okstra 0.176.1 → 0.177.1

package/runtime/python/okstra_ctl/run.py

@@ -1580,7 +1580,7 @@ def _materialize_release_handoff_input(
     반환: ctx 에 올릴 {"HANDOFF_MODE": ..., "HANDOFF_STAGES": ...}."""
     from .consumers import read_consumers
     from .handoff import (HandoffError, _require_eligible,
-                          latest_whole_task_fv_accepted)
+                          latest_whole_task_fv_release_ready)
     from .paths import task_dir
     from .render import render_template_with_ctx
     from .run_context import _now_task_date
@@ -1622,7 +1622,7 @@ def _materialize_release_handoff_input(
         stages_csv = ",".join(str(n) for n in nums)
         report_rows = _collect_handoff_source_report_rows(rows, nums)
     else:
-        report = latest_whole_task_fv_accepted(
+        report = latest_whole_task_fv_release_ready(
             project_root, inp.project_id, inp.task_group, inp.task_id)
         if not report:
             raise PrepareError(
@@ -1659,6 +1659,33 @@ def _materialize_release_handoff_input(
     return {"HANDOFF_MODE": mode, "HANDOFF_STAGES": stages_csv}
 
 
+QA_COMMAND_EXECUTING_TASK_TYPES = ("implementation", "final-verification")
+
+
+def validate_project_qa_commands(task_type: str, project_root: Path) -> None:
+    """`qaCommands` 를 실행하는 phase 진입에서 변경성 토큰 선언을 막는다.
+
+    `implementation` 은 verifier 의 QA gate baseline 으로, `final-verification` 은
+    프로파일이 정의한 Tier 2 재실행 집합으로 같은 선언을 읽는다. 실행 직전에 리드가
+    스스로 걸러내게 두면 그 자기검사가 유일한 방어선이 되므로 진입에서 막는다.
+    나머지 task-type 은 이 선언을 읽지 않아 잘못된 값이 있어도 동작에 닿지 않는다.
+    """
+    if task_type not in QA_COMMAND_EXECUTING_TASK_TYPES:
+        return
+    project_json = project_json_path(project_root)
+    if not project_json.is_file():
+        return
+    try:
+        project_meta = json.loads(project_json.read_text())
+    except (OSError, json.JSONDecodeError) as exc:
+        raise PrepareError(
+            f"project.json read failed at {project_json}: {exc}"
+        ) from exc
+    qa_errors = validate_qa_commands(project_meta.get("qaCommands"))
+    if qa_errors:
+        raise PrepareError(_format_qa_errors(qa_errors))
+
+
 def _apply_qa_waiver_if_requested(inp: "PrepareInputs", project_root: Path) -> None:
     """`--qa-waiver` 가 있으면 task-level 매니페스트 entry 의 waiver 를 채운다.
 
@@ -1745,21 +1772,9 @@ def _register_and_check_project(project_root: Path, inp: PrepareInputs) -> None:
         # is preserved by the `: {exc}` suffix and the `raise ... from exc`.
         raise PrepareError(f"project.json upsert failed for {project_root}: {exc}") from exc
 
-    # `qaCommands` 는 implementation phase verifier 의 QA gate baseline 으로만
-    # 쓰이므로 검증도 implementation 진입 시에만 수행한다. 다른 task-type 에서는
-    # 잘못된 선언이 있어도 동작에 영향이 없어 fail-fast 할 이유가 없다.
+    validate_project_qa_commands(inp.task_type, project_root)
+    # waiver 는 stage 단위 Tier 3 면제라 implementation 진입에서만 적용한다.
     if inp.task_type == "implementation":
-        project_json = project_json_path(project_root)
-        if project_json.is_file():
-            try:
-                project_meta = json.loads(project_json.read_text())
-            except (OSError, json.JSONDecodeError) as exc:
-                raise PrepareError(
-                    f"project.json read failed at {project_json}: {exc}"
-                ) from exc
-            qa_errors = validate_qa_commands(project_meta.get("qaCommands"))
-            if qa_errors:
-                raise PrepareError(_format_qa_errors(qa_errors))
         _apply_qa_waiver_if_requested(inp, project_root)
 
 
@@ -1914,12 +1929,19 @@ def _build_static_execution_manifest(
     plan: AssignmentPlan,
     context: AssignmentContext,
     lead: ResolvedAssignment,
+    translator: ResolvedAssignment,
 ) -> ExecutionManifest:
     participants: list[ParticipantAssignment] = []
     roles: list[RoleExecution] = []
+    # The translator is resolved outside the role plan, like the lead, and both
+    # are named in `invocationAssignments`. Without a role execution here,
+    # `agent-prompt materialize --audience translator` has no canonical
+    # identity to bind to and refuses — so a `reportLanguage: ko` run could
+    # never write its translation sidecar and rendered the English source.
     assignments = (
         lead,
         *(row for row in plan.assignments if row.role != "leader"),
+        translator,
     )
     for index, assignment in enumerate(assignments, start=1):
         participant_ref = f"participant-{index:03d}"
@@ -2130,8 +2152,14 @@ def _canonical_selection_provider_ids(
         and "implementer" not in scopes.global_
     )
     if implementer_uses_bundled_default:
+        # `--executor` names the provider that implements, so it belongs in the
+        # roster the same way the bundled default does. Reading only the default
+        # left `--executor <provider>` with no assignment of its own: the run
+        # rendered without that provider, and asking for it with `--workers`
+        # was refused as not being in the roster.
         selected.append(
-            _default("OKSTRA_DEFAULT_EXECUTOR", "claude")
+            (inp.executor or "").strip().lower()
+            or _default("OKSTRA_DEFAULT_EXECUTOR", "claude")
         )
     if _needs_profile_worker_candidates(profile, selection, scopes):
         selected.extend(
@@ -2287,6 +2315,7 @@ class RoleAssignment:
     role: str
     provider: str
     model_display: str
+    model_id: str
     model_execution_value: str
     runner: str
     host_runtime: str
@@ -2294,9 +2323,14 @@ class RoleAssignment:
     worker_id: str = ""
 
     def to_model_payload(self) -> dict[str, object]:
+        # `model` carries the catalog model id, not the display name: the run
+        # manifest's role executions record `modelId`, and the two are compared
+        # to bind an assignment to its execution. A display name that differs
+        # from its id (every antigravity and kimi model) made that comparison
+        # fail for the whole provider.
         return {
             "provider": self.provider,
-            "model": self.model_display,
+            "model": self.model_id,
             "modelExecutionValue": self.model_execution_value,
             "runner": self.runner,
             "hostRuntime": self.host_runtime,
@@ -2336,6 +2370,7 @@ class _ModelBindings:
     lead_assignment: RoleAssignment
     worker_assignments: tuple[RoleAssignment, ...]
     invocation_assignments: dict[str, dict[str, object]]
+    translator: ResolvedAssignment
 
 
 @dataclass(frozen=True)
@@ -2613,6 +2648,7 @@ def _resolve_model_bindings(
         resolved=translator_meta,
         role="translator",
     )
+    _reject_split_worker_models(executor_assignment, worker_assignments)
     invocation_assignments = _build_invocation_assignments(
         lead_assignment,
         worker_assignments,
@@ -2641,6 +2677,7 @@ def _resolve_model_bindings(
         lead_assignment=lead_assignment,
         worker_assignments=worker_assignments,
         invocation_assignments=invocation_assignments,
+        translator=translator_meta,
     )
 
 
@@ -2759,6 +2796,8 @@ def _project_model_bindings(
         provider: _legacy_projection_from_plan(provider, plan, context)
         for provider in ("claude", "codex", "antigravity")
     }
+    _reject_executor_outside_roster(executor_assignment, workers)
+    _reject_split_worker_models(executor_assignment, workers)
     invocation_assignments = _build_invocation_assignments(
         lead_assignment,
         workers,
@@ -2793,6 +2832,7 @@ def _project_model_bindings(
         lead_assignment=lead_assignment,
         worker_assignments=workers,
         invocation_assignments=invocation_assignments,
+        translator=translator,
     )
 
 
@@ -2843,6 +2883,64 @@ def _selected_execution_provider_ids(
     return tuple(dict.fromkeys(selected))
 
 
+def _reject_executor_outside_roster(
+    executor: RoleAssignment | None,
+    workers: tuple[RoleAssignment, ...],
+) -> None:
+    """Refuse an executor whose provider the roster never dispatches.
+
+    An implementation run opens its executor with `--workers <provider>`, so a
+    provider absent from the roster has no invocation to open. The legacy
+    selection path says so outright; the canonical path derived its roster from
+    role models alone, so `--executor <provider>` rendered fine and the run only
+    failed later, at `requested worker(s) are not in this run roster`.
+    """
+    if executor is None:
+        return
+    roster = {row.worker_id for row in workers if row.worker_id}
+    if executor.worker_id in roster:
+        return
+    raise PrepareError(
+        f"--executor {executor.worker_id} is not in this run's roster "
+        f"({', '.join(sorted(roster)) or 'empty'}); the executor is dispatched "
+        f"as a worker, so give it a roster slot — "
+        f"--role-model verifier={executor.worker_id}/<model> — or pick an "
+        f"executor already in the roster."
+    )
+
+
+def _reject_split_worker_models(
+    executor: RoleAssignment | None,
+    workers: tuple[RoleAssignment, ...],
+) -> None:
+    """Refuse one worker id standing for two roles on two different models.
+
+    The roster names a worker by provider, so an implementation run whose
+    executor and verifier are the same provider shares that id — but
+    `invocationAssignments["initial/<id>"]` can hold only one model, and it
+    holds the verifier's. Dispatch then looks the executor's role execution up
+    by that assignment, finds no row with a matching execution value, and stops
+    at `v2 execution identity does not match a canonical role execution`. The
+    render used to succeed and only the dispatch failed, by which point the run
+    had already claimed its stage.
+    """
+    if executor is None:
+        return
+    peer = next(
+        (row for row in workers if row.worker_id == executor.worker_id),
+        None,
+    )
+    if peer is None or peer.model_execution_value == executor.model_execution_value:
+        return
+    raise PrepareError(
+        f"worker {executor.worker_id!r} is the executor on "
+        f"{executor.model_execution_value!r} and a verifier on "
+        f"{peer.model_execution_value!r}; one worker id carries one model. "
+        f"Give both roles the same model, or pick a different --executor "
+        f"provider."
+    )
+
+
 def _resolve_executor_assignment(
     inp: PrepareInputs,
     workers: list[str],
@@ -2915,6 +3013,7 @@ def _role_assignment(
             role=role,
             provider=resolved.provider_id,
             model_display=resolved.display_name,
+            model_id=resolved.model_id,
             model_execution_value="unknown",
             runner="cli-wrapper",
             host_runtime=resolved.host_runtime,
@@ -2925,6 +3024,7 @@ def _role_assignment(
         role=role,
         provider=resolved.provider_id,
         model_display=resolved.display_name,
+        model_id=resolved.model_id,
         model_execution_value=binding.resolved_execution_value,
         runner=(
             "native-session"
@@ -4071,6 +4171,7 @@ def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
         assignment_plan,
         assignment_context,
         models.lead,
+        models.translator,
     )
     dynamic_roles = tuple(
         requirement.role

package/runtime/python/okstra_ctl/stage_targets.py

@@ -767,7 +767,10 @@ def _acquire_whole_task_target(
             )
             or ""
         ),
-        teardown=True,
+        # 정리는 판정 뒤로 미룬다(Phase 7 `teardown-stages`). 되돌릴 수 없는 정리를
+        # 판정 앞에 두면, 재작업이 가장 필요한 blocked 판정에서 stage 작업물이 이미
+        # 사라져 있다. 여기서는 통합만 하고 worktree/registry 키는 남긴다.
+        teardown=False,
     )
     return FinalVerificationTargetAcquisition(
         target=whole["target"],
@@ -776,6 +779,75 @@ def _acquire_whole_task_target(
     )
 
 
+def integrate_and_teardown_whole_task(
+    *, project_root: Path, task_group: str, task_id: str,
+) -> dict[str, Any]:
+    """판정이 끝난 whole-task 검증의 stage worktree 와 registry 키를 회수한다.
+
+    진입은 통합만 하고 정리를 남겨 두므로(`_resolve_whole_task_acquisition`), 정리는
+    판정 뒤인 Phase 7 에서 여기로 들어온다. 통합은 이미 끝나 있어 Phase A 는 전부
+    `already_merged` 로 지나가고 Phase B 만 실제 일을 한다. 두 번 불려도 결과는 같다 —
+    사라진 worktree 는 건너뛰고, 미커밋 변경이 남은 stage 트리는 보존한다.
+
+    stage_map 은 done 행에서 만든다. 정리 대상은 완료된 stage 뿐이고, 계획에만 있고
+    완료되지 않은 stage 는 Phase A 가 어차피 건너뛰기 때문이다.
+    """
+    from json import loads as _loads
+
+    from okstra_project.dirs import okstra_home, project_json_path
+
+    from . import consumers, worktree_registry
+    from .locks import worktree_provision_mutex
+    from .paths import task_runs_dir
+    from .stage_integrate import integrate_stages
+
+    try:
+        project_id = _loads(
+            project_json_path(project_root).read_text(encoding="utf-8")
+        ).get("projectId", "")
+    except (OSError, ValueError):
+        project_id = ""
+    if not project_id:
+        return {"skipped": "project.json declares no projectId"}
+
+    plan_run_root = task_runs_dir(
+        project_root, task_group, task_id
+    ) / "implementation-planning"
+    done_rows = [
+        row for row in consumers.read_consumers(plan_run_root)
+        if row.get("status") == "done"
+    ]
+    if not done_rows:
+        return {"skipped": "no done stage rows to reclaim"}
+    stage_map = [
+        {"stage_number": stage}
+        for stage in sorted(consumers.latest_done_by_stage(done_rows))
+    ]
+
+    entry = worktree_registry.lookup(project_id, task_group, task_id)
+    if entry is None:
+        return {"skipped": "task worktree is no longer registered"}
+
+    with worktree_provision_mutex(okstra_home(), project_id, task_group, task_id):
+        result = integrate_stages(
+            project_id=project_id,
+            task_group=task_group,
+            task_id=task_id,
+            task_worktree_path=entry.worktree_path,
+            stage_map=stage_map,
+            done_rows=done_rows,
+            teardown=True,
+        )
+    return {
+        "tornDown": result.torn_down,
+        "teardownSkipped": [
+            {"stage": stage, "reason": reason}
+            for stage, reason in result.teardown_skipped
+        ],
+        "warnings": result.warnings,
+    }
+
+
 def acquire_final_verification_target(
     request: FinalVerificationTargetRequest,
 ) -> FinalVerificationTargetAcquisition:

package/runtime/python/okstra_ctl/team.py

@@ -2,8 +2,12 @@
 
 Under cmux this is every lead's door onto cmux surfaces, because okstra owns the
 panes there rather than the host. Outside cmux a worker owns no pane at all — it
-runs as a cli-wrapper subprocess — so there is nothing for teardown to reclaim.
-Which backend a run uses is read from its run manifest.
+runs as a cli-wrapper subprocess — so there is no pane for either closing
+command to act on. Which backend a run uses is read from its run manifest.
+
+`reclaim` is the round boundary and `teardown` is the end of the run: the first
+closes nothing but the finished dispatches' panes, the second takes every
+recorded pane and writes off whatever never finished.
 """
 from __future__ import annotations
 
@@ -18,7 +22,11 @@ from . import cmux
 from .adapters.dispatch import provider_worker_wrappers
 from .adapters.dispatch.cmux import dispatch_port_for_terminal_backend
 from .application.dispatch_assignments import dispatch_assignments
-from .dispatch_state import TEARDOWN_BEFORE_TERMINAL_REASON, mutate_team_state
+from .dispatch_state import (
+    TEARDOWN_BEFORE_TERMINAL_REASON,
+    TERMINAL_WORKER_STATUSES,
+    mutate_team_state,
+)
 from .dispatch_core import (
     BACKEND_CLI_WRAPPER,
     BACKEND_CMUX_PANE,
@@ -34,7 +42,6 @@ from .session import observe_lead_session
 
 
 _SUPPORTED_WRAPPERS = provider_worker_wrappers(default_provider_registry())
-_TERMINAL_STATUSES = {"completed", "timeout", "error", "not-run"}
 
 
 def main(argv: Sequence[str] | None = None) -> int:
@@ -47,6 +54,8 @@ def main(argv: Sequence[str] | None = None) -> int:
             return _await(args)
         if args.command == "teardown":
             return _teardown(args)
+        if args.command == "reclaim":
+            return _reclaim(args)
     except DispatchError as exc:
         print(f"okstra team: {exc}", file=sys.stderr)
         return 2
@@ -62,6 +71,7 @@ def _parser() -> argparse.ArgumentParser:
     _add_dispatch_parser(sub)
     _add_await_parser(sub)
     _add_teardown_parser(sub)
+    _add_reclaim_parser(sub)
     return parser
 
 
@@ -85,7 +95,19 @@ def _add_await_parser(sub) -> None:
 
 
 def _add_teardown_parser(sub) -> None:
-    parser = sub.add_parser("teardown", help="reclaim this run's worker panes")
+    parser = sub.add_parser(
+        "teardown", help="close every recorded pane at the end of the run"
+    )
+    _add_run_args(parser)
+    parser.add_argument("--dry-run", action="store_true")
+    parser.add_argument("--json", action="store_true")
+
+
+def _add_reclaim_parser(sub) -> None:
+    parser = sub.add_parser(
+        "reclaim",
+        help="close the finished dispatches' panes at a round boundary",
+    )
     _add_run_args(parser)
     parser.add_argument("--dry-run", action="store_true")
     parser.add_argument("--json", action="store_true")
@@ -161,8 +183,47 @@ def _teardown(args) -> int:
     team_state = _load_json(team_state_path, "team-state")
     panes = _reclaimable_panes(manifest, team_state)
     if args.dry_run:
-        _emit_teardown(args.json, panes)
+        _emit_panes(args.json, panes)
+        return 0
+    _close_panes(manifest, panes)
+    _mark_teardown_errors(team_state_path)
+    _emit_panes(args.json, panes)
+    return 0
+
+
+def _reclaim(args) -> int:
+    """Close the finished dispatches' surfaces at a round boundary.
+
+    Two things teardown does are wrong here. It closes every recorded surface,
+    which mid-round would kill the workers still running; and it writes off every
+    non-terminal dispatch as an error, which would drop a worker out of the retry
+    path it has not reached yet. So this shares the closing and the reporting and
+    nothing else.
+    """
+    manifest = _load_manifest(args.project_root, args.run_manifest)
+    _validate_team_manifest(manifest)
+    project_root = Path(args.project_root).resolve()
+    team_state_path = _resolve_project_path(
+        project_root, _require_string(manifest, "teamStatePath")
+    )
+    team_state = _load_json(team_state_path, "team-state")
+    panes = _reclaimable_panes(manifest, team_state, finished_only=True)
+    if args.dry_run:
+        _emit_panes(args.json, panes)
         return 0
+    _close_panes(manifest, panes)
+    _emit_panes(args.json, panes)
+    return 0
+
+
+def _close_panes(manifest: Mapping[str, Any], panes: list[dict[str, str]]) -> None:
+    """Close the given surfaces, then give the lead its width back.
+
+    The width recovery belongs here rather than to teardown alone. cmux hands the
+    freed width to a neighbour it picks, and that neighbour is not always the
+    lead — so a round boundary that closed panes and stopped there leaves the
+    lead squeezed for exactly the stretch the user spends reading it.
+    """
     from .adapters.runtime.assembly import port_for, runtime_chain
     from .domain.worker_runtime import RuntimeHandle, SURFACE_CMUX_PANE
 
@@ -178,9 +239,6 @@ def _teardown(args) -> int:
         chain[0].restore_lead()
     except (OSError, subprocess.SubprocessError, RuntimeError) as exc:
         print(f"okstra team: could not restore the lead's width: {exc}", file=sys.stderr)
-    _mark_teardown_errors(team_state_path)
-    _emit_teardown(args.json, panes)
-    return 0
 
 
 def _observe_lead_session_from_manifest(
@@ -240,10 +298,19 @@ def _await_payload(plan: DispatchPlan, completed: bool) -> dict[str, Any]:
 
 
 def _reclaimable_panes(
-    manifest: Mapping[str, Any], team_state: Mapping[str, Any]
+    manifest: Mapping[str, Any],
+    team_state: Mapping[str, Any],
+    *,
+    finished_only: bool = False,
 ) -> list[dict[str, str]]:
     """Everything this run owns and may close.
 
+    `finished_only` is what separates a round boundary from the end of the run.
+    Teardown closes every recorded surface because no dispatch is expected to
+    continue past it. Mid-round the live workers' surfaces must survive, so
+    reclaim asks for the finished ones only — closing an `in-progress` surface
+    kills that worker and the round has no result to show for it.
+
     The recorded ids are the only candidates. There is no per-pane tag API to
     sweep with, and scanning by title would be worse than nothing: cmux labels
     its own agent surfaces with the same glyph the harness uses for a teammate
@@ -254,8 +321,11 @@ def _reclaimable_panes(
     seen: set[str] = set()
     panes: list[dict[str, str]] = []
     for record in team_state.get("workerDispatches", []):
-        if isinstance(record, dict):
-            _append_pane(panes, seen, str(record.get("paneId", "")), "worker")
+        if not isinstance(record, dict):
+            continue
+        if finished_only and record.get("status") not in TERMINAL_WORKER_STATUSES:
+            continue
+        _append_pane(panes, seen, str(record.get("paneId", "")), "worker")
     if _is_cmux_run(manifest):
         return _still_open_surfaces(panes)
     return panes
@@ -295,7 +365,7 @@ def _mark_teardown_errors(team_state_path: Path) -> None:
     def mark(payload: dict[str, Any]) -> bool:
         changed = False
         for record in payload.get("workerDispatches", []):
-            if isinstance(record, dict) and record.get("status") not in _TERMINAL_STATUSES:
+            if isinstance(record, dict) and record.get("status") not in TERMINAL_WORKER_STATUSES:
                 record["status"] = "error"
                 record["reason"] = TEARDOWN_BEFORE_TERMINAL_REASON
                 changed = True
@@ -304,7 +374,7 @@ def _mark_teardown_errors(team_state_path: Path) -> None:
     mutate_team_state(team_state_path, mark)
 
 
-def _emit_teardown(as_json: bool, panes: list[dict[str, str]]) -> None:
+def _emit_panes(as_json: bool, panes: list[dict[str, str]]) -> None:
     if as_json:
         _print_json({"panes": panes})
         return

package/runtime/python/okstra_ctl/tmux.py

@@ -16,9 +16,8 @@ from typing import Optional, Sequence
 
 # container watcher/tail pane 전용 태그. 이 태그가 붙은 pane 은 세션 종료 후에도
 # 생존한다 — watcher/tail 의 "세션 후 생존" 불변식이다. 예전에는 SessionEnd 의
-# `okstra-trace-cleanup.sh --reap` 이 다른 태그만 스캔한다는 사실이 그 생존을
-# 지탱했지만, 지금은 그 모드와 훅 자체가 없어 pane 을 세션 경계에서 회수하는
-# 주체가 아예 없다. 회수는 `down` / `stop-watcher` 의 스코프 reap 뿐이다.
+# 태그 스캔이 다른 태그만 본다는 사실이 그 생존을 지탱했지만, 지금은 그 스캔과
+# 훅과 스크립트 자체가 없어 pane 을 세션 경계에서 회수하는 주체가 아예 없다. 회수는 `down` / `stop-watcher` 의 스코프 reap 뿐이다.
 CONTAINER_TAG_OPTION = "@okstra_container_run"
 
 

package/runtime/python/okstra_ctl/wizard.py

@@ -1406,26 +1406,35 @@ def _role_add_prompt(
     state: WizardState,
     requirement: RoleRequirement,
 ) -> Prompt:
-    """min=0 선택 역할: 기본은 추가 안 함, 추가 시 1..max 수량을 이 스텝에서 고른다."""
+    """min=0 선택 역할: 프로필의 적정 수량이 기본이고, 1..max 를 이 스텝에서 고른다.
+
+    적정이 0 이면 기본은 추가 안 함이다. 0 보다 큰 적정을 선언한 역할만 기본이 열린
+    상태로 뜬다 — 어느 쪽이든 사용자는 이 화면에서 바꿀 수 있다.
+    """
     prompt = _p(
         state.workspace_root,
         "role_add",
         role=requirement.role,
         maximum=str(requirement.max_count),
     )
+    suffix = prompt["options"].get("default_suffix", "")
+
+    def _default_suffix(count: int) -> str:
+        return suffix if count == requirement.recommended_count else ""
+
     options = [
         _opt(
             "0",
-            prompt["options"]["skip"].format(
-                default_suffix=prompt["options"].get("default_suffix", ""),
-            ),
+            prompt["options"]["skip"].format(default_suffix=_default_suffix(0)),
         ),
     ]
     for count in range(1, requirement.max_count + 1):
         options.append(
             _opt(
                 str(count),
-                prompt["options"]["add"].format(count=count),
+                prompt["options"]["add"].format(
+                    count=count, default_suffix=_default_suffix(count),
+                ),
             )
         )
     return Prompt(
@@ -3865,10 +3874,10 @@ def _handoff_eligibility(state: WizardState) -> list:
     return compute_eligibility(stage_map, rows)
 
 
-def _latest_whole_task_fv_accepted(state: WizardState) -> str:
+def _latest_whole_task_fv_release_ready(state: WizardState) -> str:
     """accepted whole-task final-verification 보고서 경로 — handoff 모듈 SSOT 위임."""
-    from okstra_ctl.handoff import latest_whole_task_fv_accepted
-    return latest_whole_task_fv_accepted(
+    from okstra_ctl.handoff import latest_whole_task_fv_release_ready
+    return latest_whole_task_fv_release_ready(
         state.project_root, state.project_id, state.task_group, state.task_id)
 
 
@@ -3876,7 +3885,7 @@ def _build_handoff_stage_pick(state: WizardState) -> Prompt:
     elig = _handoff_eligibility(state)
     eligible = [e for e in elig if e["eligible"]]
     blocked = [e for e in elig if not e["eligible"]]
-    whole_task_report = _latest_whole_task_fv_accepted(state)
+    whole_task_report = _latest_whole_task_fv_release_ready(state)
     msgs = _handoff_msgs(state)
     blocked_summary = ("; ".join(
         f"stage {e['stage']} ({', '.join(e['reasons'])})" for e in blocked)
@@ -3908,7 +3917,7 @@ def _submit_handoff_stage_pick(state: WizardState, value: str) -> Optional[str]:
     if WHOLE_TASK_STAGE in picks:
         if len(picks) > 1:
             raise WizardError(t["errors"]["whole_task_exclusive"])
-        if not _latest_whole_task_fv_accepted(state):
+        if not _latest_whole_task_fv_release_ready(state):
             raise WizardError(t["errors"]["whole_task_missing"])
         state.handoff_mode = "whole-task"
         state.handoff_stages = ""

package/runtime/python/okstra_ctl/worker_liveness.py

@@ -37,6 +37,8 @@ from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 
+from .wrapper_status import log_path_for_prompt
+
 from okstra_ctl.dispatch_state import (
     DispatchError,
     LIVENESS_AUDIT_HEARTBEAT,
@@ -69,7 +71,7 @@ def _utc_now() -> datetime:
 
 def _log_path(prompt: Path) -> Path:
     """The wrapper's live log, named as okstra-*-exec.sh names it."""
-    return prompt.with_suffix(".log") if prompt.suffix == ".md" else Path(f"{prompt}.log")
+    return log_path_for_prompt(prompt)
 
 
 def probe_heartbeat(

package/runtime/python/okstra_ctl/worker_runner.py

@@ -225,8 +225,8 @@ class _AbnormalExit:
     their default disposition ends the process outright, and nothing in this
     file runs (measured — a bash ``trap … EXIT`` does fire on SIGTERM, which is
     why the shell wrappers needed no equivalent of this class). Those two are
-    the common abnormal exits: a pane kill, ``okstra-trace-cleanup.sh``, session
-    teardown. Without this the sidecar stays at ``started`` and
+    the common abnormal exits: a pane close, ``okstra team reclaim`` /
+    ``okstra team teardown``, session teardown. Without this the sidecar stays at ``started`` and
     ``worker_liveness`` reads a dead worker as a working one.
 
     SIGKILL and a host crash remain uncovered because nothing can cover them. A

package/runtime/python/okstra_ctl/wrapper_status.py

@@ -25,6 +25,21 @@ def status_path_for_prompt(prompt_path: Path) -> Path:
     return prompt_path.with_suffix(prompt_path.suffix + ".status.json")
 
 
+def log_path_for_prompt(prompt_path: Path) -> Path:
+    """Where the wrapper writes its live log for this prompt.
+
+    A `.md` prompt drops that suffix rather than stacking on it, so the log of
+    `…-009.md` is `…-009.log` and not `…-009.md.log`. Both spellings existed:
+    the entrypoint wrote the first while the dispatcher listed the second among
+    the write policy's allowed artifacts, so every CLI worker's own log read as
+    an unauthorized change to the artifact root. One function now, because the
+    disagreement stays invisible until an audit compares the two.
+    """
+    if prompt_path.name.endswith(".md"):
+        return prompt_path.with_name(f"{prompt_path.name[:-3]}.log")
+    return Path(f"{prompt_path}.log")
+
+
 def read_wrapper_status(path: Path) -> WrapperStatus | None:
     try:
         raw = json.loads(path.read_text(encoding="utf-8"))