onto-mcp 0.4.12 → 0.4.13

package/dist/core-api/review-api.js

@@ -5,7 +5,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { resolveOntoHome } from "../core-runtime/discovery/onto-home.js";
-import { defaultReviewRetrySettings, resolveSettingsChain, } from "../core-runtime/discovery/settings-chain.js";
+import { completeDispatchBreakerSettings, defaultReviewRetrySettings, resolveSettingsChain, } from "../core-runtime/discovery/settings-chain.js";
 import { loadCoreLensRegistry } from "../core-runtime/discovery/lens-registry.js";
 import { fileExists, isDeprecatedDomainAlias, isoFromTimestamp, isoNow, normalizeDomainValue, readYamlDocument, writeYamlDocument, } from "../core-runtime/review/review-artifact-utils.js";
 import { assertPathInsideRoot, realpathIfExists, } from "../core-runtime/path-boundary.js";
@@ -29,6 +29,7 @@ import { appendRuntimeStatusEventSync, } from "../core-runtime/observability/run
 import { buildReviewPipelineExecutionLedger, } from "../core-runtime/review/pipeline-execution-ledger.js";
 import { buildReviewContinuationPlan, } from "../core-runtime/review/continuation-plan.js";
 import { reviewAdvance as coreReviewAdvance, reviewRound as coreReviewRound, } from "../core-runtime/review/review-execution-steps.js";
+import { dispatchIncompleteArtifactPath } from "../core-runtime/llm/dispatch-breaker.js";
 export class ReviewContinuationError extends Error {
     failureContent;
     originalError;
@@ -1228,6 +1229,7 @@ function buildHaltPresentation(input) {
         prompt: [
             "Render a concise halted-partial onto review update from bounded runtime facts.",
             "Use only the provided input facts. Lead with halt identity, produced artifacts, absent artifacts, and available action candidates.",
+            "When run_control.continuationAvailable is true, present the default recovery as calling onto_review_continue with the same sessionRoot: it resumes the session, reuses already-completed units, and reruns only the failed/missing frontier — prefer it over restarting a new review. This operational resume is distinct from the continue_review action-candidate, which means expanding the review's evidence boundary.",
             "Do not present partial findings as a completed review. Use the user's conversation language.",
         ].join("\n"),
         input,
@@ -1511,12 +1513,28 @@ async function deriveRuntimeUnitProgress(args) {
             unitKind: "lens",
             packetPath,
             outputPath: seat.output_path,
+            sidecarOutputPath: seat.sidecar_output_path ?? null,
             runningLogRef: path.join(path.dirname(seat.output_path), `.${seat.lens_id}.running.log`),
         };
     });
     const projections = [];
     for (const unit of lensUnits) {
-        const output = await observeFile(unit.outputPath);
+        // In sidecar mode (review.artifacts.write_lens_markdown=false) the authored
+        // `.md` is never written and the lens's real artifact is the findings
+        // sidecar (`.findings.yaml`). Resolve the unit's output to whichever artifact
+        // actually exists, preferring the authored `.md`, so drill-down and the
+        // output-presence completion signal see the real file instead of an absent
+        // planned path.
+        const authoredOutput = await observeFile(unit.outputPath);
+        let output = authoredOutput;
+        let outputPath = unit.outputPath;
+        if (!authoredOutput.exists && unit.sidecarOutputPath) {
+            const sidecar = await observeFile(unit.sidecarOutputPath);
+            if (sidecar.exists) {
+                output = sidecar;
+                outputPath = unit.sidecarOutputPath;
+            }
+        }
         const runningLog = await observeFile(unit.runningLogRef);
         const signals = signalsByUnit.get(unit.unitId) ?? [];
         const latestSignal = latestRuntimeSignal(signals);
@@ -1579,7 +1597,7 @@ async function deriveRuntimeUnitProgress(args) {
             progressStepId: runtimeUnitStepId(unit.unitKind),
             status,
             packetPath: unit.packetPath,
-            outputPath: unit.outputPath,
+            outputPath,
             runningLogRef: runningLog.exists ? unit.runningLogRef : null,
             latestSignal: latestSignalName,
             latestSignalAt,
@@ -2156,7 +2174,10 @@ function reviewExecutionHostFromRoute(args) {
         return args.modelProvider;
     return reviewExecutionHostFromRuntime(args.hostRuntime, args.workerExecutor);
 }
-function reviewRetrySettingsFromUnknown(value) {
+/** Exported for tests: pins the continue-path round-trip contract — every
+ * opt-in stamped in the manifest retry policy (salvage, resubmit) must
+ * survive profile reconstruction, or a resumed run silently loses it. */
+export function reviewRetrySettingsFromUnknown(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
     const record = value;
@@ -2201,7 +2222,47 @@ function reviewRetrySettingsFromUnknown(value) {
         ...(transcription !== undefined ? { transcription_llm: transcription } : {}),
         delta_completion: "unit_llm",
     };
-    return { ...retry, salvage };
+    // Round-trip the resubmit opt-in for the same reason as salvage: a
+    // resubmit-enabled run resumed via continue must not silently revert to
+    // the whole-run-halt promotion rule (artifacts stamped before the field
+    // existed resume with resubmit disabled — conservative).
+    const resubmitRecord = record.resubmit &&
+        typeof record.resubmit === "object" &&
+        !Array.isArray(record.resubmit)
+        ? record.resubmit
+        : undefined;
+    const resubmit = {
+        enabled: resubmitRecord?.enabled === true,
+    };
+    // Round-trip the dispatch breaker for the same reason: the canonical
+    // recovery flow for a TRIPPED batch is onto_review_continue during the
+    // same outage — dropping the key here would resume the incomplete set
+    // with the breaker silently OFF (the exact retry-storm class 설계 B
+    // prevents). Artifacts stamped before the field existed resume with the
+    // breaker disabled — conservative (completeDispatchBreakerSettings
+    // defaults enabled:false).
+    const breakerRecord = record.dispatch_breaker &&
+        typeof record.dispatch_breaker === "object" &&
+        !Array.isArray(record.dispatch_breaker)
+        ? record.dispatch_breaker
+        : undefined;
+    const breakerNumber = (item, min) => typeof item === "number" && Number.isInteger(item) && item >= min
+        ? item
+        : undefined;
+    const breakerInput = {
+        enabled: breakerRecord?.enabled === true,
+        systemic_threshold: breakerNumber(breakerRecord?.systemic_threshold, 1),
+        per_call_max_attempts: breakerNumber(breakerRecord?.per_call_max_attempts, 1),
+        backoff_initial_ms: breakerNumber(breakerRecord?.backoff_initial_ms, 0),
+        backoff_cap_ms: breakerNumber(breakerRecord?.backoff_cap_ms, 0),
+    };
+    const dispatchBreaker = completeDispatchBreakerSettings(breakerInput);
+    return {
+        ...retry,
+        salvage,
+        resubmit,
+        dispatch_breaker: dispatchBreaker,
+    };
 }
 function reviewExecutionProfileFromManifest(manifest) {
     const profile = manifest?.review_execution_profile;
@@ -2480,6 +2541,10 @@ function continuationSessionArtifactRefs(args) {
         args.executionPlan.deliberation_output_path,
         args.executionPlan.final_output_path,
         args.executionPlan.review_record_path,
+        // 설계 B: 트립 배치의 회복 집합 기록 — continuation이 breaker-ON 배치를
+        // 재실행하면 덮어써지므로, 직전 상태를 continuation-attempts/에 백업해
+        // 어느 트립 상태를 회복했는지 감사 가능하게 남긴다.
+        dispatchIncompleteArtifactPath(args.sessionRoot),
     ];
 }
 async function resolveContinuationRequestText(args) {

package/dist/core-api/review-progress.js

@@ -0,0 +1,7 @@
+/**
+ * core-api re-export of the review progress-step contract (the canonical step
+ * ids, ordered specs, and label lookup that review-api itself uses), so
+ * consumers like the `onto watch` TUI reuse the same label authority through
+ * core-api instead of reaching into core-runtime/review or duplicating labels.
+ */
+export { REVIEW_PROGRESS_STEPS, reviewProgressStepById, } from "../core-runtime/review/review-progress-contract.js";

package/dist/core-api/runtime-observation.js

@@ -0,0 +1,7 @@
+/**
+ * core-api re-export of the runtime event-stream surface, so consumers (the
+ * `onto watch` TUI) depend on core-api only — never reaching into
+ * core-runtime/observability directly. The event log is the append-only
+ * `runtime-events.ndjson` produced by every review/reconstruct session.
+ */
+export { runtimeStreamEventLogPath, } from "../core-runtime/observability/runtime-stream-observation.js";

package/dist/core-runtime/artifact-io.js

@@ -1,3 +1,4 @@
+import { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { stringify as stringifyYaml } from "yaml";
@@ -35,13 +36,84 @@ export async function atomicWriteFile(filePath, contents) {
         throw error;
     }
 }
+async function fsyncDirectory(directoryPath) {
+    const handle = await fs.open(directoryPath, fsConstants.O_RDONLY);
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
 /**
- * Serialize `value` to YAML and write it atomically. Byte-for-byte identical
- * output to a direct `stringifyYaml(value)` write — only the write mechanism
+ * Atomic write with crash-durable file and directory metadata. Use for small
+ * control-plane authorities whose rename must survive a process or host crash.
+ */
+export async function durableAtomicWriteFile(filePath, contents) {
+    const directoryPath = path.dirname(filePath);
+    await fs.mkdir(directoryPath, { recursive: true });
+    tempWriteCounter += 1;
+    const tempPath = `${filePath}.${process.pid}.${tempWriteCounter}.durable.tmp`;
+    let handle = null;
+    try {
+        handle = await fs.open(tempPath, fsConstants.O_CREAT |
+            fsConstants.O_EXCL |
+            fsConstants.O_WRONLY |
+            fsConstants.O_NOFOLLOW, 0o600);
+        await handle.writeFile(contents, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await fs.rename(tempPath, filePath);
+        await fsyncDirectory(directoryPath);
+    }
+    catch (error) {
+        await handle?.close().catch(() => undefined);
+        await fs.rm(tempPath, { force: true });
+        throw error;
+    }
+}
+/**
+ * Fields stamped on in-memory artifacts for same-process consumers but NEVER persisted. Persisting one
+ * changes the on-disk bytes, which feeds reuse-provenance: the scout-pack snapshot hashes the raw
+ * validation-file bytes via `sha256File`, so a persisted field rotates that snapshot (the
+ * `reuseMatchArtifactHash` in-memory digest is neutralized separately, in run.ts
+ * `stripVolatileArtifactFields`). The only such field today is the G(a) obligation-coverage telemetry
+ * (`asserted_obligation_ids`): validators stamp it and the coverage harvest reads it off the in-memory
+ * return value — no consumer reads it from disk. Keeping it out of persistence lets the reuse-hashed /
+ * scout-captured validators be instrumented with zero hash rotation and no resume migration.
+ * See development-records/design/20260623-deferred7-obligation-telemetry-design.md.
+ */
+const IN_MEMORY_ONLY_ARTIFACT_FIELDS = ["asserted_obligation_ids"];
+/**
+ * Return `value` with any in-memory-only telemetry fields dropped from the top level. Top-level only by
+ * design: validation artifacts carry these fields at top level and the reuse channels only hash
+ * standalone validation files, so a recursive walk would add an O(size) cost on every large artifact
+ * write (e.g. a 190K-row workbook inventory) for no benefit. Returns the input unchanged (no copy) when
+ * no such field is present — the common case for every non-validation artifact.
+ */
+export function stripInMemoryOnlyArtifactFields(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const record = value;
+    if (!IN_MEMORY_ONLY_ARTIFACT_FIELDS.some((key) => key in record))
+        return value;
+    const persisted = { ...record };
+    for (const key of IN_MEMORY_ONLY_ARTIFACT_FIELDS)
+        delete persisted[key];
+    return persisted;
+}
+/**
+ * Serialize `value` to YAML and write it atomically, dropping in-memory-only telemetry fields
+ * (see `stripInMemoryOnlyArtifactFields`). Byte-for-byte identical to a direct `stringifyYaml(value)`
+ * write for any value without those fields — only the write mechanism (and the telemetry omission)
  * changes.
  */
 export async function atomicWriteYamlDocument(filePath, value) {
-    await atomicWriteFile(filePath, stringifyYaml(value));
+    await atomicWriteFile(filePath, stringifyYaml(stripInMemoryOnlyArtifactFields(value)));
+}
+export async function durableAtomicWriteYamlDocument(filePath, value) {
+    await durableAtomicWriteFile(filePath, stringifyYaml(stripInMemoryOnlyArtifactFields(value)));
 }
 /**
  * Fail-closed shape guard for trusted artifact reads. The pipeline reads its

package/dist/core-runtime/cli/claude-code-review-unit-executor.js

@@ -30,9 +30,10 @@ import { SALVAGE_INCOMPLETE_SENTINEL, buildDeltaRowsSalvagePrompt, buildTranscri
 const CLAUDE_READONLY_ALLOWED_TOOLS = ["Read", "Grep", "Glob"];
 const CLAUDE_BIN = resolveClaudeBin();
 /**
- * Embed the submit-tool JSON Schema into the bounded prompt. Claude Code's
- * `--json-schema` flag silently rejects the runtime's complex submit schemas,
- * so the schema travels in-prompt and the submit tool validates the result.
+ * Embed the submit-tool JSON Schema into the bounded prompt as a redundant
+ * semantic hint. The same schema is also passed through Claude Code's
+ * `--json-schema` flag when available; the submit tool remains the artifact
+ * validator.
  */
 function appendSchemaToPrompt(boundedPrompt, schema) {
     if (schema === undefined)
@@ -192,6 +193,7 @@ async function runSubmitSalvageMode(args) {
     process.stderr.write(`[plan:executor] kind=claude_code unit_id=${args.unitId} salvage=${mode.mode}\n`);
     const workerBase = {
         projectRoot: args.projectRoot,
+        jsonSchema: args.submitSchema.schema,
         sandboxMode: args.sandboxMode,
         unitId: args.unitId,
         unitKind: args.unitKind,
@@ -269,11 +271,19 @@ async function runClaudeWorker(args) {
     if (args.reasoningEffort && args.reasoningEffort.length > 0) {
         claudeArgs.push("--effort", args.reasoningEffort);
     }
-    // The schema is embedded in the prompt rather than passed via --json-schema:
-    // claude's --json-schema validator silently rejects the runtime's complex
-    // submit schemas (additionalProperties:false + deep required) and exits with
-    // no output. The submit tool remains the authoritative validator.
-    //
+    // --json-schema constrains output at the API level (grammar-based structured
+    // outputs) so the model CANNOT emit syntactically malformed JSON; the CLI then
+    // returns a parsed `structured_output` object (extractClaudeStructuredPayload
+    // reads that first). Empirically (opus-4.8 + haiku, 2026-07) the flag accepts
+    // the runtime's submit schemas (additionalProperties:false + deep required,
+    // ~20 params, enums) and returns native objects — the earlier "silently
+    // rejects complex schemas" note was inaccurate. Without this, opus free-forms
+    // the JSON in-prompt and can drop a comma on large findings → output_contract
+    // failure with no recovery. The in-prompt schema stays as a redundant semantic
+    // hint; the submit tool remains the authoritative VALIDATOR of field content.
+    if (args.jsonSchema !== undefined) {
+        claudeArgs.push("--json-schema", JSON.stringify(args.jsonSchema));
+    }
     // Never load project/user MCP servers in the bounded worker (no side effects,
     // no mcp__* tools to auto-approve).
     claudeArgs.push("--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}');
@@ -557,6 +567,7 @@ export async function runClaudeCodeReviewUnitExecutorCli(argv) {
         const stdout = await runClaudeWorker({
             projectRoot,
             boundedPrompt,
+            jsonSchema: submitSchema?.schema,
             model,
             reasoningEffort,
             sandboxMode,

package/dist/core-runtime/cli/materialize-review-prompt-packets.js

@@ -6,7 +6,9 @@ import os from "node:os";
 import path from "node:path";
 import { parseArgs } from "node:util";
 import { pathToFileURL } from "node:url";
+import { reviewMaterialGoals } from "../target-material-kind.js";
 import { fileExists, isoNow, readYamlDocument, writeYamlDocument, toRelativePath, truncateForEmbedding, } from "../review/review-artifact-utils.js";
+import { DEFAULT_MAX_EMBED_LINES } from "../review/review-prompt-budget.js";
 import { printOntoReleaseChannelNotice } from "../release-channel/release-channel.js";
 import { writeAndThrowStructuredFailureRecord } from "../review/failure-records.js";
 import { resolveInstallationPath } from "../discovery/installation-paths.js";
@@ -52,19 +54,52 @@ export function renderEmbeddedMaterializedInputSection(materializedInput) {
 ${materializedInput}
 <!-- onto:embedded-materialized-input:end -->`;
 }
-function materialKindReviewObligations(targetMaterialKind) {
-    switch (targetMaterialKind) {
+function materialKindReviewObligations(profile) {
+    switch (profile.target_material_kind) {
         case "code":
             return [
                 "Treat declared types, exported API signatures, documented contracts, and observable runtime behavior as review evidence.",
                 "Check visible type/runtime contract mismatches, edge-case input behavior, error/null/undefined paths, and caller-facing failure modes.",
                 "Classify a visible correctness or runtime-contract failure as material when it can violate the declared review goal inside the bounded target.",
             ];
-        case "spreadsheet":
+        case "spreadsheet": {
+            // The obligation prose stays in lockstep with the per-ref disposition projected into
+            // review_goal (the SSOT): a goal is named only when its specific structure was
+            // rendered. Three honest cases, so the lens is never told to audit absent formulas nor
+            // told the data is unavailable when it was actually rendered:
+            const spreadsheetGoals = reviewMaterialGoals("spreadsheet");
+            const backed = profile.review_goal.filter((goal) => spreadsheetGoals.includes(goal));
+            if (backed.length > 0) {
+                // Project the prose from the BACKED goal SUBSET (not a single any-backed bit), so the
+                // lens is told to audit only the structure the inventory actually rendered for this
+                // target — a macro-only or validation-only workbook is never told to audit formulas
+                // that review_goal and the render both show are absent. Emitted in stable catalog order.
+                const GOAL_PROSE = {
+                    formula_integrity: "Treat formulas and their recalculation behavior as review evidence; check visible formula mismatches, stale derived values, and decision-impacting calculation errors.",
+                    cross_sheet_reference_integrity: "Treat cross-sheet references as review evidence; check broken, stale, or misaimed references across sheets.",
+                    named_range_hygiene: "Treat named ranges as review evidence; check missing, overlapping, or wrongly-scoped named ranges.",
+                    data_validation_coverage: "Treat data-validation rules (type, operator, bounds) as review evidence; check missing or inconsistent input guards.",
+                    access_and_protection_hygiene: "Treat sheet protection, hidden sheets, and macro presence as review evidence; check the access/protection posture and any macro-carried risk.",
+                    structural_risk_signals: "Treat the recorded structural risk signals, external links, and error cells as review evidence; check decision-impacting structural risks.",
+                };
+                return spreadsheetGoals
+                    .filter((goal) => backed.includes(goal))
+                    .map((goal) => GOAL_PROSE[goal]);
+            }
+            // No structural obligation is backed. Distinguish an inspected plain-data workbook
+            // (read — e.g. a flat CSV — but with no formula/named-range/validation/protection
+            // structure to audit) from one that could not be inspected at all.
+            if (profile.material_profile.support_status === "supported") {
+                return [
+                    "The target workbook(s) were structurally inspected but carry no formula, cross-sheet reference, named range, data validation, or protection structure to audit beyond the rendered columns/data.",
+                    "Treat the rendered structural inventory as the evidence; do not infer calculation logic the workbook does not contain.",
+                ];
+            }
             return [
-                "Treat formulas, cross-sheet references, named ranges, input assumptions, and recalculation behavior as review evidence.",
-                "Check visible formula/reference mismatches, stale derived values, missing input guards, and decision-impacting calculation errors.",
+                "The target workbook(s) could not be structurally inspected (unsupported format, unreadable, or empty); the materialized input carries only an unsupported note, not formula/reference structure.",
+                "Treat only what the materialized input actually renders as evidence; do not assume formulas, cross-sheet references, or recalculated values are available, and preserve material uncertainty about the uninspected structure.",
             ];
+        }
         case "document":
             return [
                 "Treat declared purpose, audience, claims, evidence, structure, and unresolved ambiguity as review evidence.",
@@ -87,13 +122,13 @@ function materialKindReviewObligations(targetMaterialKind) {
             ];
     }
 }
-function renderReviewTargetProfileSummary(profile) {
+export function renderReviewTargetProfileSummary(profile) {
     if (!profile) {
         return `## Review Target Profile Summary
 - profile: unavailable
 - consequence: use only the materialized input and explicit request summary as target authority.`;
     }
-    const obligations = materialKindReviewObligations(profile.target_material_kind);
+    const obligations = materialKindReviewObligations(profile);
     return `## Review Target Profile Summary
 - target_material_kind: ${profile.target_material_kind}
 - target_input_kind: ${profile.target_input_kind}
@@ -190,7 +225,9 @@ Submit \`domain_context_assumptions\` as a list of strings.
 If there are no findings, submit \`findings: []\` and a concise \`no_findings_rationale\`.
 ${args.humanOutputPath ? `The runtime may render a human-readable projection at ${toRelativePath(args.humanOutputPath, args.projectRoot)}.` : "No human-readable lens markdown projection is requested for this session."}`;
 }
-const DEFAULT_MAX_EMBED_LINES = 300;
+// DEFAULT_MAX_EMBED_LINES is owned by review-prompt-budget.ts (the single
+// conversion point), imported above and shared with the prepare-time budget
+// resolution so the no-regression floor lives in one place.
 // Core role IDs derived from .onto/authority/core-lens-registry.yaml (single source of truth)
 import { loadCoreLensRegistry } from "../discovery/lens-registry.js";
 const CORE_ROLE_IDS = new Set(loadCoreLensRegistry().core_role_ids);
@@ -731,12 +768,20 @@ export async function runMaterializeReviewPromptPacketsCli(argv) {
         allowPositionals: false,
         args: argv,
     });
-    let maxEmbedLines = typeof values["max-embed-lines"] === "string" && values["max-embed-lines"].length > 0
-        ? Number.parseInt(values["max-embed-lines"], 10)
-        : DEFAULT_MAX_EMBED_LINES;
-    if (!Number.isFinite(maxEmbedLines) || maxEmbedLines < 1) {
-        console.warn(`[onto] Invalid max-embed-lines value (${values["max-embed-lines"]}), using default ${DEFAULT_MAX_EMBED_LINES}.`);
-        maxEmbedLines = DEFAULT_MAX_EMBED_LINES;
+    // Explicit CLI --max-embed-lines wins (an operator override). An invalid value
+    // falls back (warned) so it does NOT mask the plan's window-proportional budget.
+    // The plan's persisted max_embed_lines (Stage 1) is applied below, after the
+    // plan is read; absent both → DEFAULT (no regression).
+    let cliMaxEmbedLines;
+    if (typeof values["max-embed-lines"] === "string" &&
+        values["max-embed-lines"].length > 0) {
+        const parsed = Number.parseInt(values["max-embed-lines"], 10);
+        if (Number.isFinite(parsed) && parsed >= 1) {
+            cliMaxEmbedLines = parsed;
+        }
+        else {
+            console.warn(`[onto] Invalid max-embed-lines value (${values["max-embed-lines"]}), using default ${DEFAULT_MAX_EMBED_LINES}.`);
+        }
     }
     const projectRoot = path.resolve(requireString(values["project-root"], "project-root"));
     const sessionRoot = path.resolve(requireString(values["session-root"], "session-root"));
@@ -749,6 +794,15 @@ export async function runMaterializeReviewPromptPacketsCli(argv) {
     const binding = await readYamlDocument(bindingPath);
     const sessionMetadata = await readYamlDocument(sessionMetadataPath);
     const executionPlan = await readYamlDocument(executionPlanPath);
+    // Stage 1 embed-budget precedence: explicit CLI override wins; else the plan's
+    // window-proportional max_embed_lines (persisted at prepare time); else DEFAULT
+    // (model-unaware run — no regression).
+    const planMaxEmbedLines = typeof executionPlan.max_embed_lines === "number" &&
+        Number.isFinite(executionPlan.max_embed_lines) &&
+        executionPlan.max_embed_lines >= 1
+        ? executionPlan.max_embed_lines
+        : undefined;
+    const maxEmbedLines = cliMaxEmbedLines ?? planMaxEmbedLines ?? DEFAULT_MAX_EMBED_LINES;
     const promptPacketsRoot = executionPlan.prompt_packets_root ?? path.join(sessionRoot, "prompt-packets");
     const materializedInputText = await readOptionalText(binding.materialized_input_path);
     const reviewTargetProfile = await readYamlDocument(binding.review_target_profile_path);

package/dist/core-runtime/cli/prepare-review-session.js

@@ -3,11 +3,32 @@ import path from "node:path";
 import { parseArgs } from "node:util";
 import { pathToFileURL } from "node:url";
 import { DEFAULT_DIRECTORY_LISTING_OPTIONS, hasOptionFlag, parseBooleanFlag, } from "../review/review-artifact-utils.js";
-import { bootstrapInvocationBindingArtifacts, materializeReviewExecutionPreparationArtifacts, writeInvocationInterpretationArtifact, } from "../review/materializers.js";
+import { bootstrapInvocationBindingArtifacts, materializeReviewExecutionPreparationArtifacts, resolveReviewExecutionSettingsForArtifacts, writeInvocationInterpretationArtifact, } from "../review/materializers.js";
+import { DEFAULT_MAX_EMBED_LINES, deriveReviewMaxEmbedLines, resolveReviewLensContextWindowTokens, reviewWindowMultiplier, } from "../review/review-prompt-budget.js";
+import { deriveWorkbookInventoryPromptCaps } from "../spreadsheet-structure-observer.js";
+import { loadSupportedModelRegistry } from "../discovery/supported-models.js";
 import { printOntoReleaseChannelNotice } from "../release-channel/release-channel.js";
 import { detectCodexEnvSignal } from "../discovery/host-detection.js";
 import { resolveOntoHome } from "../discovery/onto-home.js";
 import { resolveSettingsChain } from "../discovery/settings-chain.js";
+/**
+ * Stage 1 — resolve the window-proportional review prompt budget multiplier from
+ * the lens model's registered context window. The registry load and model
+ * resolution are best-effort: any failure (missing/malformed authority,
+ * unresolved model, no registered window) returns multiplier 1, so the budget
+ * floors to DEFAULT caps + DEFAULT embed lines (no regression). Never throws.
+ */
+function resolveReviewPromptBudget(ontoConfig) {
+    try {
+        const registry = loadSupportedModelRegistry();
+        const execution = resolveReviewExecutionSettingsForArtifacts(ontoConfig);
+        const window = resolveReviewLensContextWindowTokens(execution, registry);
+        return { multiplier: reviewWindowMultiplier(window) };
+    }
+    catch {
+        return { multiplier: 1 };
+    }
+}
 function requireString(value, optionName) {
     if (typeof value !== "string" || value.length === 0) {
         throw new Error(`Missing required option --${optionName}`);
@@ -175,6 +196,16 @@ export async function runPrepareReviewSessionCli(argv) {
     const projectRoot = path.resolve(requireString(values["project-root"], "project-root"));
     const ontoHome = resolveOntoHome(optionalString(values["onto-home"]) || undefined);
     const ontoConfig = await resolveSettingsChain(ontoHome, projectRoot);
+    // Stage 1 — resolve the window-proportional review prompt budget ONCE, here,
+    // and thread it to both consumers: the spreadsheet inventory prompt caps
+    // (into the materialize call) and the embed line budget (persisted into the
+    // execution plan for the packet stage). The lens MODEL's registered context
+    // window drives a single multiplier. Any failure (registry load, unresolved
+    // model, no registered window) falls through to multiplier 1 → DEFAULT caps +
+    // DEFAULT embed lines (no regression). Never throws.
+    const reviewPromptBudget = resolveReviewPromptBudget(ontoConfig);
+    const inventoryPromptCaps = deriveWorkbookInventoryPromptCaps(reviewPromptBudget.multiplier);
+    const maxEmbedLines = deriveReviewMaxEmbedLines(reviewPromptBudget.multiplier, DEFAULT_MAX_EMBED_LINES);
     const bindingParams = {
         projectRoot,
         ontoConfig,
@@ -195,6 +226,7 @@ export async function runPrepareReviewSessionCli(argv) {
         filesystemAllowedRoots: values["filesystem-allowed-root"],
         bindingNotes: values["binding-note"],
         ontoHome,
+        maxEmbedLines,
         ...(typeof values["session-id"] === "string" && values["session-id"].length > 0
             ? { sessionId: values["session-id"] }
             : {}),
@@ -253,6 +285,7 @@ export async function runPrepareReviewSessionCli(argv) {
         roleDefinitionRefs: values["role-definition-ref"],
         executionRuleRefs: values["execution-rule-ref"],
         directoryListingOptions,
+        inventoryPromptCaps,
     });
     console.log(JSON.stringify({
         session_root: sessionRoot,

package/dist/core-runtime/cli/render-review-final-output.js

@@ -642,6 +642,7 @@ export async function runRenderReviewFinalOutputCli(argv) {
     const defaultPurposeAlignment = executionStatus === "completed"
         ? "- bounded review execution completed"
         : `- execution status: ${executionStatus}`;
+    const fallbackImmediateActions = renderActionCandidates(classificationSummary);
     const finalOutputText = `---
 session_id: ${bindingArtifact.session_id}
 process: review
@@ -737,7 +738,7 @@ ${renderedBoundaryNotes}
 ### Immediate Actions Required
 ${synthesisLedger
         ? renderLedgerActions(synthesisLedger)
-        : degradationSummary}
+        : fallbackImmediateActions}
 
 ### Recommendations
 ${synthesisLedger