here is guard-checked (no unguarded declared data).
+prompt_projection_contracts:
+  competency_question_assessment:
+    # Top-level keys of competencyQuestionAssessmentProjectionContract().
+    payload_fields:
+      - projection_kind
+      - projection_contract_version
+      - semantic_authority
+      - prompt_char_limit
+      - question_projection
+      - evidence_projection
+      - source_evidence_projection
+      - source_evidence_excerpt_char_limit
+      - source_evidence_reserve_derivation
+      - validation_projection
+      - claim_realization_projection
+      - runtime_derivations
+      - batching_policy
+      - fail_loud_policy
+    # Keys of the nested batching_policy object.
+    policy_fields:
+      - mode
+      - order
+      - build_budget_reserve_chars
+      - single_question_overflow
+    # The named budget constants the contract OUTPUT embeds (NOT the internal
+    # EVIDENCE_CANDIDATE_LIMIT runaway guard, which never enters the contract surface).
+    budget_fields:
+      prompt_char_limit: 50000
+      source_evidence_excerpt_char_limit: 4000
+      build_budget_reserve_chars: 1000
+
+# G(c) final-output append-section parity (INV-SCHEMA-1). Declares the canonical identity of
+# every section the reconstruct final output emits — section_id (hyphen; also the load-bearing
+# required_fragments text), heading (the provenance gate's match key), prompt_policy_id (the
+# underscore id in deterministic_runtime_append_sections; null for conditional sections),
+# emit_owner (emission surface: always_section vs conditional_markdown — distinct from the
+# binding flag), provenance_binding_required (whether the final-output provenance gate checks
+# it), and activation. Runtime SSOT is src/core-runtime/reconstruct/final-output-sections.ts;
+# the parity guard scripts/check-final-output-sections-parity.ts (G9) asserts this node equals
+# that module exactly and that run.ts consumes the module rather than inline heading literals.
+final_output_append_sections:
+  - section_id: seed-answerability
+    heading: Seed Answerability
+    prompt_policy_id: seed_answerability
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: artifact-truth
+    heading: Artifact Truth
+    prompt_policy_id: artifact_truth
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: claim-projection
+    heading: Claim Projection
+    prompt_policy_id: claim_projection
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: runtime-artifact-truth-footer
+    heading: Runtime Artifact Truth Footer
+    prompt_policy_id: provenance_footer
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: runtime-provenance-bindings
+    heading: Runtime Provenance Bindings
+    prompt_policy_id: provenance_bindings
+    emit_owner: always_section
+    provenance_binding_required: true
+    activation: always
+  - section_id: source-projection-truncation
+    heading: Source Projection Truncation
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: document_projection_truncation_nonempty
+  - section_id: workbook-inventory-projection-truncation
+    heading: Workbook Inventory Projection Truncation
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: workbook_inventory_projection_truncation_nonempty
+  - section_id: unresolved-revision-proposals
+    heading: Unresolved Revision Proposals
+    prompt_policy_id: null
+    emit_owner: conditional_markdown
+    provenance_binding_required: false
+    activation: disclosed_revision_proposals_nonempty

package/.onto/processes/reconstruct/reconstruct-execution-ux-contract.md

@@ -161,9 +161,78 @@ If a run halts, the output should still be useful:
 
 A halted run may provide candidate Seed content only if the corresponding
 artifact and validation refs exist. It may not imply seed confirmation, CQ
-  assessment, failure classification, revision proposal, terminal seed iteration readiness, or
+assessment, failure classification, revision proposal, terminal seed iteration readiness, or
 final ontology direction unless those artifacts exist.
 
+### 6.1 Provider output-ceiling failure
+
+When an OpenAI Responses direct-API semantic-author call ends with
+`incomplete_details.reason=max_output_tokens`, the runtime does not parse,
+repair, continue, or accept the partial output. It persists the provider evidence
+under `llm-dispatch-failures/*.yaml`, links that source artifact to the owning
+attempt through a committed run-control transaction, marks the attempt `failed`,
+and releases the session lock.
+
+The headroom route is pinned to the public OpenAI Responses endpoint. A custom
+actor `base_url` is rejected before dispatch, and ambient `OPENAI_BASE_URL` does
+not redirect this route. Failure publication is serialized with every other
+run-control mutation. It writes and fsyncs a scratch file, atomically promotes
+it to a hash-prefixed pending file, records the prepared transaction, publishes
+the canonical sidecar, and commits the transaction/failed attempt/released lock.
+A valid untracked pending file may be adopted only when its bytes, hash-prefix,
+session, attempt, and held owner lock all match. Scratch, malformed, truncated,
+ambiguous, wrong-prefix, wrong-owner, or wrong-hash remnants abandon the current
+attempt, release its lock, and require `blocked_partial_write` recovery.
+
+`onto_reconstruct`, `onto_reconstruct_read`, the compatibility status/result
+tools, and the Core API must return a record-less discriminated branch when the
+run-control validator trusts the latest failed terminal. A latest trusted failed
+attempt supersedes an older non-terminal preparation record. The branch has
+`status: failed`, `reconstructRecord: null`, run-control and validation refs, the
+failure artifact ref, stage progress, and a bounded failure summary. The summary
+may expose the stable failure code, stage/artifact identity, provider status and
+incomplete reason, base/headroom/effective output caps, provider token counts,
+and request-count observability. Provider request/response ids, endpoint, and
+partial-output hash remain source-artifact-only fields; raw partial output is not
+persisted.
+
+Failed progress does not infer semantic counts from the existence of a sidecar:
+`failureCount` is `null`. Run-control and run-control-validation are completed
+control stages. The failed semantic stage is halted. Other stages are completed
+only when a committed transaction owned by the latest failed attempt still
+matches the current regular-file bytes inside the real session root; otherwise
+they remain pending. `reusableArtifactRefs` contains only that same bounded,
+hash-verified latest-owner set, excludes the failure sidecar, and may be empty.
+
+### 6.2 Semantic-map provider fallback
+
+`reconstruct.execution.dispatch_fallback` is an explicit default-off capability
+for the spreadsheet semantic-map stage. It may activate only in the originating
+fresh initial attempt after a sealed direct SDK route supplies structured
+rate-limit evidence and the current attempt still owns the held session lock.
+Arbitrary diagnostic text is not trigger evidence.
+
+An activated run writes the direct-child
+`dispatch-fallback-activation.yaml` claim before alternate-provider work. It
+then reuses the existing semantic-map stage for exactly the persisted incomplete
+observation set, with one fallback pass and one physical SDK request per logical
+dispatch. Retained primary observations are not sent again.
+
+`dispatch-fallback-outcome.yaml` is the terminal commit marker after the final
+`dispatch-incomplete.yaml`, semantic-map census, and semantic-map sidecar have
+been securely published and indexed in run control. A completed outcome is
+projected into the completed reconstruct record and semantic-map manifest step.
+A halted outcome is disclosed through the current breaker error and does not
+create a completed record or manifest. Any session lineage with an activation,
+including a crash between activation and outcome, requires a new session for a
+later entry. A `running` attempt with a `held` session lock cannot be taken over
+based on `lease_expires_at` alone.
+
+The TypeScript schema, validators, path constructors, secure publishers, and
+record projection for both artifacts are owned by
+`src/core-runtime/reconstruct/dispatch-fallback-artifacts.ts`; prose and the
+contract registry do not duplicate their machine schema.
+
 ## 7. Runtime Payload Expectations
 
 Future status/result payloads should expose enough facts for the host LLM to
@@ -175,6 +244,8 @@ render this contract without scraping prose:
 - stage state: pending, running, completed, skipped, or halted
 - skipped/deferred stage reason and `authority_impact`
 - stage artifact refs and owner
+- record-less trusted provider failure status, bounded failure summary, and
+  failure/run-control refs
 - liveness state and recommended polling interval
 - deterministic count summaries from the latest completed artifacts
 - latest source frontier summary and reusable trusted observation refs

package/.onto/processes/reconstruct/source-profiles/spreadsheet.md

@@ -30,6 +30,10 @@ Workbook, sheet, named range, table, or used range.
 - named ranges
 - hidden rows and columns
 - macros or VBA presence
+- protected ranges and sheet protection
+- filters and auto-filter state
+- charts, images, and object anchors
+- external links and data connections to other workbooks or sources
 
 ## Correct Observation Examples
 
@@ -47,6 +51,18 @@ Workbook, sheet, named range, table, or used range.
 
 > The formula is a cost-recognition policy.
 
+> The `#REF!` in `B2` is a bug caused by a deleted column.
+
+> The date in `C5` is stored as text, so it is wrong.
+
+## Static Inspection Boundary
+
+Static structural inspection reveals how formulas and structure were written, but
+it cannot prove computed results. Record an observed formula or value as structure
+inspected only; do not assert that a formula's output is correct unless an engine
+recalculated it. Note unresolved external data, links, or connections as
+unresolved rather than assuming their current values.
+
 ## Detail Location Format
 
 ```text
@@ -93,6 +109,19 @@ outside this list, record it in the `PurposeAdequacyFrame` with evidence and
 promote it to this profile only after repeated real-source runs justify the
 refinement.
 
+## Large Workbook Inspection Strategy
+
+Inspect structure before converting the workbook to another format. Do not flatten
+a workbook into a single table or dataframe before checking whether structure --
+formulas, merged ranges, named ranges, and cross-sheet references -- carries
+meaning.
+
+For large workbooks, prefer narrow, targeted reads around the relevant ranges over
+loading every sheet in full. Read the workbook's own structural index first -- the
+sheet list, per-sheet dimensions, named ranges, and table definitions -- and use a
+read-only or streaming inspection path so the used range and formula cells can be
+observed without materializing the entire workbook.
+
 ## Scan Targets
 
 - sheet list and used range per sheet
@@ -104,3 +133,9 @@ refinement.
 - data validation rules
 - macro/VBA presence
 - external data connections
+- protected ranges and sheet protection
+- filters and auto-filter state
+- charts, images, and object anchors
+- external links to other workbooks
+- formula-error cells, recorded as literal tokens such as `#REF!`, `#N/A`, or `#VALUE!`
+- structural-risk signals recorded literally and without diagnosis: cross-sheet references whose target sheet or range is absent, dates stored as text, empty cells inside a calculation chain, and lookup keys whose stored type differs from the target column

package/.onto/processes/review/productized-live-path.md

@@ -198,17 +198,21 @@ canonical requirement:
 현재 repo-local TS bounded path에서 실행 가능한 `ReviewExecutionProfile` mode는 아래다.
 
 - `main-workers`: main이 teamlead 역할을 수행하고 worker가 lens를 실행한다.
+- `nested-workers`: external OAuth worker executor(`codex` 또는 `claude_code`)가
+  outer seat에서 ready unit batch를 fan-out하고, 각 inner unit은 flat 경로와
+  동일한 unit-executor CLI/seat/검증 계약을 따른다. `direct_call` executor와
+  조합되면 outer worker seat가 없으므로 fail-closed한다.
 - `synthesize.llm`: deliberation 이후 별도 synthesize unit에 적용된다. synthesize는 모든 lens output, issue artifacts, deliberation, problem framing을 통합하므로 높은 effort가 기본적으로 적합하다.
 
-`nested-workers`는 concept/profile shape로 남아 있지만 현재 active live path에서는
-pre-dispatch에서 fail-loud한다. 기존 nested bridge가 sidecar structured output,
-read-only lens execution, settings-owned bounded dispatch를 강제하지 못하기 때문이다.
-이 mode는 inner lens 실행이 동일한 structured runner 계약을 따를 때만 다시 실행
-가능한 경로가 될 수 있다.
+`nested-workers`의 canonical 계약은 `nesting-batch-worker-contract.md`가 소유한다.
+과거 raw provider-CLI inner bridge는 retired 경로이며, 현재 runtime path는
+sidecar structured output, read-only unit execution, settings-owned bounded dispatch를
+동일 unit executor 공유로 보존한다.
 
 worker executor는 profile resolution에서 아래 중 하나로 고정된다.
 
 - `codex`: host-bound OAuth 또는 Codex worker path.
+- `claude_code`: host-bound Claude Code worker path.
 - `direct_call`: `api_key` 또는 `local` provider path.
 
 중요한 점은 host-specific naming이 아니라:

package/.onto/processes/review/prompt-execution-runner-contract.md

@@ -60,7 +60,7 @@ runtime은 아래만 한다.
    - `prompt-packets/synthesis/{issue_id}.prompt.md`
 9. executor realization
    - `worker`
-   - `direct-call`
+   - `direct_call`
 10. host runtime
    - `codex`
    - `openai`
@@ -108,6 +108,9 @@ runtime은 아래만 한다.
 9. `execution-result.yaml`
 10. `review-run-manifest.yaml`
 11. `error-log.md`
+12. `dispatch-incomplete.yaml` — dispatch breaker가 켜진 배치(lens/issue-stance)의
+    end state (완료/dead-letter/미완료 집합). 트립이든 완주든 기록하며, OFF에서는
+    쓰지 않는다
 
 원칙:
 
@@ -121,6 +124,22 @@ runtime은 아래만 한다.
 - `execution-result.yaml`은 actual execution truth의 canonical seat다
 - `execution-result.yaml`과 `review-run-manifest.yaml`은 effective retry policy를 기록해야 한다
 - `lens-completion-barrier.yaml`은 downstream stage 진입 gate다
+- `review.execution.retry.dispatch_breaker`(opt-in)가 켜지면 lens/issue-stance
+  fan-out 풀의 **flat per-unit 루프**는 유닛의 최종 outcome을 계통 실패 분류
+  (rate_limit/auth/transport)로 관찰하고, 서로 다른 유닛에 걸친 연속 계통 실패가
+  임계에 닿으면 잔여 유닛을 디스패치하지 않고 halt한다 (`halt_reason` prefix
+  `dispatch_breaker:`, lens 풀은 `halt_phase=lens_dispatch_breaker`). 미완료
+  집합은 `dispatch-incomplete.yaml`이 회복 계약(재디스패치 집합 == 미완료 집합)
+  으로 영속하며, 트립 halt의 execution-result는 완료 유닛 행을 보존한다.
+  nested-workers 1차 배치가 실행된 스테이지도 breaker가 적용된다(§4-1): 배치-창
+  SUCCESS는 실 디스패치가 아니므로 완료로만 집계돼 계통 streak을 리셋하지 않고,
+  배치-창 FAILURE는 flat 경로처럼 실패로 분류된다(item-local→dead-letter, 계통→
+  회복 미완료 집합). 배치-실패 유닛의 flat 재시도가 계통 실패를 직접 관찰·구동
+  한다. lens/issue-stance 풀의 실제 dispatch width가 2 이상이면 runner가
+  breaker policy를 내부적으로 `concurrent:true`로 투영해 완료순서가 poison-vs-outage
+  회복 집합을 결정하지 못하게 한다. 이 값은 사용자 설정 키가 아니라 runtime-owned
+  execution projection이다. OFF(기본)는 현행 halt/배리어 동작이며 nested 경로도
+  무변경이다
 - degraded case / partial failure는 `error-log.md`에 기록해야 한다
 - runtime unavailable completion으로 root unit이 completed가 된 경우에도 원 실패는 child unit result로 보존하고 degradation evidence에 포함해야 한다
 - `error-log.md`는 최소 한 번 `EffectiveBoundaryState`를 기록해야 한다
@@ -168,13 +187,18 @@ evidence로 쓰지 않는다.
 
 현재 구현에서 prompt execution runner를 통해 실행되는 execution profile:
 
-- `worker + codex` (Codex CLI 경로)
-- `worker + direct-call` (API/local provider 경로)
-
-`nested-workers` mode는 현재 runner에서 pre-dispatch structured failure로
-차단한다. inner lens worker가 runtime submit-tool serialization,
-read-only sandbox, `execution-plan.max_concurrent_lenses` 기반 bounded dispatch를
-같은 방식으로 보장하기 전에는 active product path가 아니다.
+- `main-workers + codex|claude_code` (Codex CLI 또는 Claude Code CLI 경로)
+- `main-workers + direct_call` (API/local provider 경로)
+- `nested-workers + codex|claude_code` (outer OAuth worker가 ready unit batch를
+  fan-out하고, inner unit은 flat 경로와 동일한 unit-executor CLI/seat/검증 계약을
+  따른다)
+
+`nested-workers + direct_call`은 outer worker seat가 없으므로
+`nested_workers_executor_unsupported` structured failure로 fail-closed한다. raw
+provider-CLI inner bridge는 retired 경로이며, active nested path의 계약은
+`nesting-batch-worker-contract.md`가 소유한다. mock-backed nested harness는 wiring,
+schema, artifact contract, route/failure 검증 evidence이며 product semantic
+completion 또는 semantic quality evidence로 승격하지 않는다.
 
 원칙:
 

package/.onto/processes/review/review-target-profile-contract.md

@@ -93,8 +93,8 @@ material_profile:
   target_material_kind: code
   target_material_kind_candidates:
     - code
-  support_status: partial
-  unsupported_reason: review records target material kind, but material-specific validation is not implemented yet
+  support_status: supported
+  unsupported_reason: null
   detection:
     owner: runtime_heuristic
     confidence: 0.92
@@ -157,8 +157,51 @@ This axis must stay separate from:
 - `medium`: a cross-product reference and learning frame
 
 The current runtime records material kind and detection confidence as a bounded
-heuristic. It must not claim material-specific validation until per-material
-validators or adapters are implemented.
+heuristic. Per-material review handling is implemented for **spreadsheet** through a
+**single per-ref disposition** (`computeSpreadsheetDisposition`, the SSOT): every
+spreadsheet honesty surface — `support_status`, `target_refs[].inspectable`/`.sha256`,
+the `review_goal` obligations, the prompt `material_kind_obligations`, and the render
+notes — **projects from one record computed once over the shared observation**, instead
+of each surface re-deriving its claim from a different proxy. The structural inventory is
+rendered into `materialized-input.md` with detail (formula text, named-range references,
+data-validation rules incl. operator + formula bounds, protections, risk signals) —
+**structure inspected only, not recalculated**.
+
+Two distinct axes, deliberately not coupled:
+
+- **`inspectable`** — the workbook was read (`unsupported_reason === null`) AND has
+  renderable structure, *including plain tabular data* (columns / per-column cardinality /
+  distinct-value counts). The aggregate-only rule is NARROWED, not preserved: the single
+  value-bearing field is `data_validations[].members` — bounded DECLARED type=list enum labels
+  parsed from a formula1 literal (never observed/free/high-cardinality cell values).
+  A clean CSV or a formula-free data `.xlsx` is `inspectable` and stays
+  `support_status: supported`. It is NOT coupled to whether any obligation is backed.
+- **`backed_goals`** — the POSITIVE subset of the six obligations whose specific evidence
+  exists in that ref's inventory; this drives `review_goal`. `review_goal` therefore
+  carries **only the backed subset, not always all six**: a plain-data CSV backs none
+  (and so carries no spreadsheet obligation while remaining `supported`); a macro-only or
+  protection-only workbook backs only `access_and_protection_hygiene`. `structural_risk_signals`
+  is backed by genuine structural risk only — `unreadable_sheet_part` (an observation-failure
+  marker) and the `macro_present` / `external_links_present` signals (owned by other goals)
+  do not back it.
+
+`support_status` runs the gate over the **union of resolved and materialized** spreadsheet
+refs the prompt renders — **regardless of the resolved material kind**, so a `code`-resolved
+target carrying a materialized workbook the observer could not read degrades to `partial`
+(it is not gated only when the resolved kind is spreadsheet). If **any** rendered spreadsheet
+ref is uninspectable the target is `partial`, with a reason naming each uninspected ref by
+its full resolved path and actual cause; obligations are dropped only when **no** ref is
+inspectable. A `supported`/`null` profile is never emitted for a workbook the render shows as
+`unsupported`. The render emits obligation-backing detail **before** the per-sheet bodies so
+the prompt embed cut cannot strip an obligation's evidence, and protected/hidden sheets beyond
+the render cap are disclosed by count. Observation bounds the number of sheets read
+(`max_sheets_observed`, conservatively high) and a CSV/workbook whose decode or parse throws
+degrades to an honest `unsupported` inventory rather than aborting review prep.
+
+`code`, `document`, `database`, and `unknown` retain their prior support states
+until their per-material review adapters land. A spreadsheet inside a `mixed`
+bundle does not yet receive spreadsheet obligations (a known limitation,
+consistent with the `mixed` support state).
 
 ---
 

package/.onto/processes/shared/pipeline-execution-ledger-contract.md

@@ -81,6 +81,7 @@ interface PipelineExecutionLedgerUnitEntry {
   lastFailureMessage: string | null;
   upstreamUnitIds: string[];
   downstreamUnitIds: string[];
+  resolution?: "demoted";
   executionTelemetry?: PipelineUnitExecutionTelemetry | null;
 }
 
@@ -170,6 +171,16 @@ Execution telemetry rules:
   competency-question assessment) so batching changes stay attributable.
 - Units that made no LLM call carry no telemetry field; absence is not a
   failure signal.
+- `resolution: "demoted"` marks terminal resolution outside the trusted-output
+  path (bounded resubmit exhausted, complete-with-failure): the downstream
+  stage product consumed and disclosed the gap (review: issue-stance-matrix
+  `validation.missing_stances`), so the unit owes no further dispatch — it
+  must not reappear on the frontier, block convergence, or block downstream
+  upstream-trust. `status`/`lastFailureMessage` keep the audit truth
+  (typically `failed`); a resolved unit contributes no preserved artifacts.
+  Frontier/convergence consumers use `isResolvedLedgerUnit`
+  (trusted-or-resolved); artifact-preservation consumers keep
+  `isTrustedLedgerUnit`.
 - Current population status: `reconstruct` populates telemetry from its run
   manifest steps. `review` does not populate it yet.
 

package/.onto/processes/shared/target-material-kind-contract.md

@@ -81,7 +81,7 @@ the lexicon.
 
 | Process | Required alignment |
 |---|---|
-| `review` | `review-target-profile.yaml` records `target_material_kind`; review must not claim material-aware validation before per-material validators exist. |
+| `review` | `review-target-profile.yaml` records `target_material_kind` and provides a per-material review adapter for `spreadsheet` via a **single per-ref disposition** (`computeSpreadsheetDisposition`): every honesty surface (`support_status`, `target_refs[].inspectable`, `review_goal`, prompt obligations, render notes) projects from one record. `inspectable` (the workbook was read and has renderable structure, *including plain tabular data*) drives `support_status`; the **positive** `backed_goals` subset drives `review_goal`, so `review_goal` carries only the backed obligations — a plain CSV is `supported`/`inspectable` yet backs none, and a macro/protection-only workbook backs only `access_and_protection_hygiene`. `support_status` degrades to `partial` when **any** rendered ref across the resolved∪materialized union is uninspectable (unsupported format .xls/.xlsb/.ods, unreadable/oversized/empty, or a corrupt shell), and the gate runs regardless of the resolved kind (a code target carrying a materialized uninspectable workbook also degrades). `code` stays `supported`, `document`/`database` stay `partial`, `mixed` stays `partial_composite`, and `unknown` stays `unknown` until their adapters land (precise per-kind states owned by `review-target-profile-contract.md` §6). Review `support_status` and reconstruct `runtime_implementation_status` are **independent per-process axes over the same shared inventory backing**: review `supported` does not imply the reconstruct seed pipeline is fully wired (it remains `partially_wired`). |
 | `reconstruct` | Source profiles, source adapters, source observations, and directive validation must be keyed by `target_material_kind`. |
 | `evolve` | Future adapters must not assume code-product inputs; adapter selection should start from `target_material_kind` as defined in `.onto/processes/evolve/material-kind-adapter-contract.md`. |