okstra 0.132.0 → 0.134.0

package/runtime/python/okstra_ctl/run.py

@@ -1326,7 +1326,12 @@ def _resolve_pr_template(inp: PrepareInputs) -> tuple[str, str]:
 
 @dataclass
 class _ModelBindings:
-    """이 run 의 lead/worker 모델 + critic + executor 바인딩."""
+    """이 run 의 lead/worker 모델 + critic + executor 바인딩.
+
+    `*_execution` 은 dispatch 에 쓰이는 CLI 신원 철자다. 카탈로그 값과 달리
+    provider CLI 조회를 거치므로 실패할 수 있고, 그래서 이 묶음에서 함께
+    해소한다 — prepare 가 run seq 를 할당하거나 worktree 를 만들기 전에.
+    """
 
     lead: ModelAssignment
     cw: ModelAssignment
@@ -1338,6 +1343,9 @@ class _ModelBindings:
     executor_display_name: str
     executor_worker_agent: str
     executor_model_meta: ModelAssignment
+    codex_worker_execution: str
+    antigravity_worker_execution: str
+    executor_execution: str
 
 
 def recommended_role_models() -> dict[str, str]:
@@ -1413,6 +1421,12 @@ def _resolve_model_bindings(inp: PrepareInputs, workers: list[str]) -> _ModelBin
         executor_display_name=display_name,
         executor_worker_agent=worker_agent,
         executor_model_meta=model_meta,
+        codex_worker_execution=_worker_execution_value(
+            m["co"], "codex", "worker", workers),
+        antigravity_worker_execution=_worker_execution_value(
+            m["ge"], "antigravity", "worker", workers),
+        executor_execution=_normalized_execution(
+            model_meta, provider=executor_provider, role="executor"),
     )
 
 
@@ -1421,7 +1435,7 @@ def _normalized_execution(meta: ModelAssignment, provider: str, role: str) -> st
     so the manifest carries the dispatch-correct spelling. SSOT for the mapping
     lives in model_discovery; this is only the run.py call seam."""
     return normalize_execution_for_dispatch(
-        provider=provider, execution=meta.execution, display=meta.display, role=role,
+        provider=provider, execution=meta.execution, role=role,
     )
 
 
@@ -2176,22 +2190,16 @@ def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
         "CLAUDE_WORKER_MODEL": cw.display,
         "CLAUDE_WORKER_MODEL_EXECUTION_VALUE": cw.execution,
         "CODEX_WORKER_MODEL": co.display,
-        "CODEX_WORKER_MODEL_EXECUTION_VALUE": _worker_execution_value(
-            co, "codex", "worker", workers,
-        ),
+        "CODEX_WORKER_MODEL_EXECUTION_VALUE": models.codex_worker_execution,
         "ANTIGRAVITY_WORKER_MODEL": ge.display,
-        "ANTIGRAVITY_WORKER_MODEL_EXECUTION_VALUE": _worker_execution_value(
-            ge, "antigravity", "worker", workers,
-        ),
+        "ANTIGRAVITY_WORKER_MODEL_EXECUTION_VALUE": models.antigravity_worker_execution,
         "REPORT_WRITER_MODEL": rw.display,
         "REPORT_WRITER_MODEL_EXECUTION_VALUE": rw.execution,
         "EXECUTOR_PROVIDER": executor_provider,
         "EXECUTOR_DISPLAY_NAME": executor_display_name,
         "EXECUTOR_WORKER_AGENT": executor_worker_agent,
         "EXECUTOR_MODEL_DISPLAY": executor_model_meta.display,
-        "EXECUTOR_MODEL_EXECUTION_VALUE": _normalized_execution(
-            executor_model_meta, provider=executor_provider, role="executor",
-        ),
+        "EXECUTOR_MODEL_EXECUTION_VALUE": models.executor_execution,
         "CRITIC_CHOICE": critic_choice,
         "RELATED_TASKS_JSON": related_tasks_json_str,
         "RELATED_TASKS_BULLETS": bullets,

package/runtime/python/okstra_ctl/session.py

@@ -65,17 +65,46 @@ def _session_has_agent_name(jsonl_path: Path) -> bool:
     return False
 
 
+def _session_mentions(jsonl_path: Path, needle: str) -> bool:
+    """세션 transcript 어딘가에 *needle* 문자열이 등장하는가."""
+    try:
+        with jsonl_path.open(encoding="utf-8", errors="ignore") as fh:
+            return any(needle in line for line in fh)
+    except OSError:
+        return False
+
+
+def resolve_lead_session_id_for_run(project_root: Path, run_dir: Path) -> str:
+    """`run_dir` 를 다룬 lead 세션 중 가장 최근 수정된 것의 id, 없으면 ''.
+
+    프로젝트 디렉토리의 최신 jsonl 을 그대로 집으면(``resolve_inproc_lead_session_id``)
+    같은 프로젝트에서 동시에 도는 **다른 태스크의 세션**이 잡힌다 — 실측
+    (dev-10172): 남의 세션이 `leadSessionIds` 에 들어가 run 비용이 $80 → $207 로
+    부풀고, 그 세션의 PROGRESS 라인이 conformance 스캔에 섞여 오탐을 냈다.
+    자기 run 의 산출물 경로를 언급한 세션만 후보로 인정해 그 오염을 막는다.
+    """
+    proj_dir = _claude_projects_dir_for(project_root)
+    try:
+        candidates = [p for p in proj_dir.iterdir() if p.suffix == ".jsonl"]
+    except OSError:
+        return ""
+    needle = str(run_dir)
+    for path in sorted(candidates, key=lambda p: p.stat().st_mtime, reverse=True):
+        if _session_has_agent_name(path):
+            continue
+        if _session_mentions(path, needle):
+            return path.stem
+    return ""
+
+
 def record_observed_lead_session(project_root: Path, team_state_path: Path) -> str:
-    """현재 live lead 세션을 관측해 team-state 에 append(멱등). 워커 세션이거나
-    관측 실패·중복이면 '' 반환. 재발급으로 갈린 세대를 축1 이 여기에 모은다.
+    """이 run 의 live lead 세션을 관측해 team-state 에 append(멱등). 이 run 을
+    다룬 lead 세션을 못 찾거나 중복이면 '' 반환. 재발급으로 갈린 세대를 축1 이
+    여기에 모은다.
     """
-    sid = resolve_inproc_lead_session_id(project_root)
+    sid = resolve_lead_session_id_for_run(project_root, team_state_path.parent.parent)
     if not sid:
         return ""
-    proj_dir = _claude_projects_dir_for(project_root)
-    jsonl = proj_dir / f"{sid}.jsonl"
-    if _session_has_agent_name(jsonl):
-        return ""
     try:
         state = json.loads(team_state_path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):

package/runtime/python/okstra_ctl/stage_integrate.py

@@ -2,7 +2,8 @@
 
 Phase A: stage done commit 을 task 브랜치에 위상순 --no-ff 머지(이미 머지면
 skip, 충돌이면 해당 머지만 abort 후 IntegrateError). Phase B: 머지/skip 된
-stage 의 worktree·registry 키·stage 브랜치를 정리(dirty 면 skip).
+stage 의 worktree 디렉터리와 registry 키를 정리(dirty 면 skip). stage 브랜치는
+스택 보존을 위해 삭제하지 않는다.
 설계: docs/superpowers/specs/2026-06-20-stage-auto-integrate-teardown-design.md
 """
 from __future__ import annotations
@@ -64,7 +65,7 @@ def integrate_stages(
 ) -> IntegrateResult:
     """whole-task 통합: Phase A 머지 → Phase B teardown.
 
-    teardown=False 면 Phase B(stage worktree·브랜치·registry 키 정리)를 건너뛴다 —
+    teardown=False 면 Phase B(stage worktree 디렉터리·registry 키 정리)를 건너뛴다 —
     container 는 머지만 하고 stage 트리를 보존한다(스펙 §10). final-verification
     호출은 기본값(True)으로 기존 행위를 유지한다."""
     from .consumers import latest_done_by_stage
@@ -137,11 +138,39 @@ def _remove_clean_worktree(task_wt: str, wt: str, stage_n: int) -> tuple[str, st
     return None
 
 
+def _unmerged_branch_tip_warning(task_wt: str, stage_n: int, branch: str) -> str:
+    """Warn text when the stage branch tip is not an ancestor of the task
+    worktree HEAD, or "" when it is (or cannot be resolved).
+
+    Phase A merges `done.head_commit`, never the branch ref, so a stage branch
+    can carry commits that whole-task verification never saw. `local-checkout
+    --stage <N>` hands that branch to the user as a verified branch, so the
+    divergence has to be reported."""
+    from .worktree import is_ancestor
+
+    tip = _git(task_wt, "rev-parse", "--verify", "--quiet", branch)
+    if tip.returncode != 0:
+        return ""
+    sha = tip.stdout.strip()
+    head = _git(task_wt, "rev-parse", "HEAD").stdout.strip()
+    if is_ancestor(task_wt, sha, head):
+        return ""
+    return (f"stage {stage_n} 브랜치 {branch} 의 tip {sha[:12]} 이 검증된 task "
+            f"HEAD 에 포함되지 않습니다 — 검증에 포함되지 않은 커밋이 있습니다")
+
+
 def _teardown_stage(project_id, task_group, task_id, task_wt, stage_n, row):
-    """clean stage worktree 를 제거 + registry release + branch -d.
-    branch -d 가 성공한 뒤에만 branch 슬롯을 free 한다 — 물리 브랜치가
-    살아있는 채로 슬롯이 풀려 동시 run 이 같은 이름을 재예약하는 윈도우를
-    막기 위함. 반환 ('torn_down'|'skipped'|'warn', detail)."""
+    """Remove the clean stage worktree directory and mark the registry row
+    released. The stage branch is deliberately kept: the per-stage stack
+    branches must survive whole-task verification so that
+    `okstra handoff local-checkout --stage <N>` still has a target. The
+    branch's registry slot is not touched here — `consumers`'
+    `_release_stage_reservation` already freed it at stage-done time.
+
+    Warns when the surviving branch tip carries commits the verified merge
+    never included. Teardown itself is already complete at that point, so the
+    warning reports the divergence rather than undoing the cleanup. Returns
+    ('torn_down'|'skipped'|'warn', detail)."""
     from . import worktree_registry
 
     wt = (row or {}).get("worktree_path") or ""
@@ -152,12 +181,9 @@ def _teardown_stage(project_id, task_group, task_id, task_wt, stage_n, row):
             return outcome
     worktree_registry.release_status(project_id, task_group, task_id, stage_number=stage_n)
     if branch:
-        bd = _git(task_wt, "branch", "-d", branch)
-        if bd.returncode != 0:
-            return ("warn", f"stage {stage_n} branch -d {branch} 실패(미머지?): "
-                            f"{bd.stderr.strip()}")
-        worktree_registry.free_branch_slot(project_id, task_group, task_id,
-                                           stage_number=stage_n)
+        warning = _unmerged_branch_tip_warning(task_wt, stage_n, branch)
+        if warning:
+            return ("warn", warning)
     return ("torn_down", "")
 
 

package/runtime/python/okstra_ctl/user_response.py

@@ -24,7 +24,7 @@ from okstra_ctl.report_view_artifacts import user_responses_dir_for_report
 from okstra_ctl.listing import list_runs, absolute_final_report_path
 from okstra_ctl.clarification_items import (
     parse_clarification_rows,
-    scan_approval_gate,
+    scan_open_user_input,
     section_1_present_but_unparsed,
     _section_1_slice,
 )
@@ -118,7 +118,13 @@ def _seq_from_report(report: Path) -> str:
 
 
 def list_awaiting_tasks(home: Path, project_id: str, limit: int) -> list[dict]:
-    """approval-open clarification 이 있는 태스크를 최신 report mtime 순으로."""
+    """사용자 답변을 기다리는 clarification 이 있는 태스크를 최신 report mtime 순으로.
+
+    `Blocks=approval` 만 세면 열린 항목이 전부 `Blocks=next-phase` 인 리포트가
+    빈 목록으로 보이고, 스킬의 picker 자체에 진입할 수 없다(실측: dev-10172 —
+    열린 4건이 모두 next-phase 라 `list` 가 `[]` 를 냈다). 승인 게이트 판정은
+    `scan_approval_gate` 쪽 소비자들의 몫이고, 여기서는 답변 대기 전체를 센다.
+    """
     seen: set[str] = set()
     out: list[dict] = []
     for row in list_runs(home, project=project_id, limit=0):  # startedAt desc
@@ -131,18 +137,21 @@ def list_awaiting_tasks(home: Path, project_id: str, limit: int) -> list[dict]:
         if report is None or not report.is_file():
             continue
         text = report.read_text(encoding="utf-8")
-        scan = scan_approval_gate(text)
+        scan = scan_open_user_input(text)
         base = {"taskKey": key, "taskType": row.get("taskType", ""),
                 "seq": _seq_from_report(report), "reportPath": str(report),
                 "reportMtime": report.stat().st_mtime}
         if scan.unreadable_reason is not None:
             # §1 heading exists but drifted → real warning; §1 simply absent → skip.
             if section_1_present_but_unparsed(text):
-                out.append({**base, "openApprovalCount": 0, "unreadable": True})
+                out.append({**base, "openBlockerCount": 0, "openApprovalCount": 0,
+                            "unreadable": True})
             continue
         if not scan.blockers:
             continue
-        out.append({**base, "openApprovalCount": len(scan.blockers), "unreadable": False})
+        approval_count = sum(1 for it in scan.blockers if it.blocks == "approval")
+        out.append({**base, "openBlockerCount": len(scan.blockers),
+                    "openApprovalCount": approval_count, "unreadable": False})
     out.sort(key=lambda t: t["reportMtime"], reverse=True)
     return out[:limit] if limit > 0 else out
 

package/runtime/python/okstra_ctl/worker_heartbeat.py

@@ -9,6 +9,7 @@ the cadence budget live here rather than in either consumer.
 from __future__ import annotations
 
 import re
+from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -21,6 +22,36 @@ HEARTBEAT_LINE_RE = re.compile(
 # 고정 grace 60초를 더한다.
 HEARTBEAT_MAX_GAP_SECONDS = 5 * 60 + 60
 
+# 단일 도구 호출이 구간 전체를 차지해 워커가 하트비트를 끼워 넣을 수 없는 단계.
+# 한 번의 Write 가 진행되는 동안에는 `in-stage:` 라인도 append 할 수 없으므로
+# 5분 예산으로는 살아 있는 워커가 stalled 로 판정된다 (실측 dev-10172:
+# report-writer 가 74KB data.json 한 개를 쓰는 11분 동안 무하트비트).
+SINGLE_WRITE_STAGES = frozenset({
+    "data-json-write-start",
+    "render-start",
+    "write-result-start",
+})
+SINGLE_WRITE_MAX_GAP_SECONDS = 20 * 60 + 60
+
+
+def max_gap_seconds_after(stage: str) -> int:
+    """*stage* 를 알린 뒤 다음 하트비트까지 허용되는 최대 공백(초).
+
+    간격이 재는 것은 직전에 선언된 단계의 작업 시간이므로, 예산은 언제나
+    구간을 *여는* 단계에서 고른다."""
+    return (
+        SINGLE_WRITE_MAX_GAP_SECONDS
+        if stage in SINGLE_WRITE_STAGES
+        else HEARTBEAT_MAX_GAP_SECONDS
+    )
+
+
+@dataclass(frozen=True)
+class Heartbeat:
+    """사이드카에 기록된 하나의 heartbeat."""
+    stage: str
+    at: datetime
+
 
 def parse_timestamp(raw: str) -> datetime | None:
     """A heartbeat's ISO-8601 timestamp as an aware datetime, or None."""
@@ -31,7 +62,7 @@ def parse_timestamp(raw: str) -> datetime | None:
     return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
 
 
-def latest_heartbeat(sidecar: Path) -> datetime | None:
+def latest_heartbeat(sidecar: Path) -> Heartbeat | None:
     """The newest parseable heartbeat in *sidecar*, or None when it has none.
 
     Takes the maximum rather than the last line: a regressing timestamp is the
@@ -42,9 +73,9 @@ def latest_heartbeat(sidecar: Path) -> datetime | None:
         text = sidecar.read_text(encoding="utf-8")
     except OSError:
         return None
-    stamps = [
-        parsed
+    beats = [
+        Heartbeat(match.group("stage"), parsed)
         for match in HEARTBEAT_LINE_RE.finditer(text)
         if (parsed := parse_timestamp(match.group("ts"))) is not None
     ]
-    return max(stamps) if stamps else None
+    return max(beats, key=lambda beat: beat.at) if beats else None

package/runtime/python/okstra_ctl/worker_liveness.py

@@ -28,7 +28,11 @@ import sys
 from datetime import datetime, timezone
 from pathlib import Path
 
-from okstra_ctl.worker_heartbeat import HEARTBEAT_MAX_GAP_SECONDS, latest_heartbeat
+from okstra_ctl.worker_heartbeat import (
+    HEARTBEAT_MAX_GAP_SECONDS,
+    latest_heartbeat,
+    max_gap_seconds_after,
+)
 
 DEFAULT_LAUNCH_GRACE_SECONDS = 60
 
@@ -39,7 +43,12 @@ def _log_path(prompt: Path) -> Path:
 
 
 def probe_heartbeat(sidecar: Path, now: datetime, max_idle: float) -> dict:
-    """Liveness of one in-process worker, read from its audit sidecar."""
+    """Liveness of one in-process worker, read from its audit sidecar.
+
+    ``max_idle`` is the floor. A stage whose work is one uninterruptible tool
+    call carries its own, longer budget (``max_gap_seconds_after``) — during a
+    single large Write the worker cannot append a heartbeat at all.
+    """
     probe = {"kind": "heartbeat", "path": str(sidecar)}
     if not sidecar.is_file():
         # The worker writes the sidecar early but not instantly; absence is the
@@ -52,15 +61,19 @@ def probe_heartbeat(sidecar: Path, now: datetime, max_idle: float) -> dict:
             "state": "stalled",
             "reason": "audit sidecar carries no `- PROGRESS:` heartbeat",
         }
-    idle = (now - beat).total_seconds()
-    state = "stalled" if idle > max_idle else "live"
+    budget = max(max_idle, max_gap_seconds_after(beat.stage))
+    idle = (now - beat.at).total_seconds()
+    state = "stalled" if idle > budget else "live"
     return {
         **probe,
         "state": state,
         "idleSeconds": int(idle),
-        "lastHeartbeat": beat.isoformat(),
+        "lastHeartbeat": beat.at.isoformat(),
+        "lastStage": beat.stage,
+        "budgetSeconds": int(budget),
         "reason": (
-            f"no heartbeat for {int(idle)}s (budget {int(max_idle)}s)"
+            f"no heartbeat for {int(idle)}s after stage `{beat.stage}` "
+            f"(budget {int(budget)}s)"
             if state == "stalled"
             else ""
         ),

package/runtime/python/okstra_ctl/worker_prompt_contract.py

@@ -41,6 +41,7 @@ _NON_BODY_PREFIXES = (
     "**Worker Preamble Path:**",
     *ERRORS_PATH_HEADERS,
     "**Read scope:**",
+    "**File write mode:**",
     "**Worktree:**",
     "**Verification scope:**",
     "**Verification base ref:**",
@@ -63,6 +64,9 @@ _WORKER_SPECIFIC_PREFIXES = (
     "Assigned worker prompt history path:",
     "**Errors sidecar path:**",
     "**Worker Result Path:**",
+    # Only antigravity carries this (worker_prompt_headers.PLAIN_FILE_WRITE_HEADER)
+    # because only agy has an artifact store; unstripped it reads as divergence.
+    "**File write mode:**",
     "**Model:**",
     "**Pane role:**",
 )

package/runtime/python/okstra_ctl/worker_prompt_headers.py

@@ -37,6 +37,24 @@ READ_SCOPE_HEADER = (
     "or Assumptions* instead of reading it."
 )
 
+# `agy`'s write tool validates the target against the Gemini artifact store
+# whenever the model attaches ArtifactMetadata, and rejects every path outside
+# `~/.gemini/antigravity-cli/brain/<uuid>/`. All okstra worker outputs live under
+# `<PROJECT_ROOT>/.okstra/`, so an attached ArtifactMetadata fails the write —
+# usually on the audit sidecar, after which the CLI exits 0 having persisted no
+# result file. Only antigravity carries this: codex and claude have no artifact
+# store, and a shared header would break the cross-worker prompt-body equality
+# that `worker_prompt_contract` enforces.
+PLAIN_FILE_WRITE_HEADER = (
+    "**File write mode:** Write every okstra output (result file, audit "
+    "sidecar, errors sidecar) as a plain project file at the absolute path this "
+    "prompt gives. Do NOT attach ArtifactMetadata and do NOT route these writes "
+    "through the Gemini artifact store — artifact paths are restricted to the "
+    "brain folder, so an artifact write under `<PROJECT_ROOT>/.okstra/` is "
+    "rejected and the run ends with no result file."
+)
+ANTIGRAVITY_WORKER_ID = "antigravity"
+
 
 def worker_prompt_headers(
     *,
@@ -81,6 +99,8 @@ def worker_prompt_headers(
         f"**Errors sidecar path:** {errors_sidecar_path}",
         READ_SCOPE_HEADER,
     ])
+    if worker_id == ANTIGRAVITY_WORKER_ID:
+        headers.append(PLAIN_FILE_WRITE_HEADER)
     if _string_value(manifest.get("taskType")) == "improvement-discovery":
         headers.append(
             f"{GRILLING_LOG_HEADER} "

package/runtime/python/okstra_ctl/worktree.py

@@ -284,6 +284,43 @@ def _branch_exists(project_root: Path, branch: str) -> bool:
     return res.returncode == 0
 
 
+def _branch_checkout_path(project_root: Path, branch: str) -> str:
+    """The worktree that currently has *branch* checked out, or "" when none does.
+
+    `git branch -D` refuses to delete a checked-out branch, so an existing-branch
+    error that only recommends `-D` is unfollowable whenever the branch is the
+    main checkout's HEAD. Callers use this to name the extra step instead.
+    """
+    res = _git(project_root, "worktree", "list", "--porcelain")
+    if res.returncode != 0:
+        return ""
+    current = ""
+    for line in res.stdout.splitlines():
+        if line.startswith("worktree "):
+            current = line[len("worktree "):].strip()
+        elif line.strip() == f"branch refs/heads/{branch}":
+            return current
+    return ""
+
+
+def _branch_exists_message(project_root: Path, branch: str, kind: str) -> str:
+    """Existing-branch error text whose remedy is actually runnable."""
+    checkout = _branch_checkout_path(project_root, branch)
+    if checkout:
+        return (
+            f"{kind} worktree branch already exists: {branch}, and it is checked "
+            f"out at {checkout}. `git branch -D {branch}` will refuse while it is "
+            f"checked out — switch that checkout to another branch first "
+            f"(`git -C {checkout} switch <other-branch>`), then delete it, or "
+            "choose a different work-category before retrying."
+        )
+    return (
+        f"{kind} worktree branch already exists: {branch}. "
+        f"Delete it (`git branch -D {branch}`) or choose a different "
+        "work-category before retrying."
+    )
+
+
 def _head_sha(cwd: Path) -> str:
     res = _git(cwd, "rev-parse", "HEAD")
     if res.returncode != 0:
@@ -768,11 +805,7 @@ def provision_task_worktree(
             "(or `rm -rf` if it is not a registered worktree) before retrying."
         )
     if _branch_exists(project_root, branch):
-        raise RuntimeError(
-            f"task worktree branch already exists: {branch}. "
-            "Delete it (`git branch -D <branch>`) or choose a different "
-            "work-category before retrying."
-        )
+        raise RuntimeError(_branch_exists_message(project_root, branch, "task"))
 
     main_root = main_worktree_path(project_root)
     requested_base = (base_ref or "").strip()
@@ -921,10 +954,7 @@ def provision_stage_worktree(
             f"{worktree_path}. Remove it before retrying."
         )
     if _branch_exists(project_root, branch):
-        raise RuntimeError(
-            f"stage worktree branch already exists: {branch}. "
-            "Delete it (`git branch -D <branch>`) before retrying."
-        )
+        raise RuntimeError(_branch_exists_message(project_root, branch, "stage"))
 
     main_root = main_worktree_path(project_root)
     resolved_sha = _resolve_commit_sha(main_root, base_commit)

package/runtime/python/okstra_ctl/worktree_registry.py

@@ -275,10 +275,11 @@ def release_status(
 ) -> Optional[WorktreeEntry]:
     """Mark the entry as `released` WITHOUT freeing its branch index slot.
 
-    Use when the physical branch still exists and its name must stay
-    reserved — e.g. teardown defers the slot-free until `git branch -d`
-    actually succeeds, so the registry never advertises a free branch
-    name that is still alive on disk. Returns the prior entry, or None.
+    Use when the caller must not touch the branch index — either the slot is
+    still needed, or another caller owns its lifetime. Stage teardown is the
+    latter case: `consumers._release_stage_reservation` already ran `release()`
+    at stage-done time, so teardown only flips the status. Returns the prior
+    entry, or None.
     """
     key = task_key(project_id, task_group, task_id, stage_number, group_id)
     with _registry_lock():
@@ -323,11 +324,12 @@ def release(
     group_id: Optional[str] = None,
 ) -> Optional[WorktreeEntry]:
     """Mark the entry as `released` and free its branch slot (worktree dir
-    intact — preservation is the project's policy). Used by callers that
-    release at a point where the branch is gone or intentionally orphaned
-    (done-time reservation release, group cleanup). Teardown of a physical
-    branch must instead pair `release_status` + `free_branch_slot` so the
-    slot is freed only after `git branch -d` succeeds.
+    intact — preservation is the project's policy). Used at the points that
+    end a reservation's life: done-time stage release
+    (`consumers._release_stage_reservation`) and group cleanup. Both free the
+    slot even when the physical branch survives — stage stack branches are
+    deliberately kept, and their names are task-scoped, so a freed slot cannot
+    collide with a live branch from another task.
     Returns the prior entry, or None when not found.
     """
     entry = release_status(project_id, task_group, task_id, stage_number, group_id)

package/runtime/python/okstra_token_usage/collect.py

@@ -178,6 +178,55 @@ def _earliest_lead_session_ts(state: dict, team_state_path: Path) -> str | None:
     return earliest
 
 
+def _previous_run_suffix(run_dir: Path, suffix: str) -> str | None:
+    """같은 task-type 에서 이 run 직전에 실행된 run 의 접미사, 없으면 None.
+
+    seq 는 연속이 아닐 수 있으므로(실패한 prep 이 번호를 소모한다) manifest 를
+    실제로 스캔해 현재 seq 미만 중 최대를 고른다."""
+    task_type, _, raw_seq = suffix.rpartition("-")
+    if not task_type or not raw_seq.isdigit():
+        return None
+    current = int(raw_seq)
+    prefix, width = f"run-manifest-{task_type}-", len(raw_seq)
+    earlier = []
+    try:
+        names = [p.name for p in (run_dir / "manifests").iterdir()]
+    except OSError:
+        return None
+    for name in names:
+        if not (name.startswith(prefix) and name.endswith(".json")):
+            continue
+        candidate = name[len(prefix):-len(".json")]
+        if candidate.isdigit() and int(candidate) < current:
+            earlier.append(int(candidate))
+    if not earlier:
+        return None
+    return f"{task_type}-{max(earlier):0{width}d}"
+
+
+def _previous_run_end(run_dir: Path, suffix: str) -> str | None:
+    """직전 run 의 종료 시각 — 종료 산출물이 없으면 그 run 의 시작 시각.
+
+    `since` 완화의 하한이다. 한 세션에서 같은 task-type 을 두 번 돌리면
+    `leadSessionIds` 의 세션 jsonl 첫 ts 는 *첫 run* 의 시작을 가리키므로,
+    완화를 그대로 두면 seq002 의 윈도우가 seq001 구간을 통째로 삼킨다 —
+    seq001 의 PROGRESS 체크포인트가 seq002 검증에 섞여 순서 오탐을 낸다
+    (관측: dev-10172 — seq002 검증이 seq001 의 phase-6 타임스탬프를 인용)."""
+    prev = _previous_run_suffix(run_dir, suffix)
+    if prev is None:
+        return None
+    try:
+        prev_state = json.loads(
+            (run_dir / "state" / f"team-state-{prev}.json").read_text()
+        )
+        ended_at = prev_state.get("runEndedAt")
+        if ended_at:
+            return str(ended_at)
+    except (OSError, json.JSONDecodeError):
+        pass
+    return _run_end_estimate(run_dir, prev) or _run_manifest_created_at(run_dir, prev)
+
+
 def resolve_run_window(team_state_path: Path, state: dict) -> tuple[str | None, str | None]:
     """이 run 의 [시작, 종료] ISO 윈도우.
 
@@ -193,7 +242,11 @@ def resolve_run_window(team_state_path: Path, state: dict) -> tuple[str | None,
     늦게 찍히면(관측: dev-9902 — createdAt 11:43Z 가 05:34Z 시작 세션보다 늦음)
     since 가 앞선 세션을 잘라낸다. Task 3 이 기록한 `leadSessionIds[]` 세션의
     첫 ts 최소값이 createdAt 보다 앞서면 그 값으로 since 를 앞당긴다.
-    `leadSessionIds` 부재(legacy)면 createdAt 그대로 — 기존 동작 불변."""
+    `leadSessionIds` 부재(legacy)면 createdAt 그대로 — 기존 동작 불변.
+
+    완화 하한: 직전 run 의 종료 시각 이전으로는 내려가지 않는다
+    (`_previous_run_end`). 세션 jsonl 은 run 마다 새로 생기지 않으므로 하한이
+    없으면 같은 세션의 이전 run 이 이 윈도우에 통째로 들어온다."""
     suffix = run_artifact_suffix(team_state_path)
     if not suffix:
         return None, None
@@ -202,6 +255,9 @@ def resolve_run_window(team_state_path: Path, state: dict) -> tuple[str | None,
     earliest = _earliest_lead_session_ts(state, team_state_path)
     if earliest and (since is None or earliest < since):
         since = earliest
+    floor = _previous_run_end(run_dir, suffix)
+    if floor and since and since < floor:
+        since = floor
     until = state.get("runEndedAt") or _run_end_estimate(run_dir, suffix) or utc_now()
     return since, until