okstra 0.179.2 → 0.183.2

package/runtime/python/okstra_ctl/claim_reproduction.py

@@ -0,0 +1,101 @@
+"""사실 주장의 재현.
+
+계획 검증의 1표 차단(`kind a`, `P-Req` 의 `kind f`)에는 근거가 있다 — 명시된 두
+인용이 서로 모순이라는 것은 한 명이 실측으로 확정할 수 있는 사실이고, 사실을
+다수결로 기각하면 안 된다. 문제는 1표라는 것이 아니라 **1표에 재현 요구가 없다**는
+것이었다. 검증자가 "이 경로는 존재하지 않는다" 라고 쓰면 그대로 차단이 됐다.
+
+여기서 재현은 워커가 아니라 이 코드가 실행한다. 워커가 결과까지 신고하면 판정이
+자기신고 위에 서고, 같은 주장이 워커마다 다르게 결론난다.
+
+대가는 표현력이다. 여기서 돌릴 수 있는 형태로만 사실 주장을 쓸 수 있고, 그 밖의
+것은 `judgement` 로 내어 정족수로 판정한다. 강등이 아니라 분류다 — 기계가 확인할
+수 없는 것에 1표 차단을 주는 것이 애초에 틀렸다.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Mapping
+
+REPRODUCED = "reproduced"
+NOT_REPRODUCED = "not-reproduced"
+NOT_RUNNABLE = "not-runnable"
+
+PROBE_KINDS = (
+    "path-exists",
+    "path-absent",
+    "literal-present",
+    "literal-absent",
+    "citations-differ",
+)
+
+_MAX_READ_BYTES = 4_000_000
+
+
+def _within(project_root: Path, value: object) -> Path | None:
+    """프로젝트 안의 경로. 밖으로 나가거나 모양이 아니면 ``None``.
+
+    재현은 검증자가 쓴 문자열을 그대로 받는다. 담아 두지 않으면 그 문자열 하나로
+    프로젝트 밖을 읽게 된다.
+    """
+    if not isinstance(value, str) or not value.strip():
+        return None
+    candidate = Path(value)
+    resolved = (
+        candidate if candidate.is_absolute() else project_root / candidate
+    )
+    try:
+        resolved = resolved.resolve()
+        root = project_root.resolve()
+    except (OSError, RuntimeError):
+        return None
+    return resolved if resolved == root or root in resolved.parents else None
+
+
+def _read(path: Path) -> str | None:
+    try:
+        if not path.is_file() or path.stat().st_size > _MAX_READ_BYTES:
+            return None
+        return path.read_text(encoding="utf-8", errors="replace")
+    except (OSError, ValueError):
+        return None
+
+
+def reproduce(probe: object, *, project_root: Path) -> str:
+    """이 프로브를 실행한 결과.
+
+    ``reproduced`` 는 주장이 성립한다는 뜻이고, ``not-reproduced`` 는 근거가
+    성립하지 않는다는 뜻이다. ``not-runnable`` 은 판정하지 않았다는 뜻이며 —
+    프로브의 모양이 아니거나, 경로가 프로젝트 밖이거나, 파일을 못 읽은 경우다 —
+    소비처는 이것을 `judgement` 와 같게 다뤄야 한다. 못 돌린 것을 재현 실패로
+    읽으면 도구의 한계가 주장의 기각이 된다.
+    """
+    if not isinstance(probe, Mapping):
+        return NOT_RUNNABLE
+    kind = str(probe.get("kind") or "")
+    if kind not in PROBE_KINDS:
+        return NOT_RUNNABLE
+
+    if kind in ("path-exists", "path-absent"):
+        path = _within(project_root, probe.get("path"))
+        if path is None:
+            return NOT_RUNNABLE
+        exists = path.exists()
+        return REPRODUCED if exists == (kind == "path-exists") else NOT_REPRODUCED
+
+    if kind in ("literal-present", "literal-absent"):
+        path = _within(project_root, probe.get("path"))
+        literal = probe.get("literal")
+        if path is None or not isinstance(literal, str) or not literal:
+            return NOT_RUNNABLE
+        text = _read(path)
+        if text is None:
+            return NOT_RUNNABLE
+        present = literal in text
+        return REPRODUCED if present == (kind == "literal-present") else NOT_REPRODUCED
+
+    left, right = probe.get("left"), probe.get("right")
+    if not isinstance(left, str) or not isinstance(right, str) or not left or not right:
+        return NOT_RUNNABLE
+    # 주장은 "이 둘이 서로 모순이다" 이므로, 다르면 재현된 것이다.
+    return REPRODUCED if left.strip() != right.strip() else NOT_REPRODUCED

package/runtime/python/okstra_ctl/clarification_items.py

@@ -37,6 +37,7 @@ from pathlib import Path
 from typing import Optional
 
 from okstra_ctl.final_report_paths import final_report_data_path
+from okstra_ctl.json_boundary import load_owned_object
 from okstra_ctl.md_table import is_separator_row, split_pipe_row, to_cell_text
 
 
@@ -224,28 +225,41 @@ def parse_clarification_items(report_text: str) -> Optional[list[ClarificationIt
 # 워크는 거기서 아무것도 못 찾으므로, 게이트가 v1 파서만 쓰면 열린 항목이 있는
 # v2 리포트를 "읽을 수 없음"으로 떨어뜨린다. data.json 은 두 렌더러가 이미 읽는
 # SSOT 다 — clarification 상태도 여기서 읽는다.
-SCHEMA_VERSION_V2 = "2.0"
+# 리포트 정본의 구조화 판본. 2.0 과 3.0 은 `clarificationItems[]` 를 같은 자리에
+# 같은 모양으로 들고 있으므로 이 좁히기에는 차이가 없다. ADR-0019 가 2.0 을 계속
+# 판독하라고 정했으므로 둘 다 받는다 — `stage_map.structured_report` 와 같은 규칙.
+STRUCTURED_REPORT_VERSIONS = frozenset({"2.0", "3.0"})
 
 
 def _read_report_text(report_path: Path) -> str:
     return report_path.read_text(encoding="utf-8", errors="replace")
 
 
-def _v2_report_data(report_path: Path) -> Optional[dict]:
-    """``report_path`` 의 schema-v2 data 사이드카, 아니면 ``None``.
+def _structured_report_data(report_path: Path) -> Optional[dict]:
+    """``report_path`` 의 구조화 리포트 레코드, 아니면 ``None``.
 
-    파일이 없거나 JSON 이 깨졌거나 v2 가 아니면 ``None`` — 호출자는 v1
-    마크다운 경로로 폴백하고, 진짜 v2 인데 사이드카가 깨진 경우는 그 폴백이
-    "§1 없음" fail-closed 로 잡는다.
+    파일이 없거나 JSON 이 깨졌거나 구조화 판본이 아니면 ``None`` — 호출자는 v1
+    마크다운 경로로 폴백하고, 진짜 구조화 리포트인데 레코드가 깨진 경우는 그
+    폴백이 "§1 없음" fail-closed 로 잡는다.
+
+    판본을 `2.0` 하나로 못박아 두던 동안 3.0 리포트가 여기서 ``None`` 이 됐고,
+    그러면 호출자가 JSON 본문에서 `## 1.` 헤딩을 찾다 실패해 **리포트 전문을
+    그대로 복사**했다 — 이 좁히기가 막으려던 바로 그 중복이다. 실측: 66K 짜리
+    추출본이 나와야 할 자리에 693K data.json 이 스테이징됐고, 패킷의
+    `## Clarification Carry-In Extract` 가 0행이 되어 워커가 사용자 답변을
+    전혀 받지 못했다.
     """
     data_path = final_report_data_path(report_path)
     if not data_path.is_file():
         return None
     try:
-        data = json.loads(data_path.read_text(encoding="utf-8"))
+        data = load_owned_object(data_path, artifact="final report record")
     except (OSError, ValueError):
         return None
-    if not isinstance(data, dict) or data.get("schemaVersion") != SCHEMA_VERSION_V2:
+    if (
+        not isinstance(data, dict)
+        or data.get("schemaVersion") not in STRUCTURED_REPORT_VERSIONS
+    ):
         return None
     return data
 
@@ -287,7 +301,7 @@ def _v2_row(entry: dict) -> Optional[dict]:
 def _v2_clarification_rows(report_path: Path) -> Optional[list[dict]]:
     """schema-v2 clarification 행들, 이 리포트가 v2 가 아니면 ``None``.
     필수 필드가 빠진 행은 건너뛰는 lenient 계약(§1 파서와 동일)."""
-    data = _v2_report_data(report_path)
+    data = _structured_report_data(report_path)
     if data is None:
         return None
     entries = data.get("clarificationItems")
@@ -503,7 +517,7 @@ def _scan_v2_blockers(
 ) -> Optional[ClarificationScan]:
     """schema-v2 data.json 기준 스캔, 이 리포트가 v2 가 아니면 ``None``.
     필수 필드가 빠진 행은 §1 의 unparsed row 와 같이 fail-closed 로 다룬다."""
-    data = _v2_report_data(report_path)
+    data = _structured_report_data(report_path)
     if data is None:
         return None
     entries = data.get("clarificationItems")
@@ -758,10 +772,10 @@ def _carry_section_1(source: Path, text: str) -> Optional[tuple[str, str]]:
     복사**됐다 — 이 좁히기가 막으려던 바로 그 중복이다. carry-in 은 파생 문서이고
     다운스트림(승인 게이트·프롬프트 빌더·검증 워커)이 §1 표 하나만 읽으므로, v2
     행도 같은 표로 렌더한다."""
-    data = _v2_report_data(source)
+    data = _structured_report_data(source)
     if data is not None:
         entries = data.get("clarificationItems")
-        return SECTION_1_HEADING, _v2_section_1_body(
+        return SECTION_1_HEADING, _structured_section_1_body(
             entries if isinstance(entries, list) else []
         )
     slice_ = _section_1_slice(text)
@@ -772,7 +786,7 @@ def _carry_section_1(source: Path, text: str) -> Optional[tuple[str, str]]:
     return heading.group(0), slice_.rstrip()
 
 
-def _v2_section_1_body(entries: list) -> str:
+def _structured_section_1_body(entries: list) -> str:
     """schema-v2 `clarificationItems[]` 를 §1 표 본문으로.
 
     메타 셀은 렌더러가 쓰는 모양 그대로다 — `Status:` 는 따옴표 없이 써야

package/runtime/python/okstra_ctl/cmux.py

@@ -32,9 +32,9 @@ SHIM_DIR_MARKER = "cmux-cli-shims"
 
 # The workspace is split in fifths: two for the lead, three for the workers.
 # Every worker lands in that one column and the column divides downward, so all
-# workers hold the same width and only one border — the lead's — is ever
-# computed. Splitting sideways instead would make each worker's width a
-# function of how many rounds preceded it.
+# workers hold the same width. Splitting sideways instead would make each
+# worker's width a function of how many rounds preceded it. The split itself
+# halves the pane it lands on; worker heights are evened out afterwards.
 LEAD_SHARE_WITH_WORKERS = 2 / 5
 
 # Three fifths is what a worker needs to be worth watching: measured against a
@@ -46,10 +46,9 @@ LEAD_SHARE_WITH_WORKERS = 2 / 5
 # whole workspace back rather than sitting at its working width.
 LEAD_SHARE_ALONE = 1.0
 
-# A floor for the dimension the worker column actually divides. A pane
-# this short still shows a command and its first lines of output; below it the
-# pane stops being a window onto the worker and the next one stacks as a tab.
-WORKER_MIN_ROWS = 20
+# Two passes per pane above the bottom. A roster of four analysers is four
+# workers in the column; eight moves is that bound with one extra pass.
+MAX_WORKER_HEIGHT_MOVES = 8
 
 # Sidebar entries are keyed by source so tools do not overwrite each other's.
 SIDEBAR_SOURCE = "okstra"
@@ -163,15 +162,29 @@ class PaneGeometry:
     width_points: float = 0.0
     ref: str = ""
     selected_surface_id: str = ""
+    height_points: float = 0.0
 
 
 @dataclass(frozen=True)
 class Placement:
-    """Where the next worker goes: split `pane_id`, or stack a tab into it."""
+    """Where the next worker goes: split `pane_id` in `direction`."""
 
     pane_id: str
     direction: str
-    stack_as_tab: bool
+
+
+@dataclass(frozen=True)
+class WorkerHeightResize:
+    """One vertical border move that equalizes the worker column.
+
+    `down` on a pane grows it into the neighbour below. `up` on a pane pulls
+    the shared border up, shrinking the neighbour above — the top pane has no
+    upper border, so shrinking it is the pane below's request.
+    """
+
+    pane_id: str
+    direction: str
+    amount: int
 
 
 def plan_worker_placement(
@@ -179,15 +192,14 @@ def plan_worker_placement(
     *,
     lead_pane_id: str,
     owned_surface_ids: Collection[str],
-    min_rows: int,
 ) -> Placement:
     """Pick the next worker slot from the workspace's current geometry.
 
     One column for every worker: the first split takes it off the lead, and each
-    one after that divides the column downward. Width is therefore decided once,
-    by where the lead's border sits, and every worker inherits it — nothing here
-    computes a width, and no worker's width depends on how many rounds ran
-    before it.
+    one after that divides the worker next to the lead downward. Width is
+    therefore decided once, by where the lead's border sits, and every worker
+    inherits it — nothing here computes a width, and no worker's width depends
+    on how many rounds ran before it.
 
     Stateless by design: okstra records surface UUIDs, never a layout, so a
     resumed or crashed run cannot carry a layout model that no longer matches
@@ -207,8 +219,8 @@ def plan_worker_placement(
         and _holds_an_okstra_surface(pane, owned_surface_ids)
     ]
     if not workers:
-        return Placement(pane_id=lead_pane_id, direction="right", stack_as_tab=False)
-    return _extend_the_worker_column(workers, min_rows=min_rows)
+        return Placement(pane_id=lead_pane_id, direction="right")
+    return _extend_the_worker_column(workers)
 
 
 def lead_target_width(
@@ -273,28 +285,52 @@ def _holds_an_okstra_surface(
 ) -> bool:
     """Whether okstra opened anything in this pane.
 
-    Any one recorded surface is enough: workers that stacked as tabs share a
-    pane, and only the tab that opened it carries the UUID okstra split on.
+    Any one recorded surface is enough: a pane may hold more than one surface,
+    and only one of those UUIDs has to be in the ledger.
     """
     return any(surface_id in owned_surface_ids for surface_id in pane.surface_ids)
 
 
-def _extend_the_worker_column(
-    workers: Sequence[PaneGeometry], *, min_rows: int
-) -> Placement:
-    """Divide the bottom worker, or stack when the halves would be unreadable.
+def _extend_the_worker_column(workers: Sequence[PaneGeometry]) -> Placement:
+    """Divide the worker next to the lead downward. A tab would hide the new worker.
+
+    The first worker is split off the lead, so it stays at the lead's y. Later
+    workers stack below it. Splitting the bottom one parks each new pane at the
+    far end of the column; splitting the neighbour keeps the new pane next to
+    the lead.
+    """
+    neighbour = min(workers, key=lambda pane: pane.y)
+    return Placement(pane_id=neighbour.pane_id, direction="down")
+
+
+def plan_worker_height_resize(
+    workers: Sequence[PaneGeometry],
+) -> WorkerHeightResize | None:
+    """The next vertical move that gives every worker an equal share of the column.
+
+    Only the first off-share pane above the bottom is reported. Growing or
+    shrinking it changes every pane below, so the caller re-reads and asks
+    again. The bottom pane is never the one named: it absorbs the remainder.
 
-    A split halves the pane it lands on, so the bottom pane's own height decides
-    whether the column can take another worker at all. Once it cannot, further
-    workers stack as tabs into the pane holding the fewest — a background tab is
-    worse than a visible pane, but better than two panes too short to show a
-    command and its first lines of output.
+    `new-split` halves the pane it lands on and does not take a ratio, so a
+    third worker split off the top would otherwise stay at a quarter while
+    the bottom one keeps a half.
     """
-    bottom = max(workers, key=lambda pane: pane.y)
-    if bottom.rows // 2 >= min_rows:
-        return Placement(pane_id=bottom.pane_id, direction="down", stack_as_tab=False)
-    roomiest = min(workers, key=lambda pane: (len(pane.surface_ids), pane.y))
-    return Placement(pane_id=roomiest.pane_id, direction="", stack_as_tab=True)
+    if len(workers) < 2:
+        return None
+    ordered = sorted(workers, key=lambda pane: pane.y)
+    total = sum(pane.height_points for pane in ordered)
+    if total <= 0:
+        return None
+    share = total / len(ordered)
+    for index, pane in enumerate(ordered[:-1]):
+        delta = round(pane.height_points - share)
+        if delta == 0:
+            continue
+        if delta < 0:
+            return WorkerHeightResize(pane.pane_id, "down", -delta)
+        return WorkerHeightResize(ordered[index + 1].pane_id, "up", delta)
+    return None
 
 
 def shim_free_login_path() -> str:
@@ -331,6 +367,17 @@ def worker_command_line(
     The `cd` is part of the command because neither `new-split` nor
     `respawn-pane` accepts a working directory the way `tmux split-window -c`
     does.
+
+    `exec` is here for termination, not for the pane's life, and removing it
+    does not keep a finished worker's pane on screen. Measured 2026-08-21: a
+    surface's life is bound to the command `respawn-pane` starts — cmux runs it
+    through `login … bash --noprofile --norc` and closes the surface when it
+    exits — and cmux's settings schema carries no option that keeps a surface
+    open past its process. Dropping `exec` was tried against a live dispatch and
+    the pane still went with the worker; what it changed was that
+    `close_surface` would kill an intermediate shell rather than the worker
+    itself. So the adapter contract's "finished workers leave their panes
+    behind" does not hold under cmux, and no edit to this line makes it hold.
     """
     return (
         f"cd {shlex.quote(str(cwd))} && "
@@ -366,13 +413,14 @@ def spawn_worker_surface(
         panes,
         lead_pane_id=lead.pane_id,
         owned_surface_ids=owned_surface_ids,
-        min_rows=WORKER_MIN_ROWS,
     )
     target = _pane_by_id(panes, placement.pane_id)
     surface_uuid = _open_worker_surface(workspace, placement, target)
     run_cmux(["rename-tab", "--surface", surface_uuid, "--title", title])
     _exec_worker(surface_uuid, cwd=cwd, command=command)
-    _size_lead_pane(workspace, (*owned_surface_ids, surface_uuid))
+    owned = (*owned_surface_ids, surface_uuid)
+    _size_lead_pane(workspace, owned)
+    _equalize_worker_heights(workspace, owned)
     return surface_uuid
 
 
@@ -575,21 +623,16 @@ def open_surface_ids(workspace: str) -> set[str]:
 def _create_surface(
     workspace: str, placement: Placement, target: PaneGeometry
 ) -> None:
-    if placement.stack_as_tab:
-        created = run_cmux(
-            ["new-surface", "--workspace", workspace, "--pane", target.pane_id]
-        )
-    else:
-        created = run_cmux(
-            [
-                "new-split",
-                placement.direction,
-                "--workspace",
-                workspace,
-                "--surface",
-                target.selected_surface_id or target.surface_ids[0],
-            ]
-        )
+    created = run_cmux(
+        [
+            "new-split",
+            placement.direction,
+            "--workspace",
+            workspace,
+            "--surface",
+            target.selected_surface_id or target.surface_ids[0],
+        ]
+    )
     if created.returncode != 0:
         raise RuntimeError(created.stderr.strip() or "cmux could not open a pane")
 
@@ -606,9 +649,10 @@ def _exec_worker(surface_uuid: str, *, cwd: Path, command: Sequence[str]) -> Non
 def _size_lead_pane(workspace: str, owned_surface_ids: Collection[str]) -> None:
     """Move the lead's border to its share of the workspace.
 
-    This is the only border okstra places. Workers divide their column downward
-    and therefore all inherit whatever is left of it, so placing this one border
-    sizes every pane on screen.
+    This is the horizontal border okstra places. Workers divide their column
+    downward and inherit the remaining width, so this one move sizes the lead
+    and every worker's width. Worker heights are equalized separately after
+    the split that just halved one of them.
 
     Which pane carries the request follows from what `pane.resize` does: it
     moves the named pane's own border in the direction given. The lead can push
@@ -659,6 +703,39 @@ def _size_lead_pane(workspace: str, owned_surface_ids: Collection[str]) -> None:
     )
 
 
+def _equalize_worker_heights(
+    workspace: str, owned_surface_ids: Collection[str]
+) -> None:
+    """Give every owned worker the same height in the column.
+
+    `new-split` halves whichever pane it lands on, so the third worker of a
+    round would otherwise sit at a quarter with the bottom one still at a half.
+    Each call moves one border and re-reads: growing the top pane steals from
+    the one below, and that is what the next plan has to see.
+    """
+    for _ in range(MAX_WORKER_HEIGHT_MOVES):
+        panes = list_panes(workspace)
+        lead = _lead_pane(panes)
+        workers = [
+            pane
+            for pane in panes
+            if pane.pane_id != lead.pane_id
+            and _holds_an_okstra_surface(pane, owned_surface_ids)
+        ]
+        move = plan_worker_height_resize(workers)
+        if move is None:
+            return
+        rpc(
+            "pane.resize",
+            {
+                "workspace_id": workspace,
+                "pane_id": move.pane_id,
+                "direction": move.direction,
+                "amount": move.amount,
+            },
+        )
+
+
 def _lead_pane(panes: Sequence[PaneGeometry]) -> PaneGeometry:
     caller_pane_ref = identify_caller().get("pane_ref", "")
     for pane in panes:
@@ -706,6 +783,7 @@ def _pane_geometry(entry: dict[str, Any]) -> PaneGeometry:
         width_points=float(frame.get("width") or 0),
         ref=str(entry.get("ref", "")),
         selected_surface_id=str(entry.get("selected_surface_id", "")),
+        height_points=float(frame.get("height") or 0),
     )
 
 

package/runtime/python/okstra_ctl/code_review_target.py

@@ -24,6 +24,7 @@ from okstra_project import (
 )
 
 from .code_review_paths import branch_review_dir, next_branch_review
+from .fixed_text import line
 
 DEFAULT_BRANCH_CANDIDATES = ("main", "master")
 
@@ -105,7 +106,9 @@ def _build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--date", default="", help="YYYY-MM-DD for branch result naming")
     parser.add_argument("--project-root", default="", help="explicit project root")
     parser.add_argument("--cwd", default=".", help="cwd for project root resolution")
-    parser.add_argument("--json", action="store_true", help="emit JSON (always on)")
+    output = parser.add_mutually_exclusive_group()
+    output.add_argument("--json", action="store_true", help="emit JSON (default)")
+    output.add_argument("--text", action="store_true", help="emit fixed text fields")
     return parser
 
 
@@ -121,6 +124,25 @@ def _resolve(args: argparse.Namespace, project_root: Path) -> dict:
     raise StateError("pass either --task-key --stage or --branch", stage="args")
 
 
+def render_code_review_target_text(payload: dict) -> str:
+    """모델이 소비할 리뷰 범위와 결과 경로만 고정 줄로 투영한다."""
+    rows = ["Okstra code review target\n"]
+    rows.append(line("Status", "ready" if payload.get("ok") else "error"))
+    fields = (
+        ("Project root", "projectRoot"), ("Mode", "mode"),
+        ("Worktree path", "worktreePath"), ("Branch", "branch"),
+        ("Base commit", "baseCommit"), ("Head commit", "headCommit"),
+        ("Review path", "reviewPath"), ("Round", "round"),
+        ("Task key", "taskKey"), ("Task root", "taskRoot"), ("Stage", "stage"),
+        ("Failure stage", "stage"), ("Failure reason", "reason"),
+    )
+    for label, key in fields:
+        failure_field = label.startswith("Failure")
+        if key in payload and failure_field != bool(payload.get("ok")):
+            rows.append(line(label, payload.get(key)))
+    return "".join(rows)
+
+
 def main(argv: list[str] | None = None) -> int:
     args = _build_parser().parse_args(argv)
     try:
@@ -128,23 +150,27 @@ def main(argv: list[str] | None = None) -> int:
             explicit_root=args.project_root, cwd=args.cwd
         )
     except ResolverError as exc:
-        print(json.dumps({"ok": False, "stage": "resolve", "reason": str(exc)}))
+        payload = {"ok": False, "stage": "resolve", "reason": str(exc)}
+        print(render_code_review_target_text(payload) if args.text else json.dumps(payload))
         return 2
 
     try:
         snapshot = _resolve(args, Path(project_root))
     except StateError as exc:
-        print(json.dumps({
+        payload = {
             "ok": False,
             "stage": exc.stage or "target",
             "reason": str(exc),
-        }))
+        }
+        print(render_code_review_target_text(payload) if args.text else json.dumps(payload))
         return 1
 
-    print(json.dumps(
-        {"ok": True, "projectRoot": str(project_root), **snapshot},
-        ensure_ascii=False, indent=2,
-    ))
+    payload = {"ok": True, "projectRoot": str(project_root), **snapshot}
+    print(
+        render_code_review_target_text(payload)
+        if args.text
+        else json.dumps(payload, ensure_ascii=False, indent=2)
+    )
     return 0
 
 

package/runtime/python/okstra_ctl/consumers.py

@@ -16,6 +16,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
+from .json_boundary import JsonBoundaryError, load_owned_object
+from .jsonl import append_jsonl
 from .run_context import consumers_mutex
 
 CONSUMERS_FILENAME = "consumers.jsonl"
@@ -265,8 +267,7 @@ def _release_stage_occupancy_keeping_branch(
 
 
 def _append_row(plan_run_root: Path, record: Dict[str, Any]) -> None:
-    with _path(plan_run_root).open("a", encoding="utf-8") as f:
-        f.write(json.dumps(record, ensure_ascii=False) + "\n")
+    append_jsonl(_path(plan_run_root), record, ensure_ascii=False, compact=False)
 
 
 def append_verified(plan_run_root: Path, *, impl_task_key: str, stage: int,
@@ -414,8 +415,8 @@ def backfill_done_from_carry(plan_run_root: Path) -> int:
     recovered = 0
     for cf in sorted(carry_dir.glob("stage-*.json")):
         try:
-            carry = json.loads(cf.read_text(encoding="utf-8"))
-        except (json.JSONDecodeError, OSError):
+            carry = load_owned_object(cf, artifact="implementation stage carry")
+        except (JsonBoundaryError, OSError):
             continue
         if not isinstance(carry, dict):
             continue