okstra 0.180.0 → 0.183.2

package/runtime/validators/validate-run.py

@@ -2997,6 +2997,9 @@ def validate_report(
 
 
 _REPORT_BASENAME_SEQ_RE = re.compile(r"-(?P<seq>\d{3})(?:\.data)?\.(?:md|json)$")
+_REPORT_BASENAME_TASK_TYPE_RE = re.compile(
+    r"^final-report-(?P<task_type>[a-z][a-z-]*?)-\d{3}(?:\.data)?\.(?:md|json)$"
+)
 
 
 def _report_run_seq(report_path: Path) -> str | None:
@@ -3007,6 +3010,25 @@ def _report_run_seq(report_path: Path) -> str | None:
     return match.group("seq") if match else None
 
 
+def _report_task_type(report_path: Path) -> str:
+    """This run's task type, read off `final-report-<task-type>-<seq>`.
+
+    The report's own `header.taskType` is the first source, but it is not
+    always reachable. `report_narrative._allowed_top_level()` has no `header` —
+    it is not a writer-owned block — so a gate scored from a narrative, which is
+    the only input a report-contract-3.0 run has before assembly, carries no
+    task type at all. Globbing with an empty one matched nothing and reported
+    every verdict as unbacked under a `runs//worker-results/` path.
+
+    The filename carries it in every caller: the full-run path passes the report
+    itself, and `_report_path_for_state` builds the same canonical name from the
+    state file. Returns `""` when the name does not carry one, so a caller can
+    tell "not resolvable" from a real task type.
+    """
+    match = _REPORT_BASENAME_TASK_TYPE_RE.match(report_path.name)
+    return match.group("task_type") if match else ""
+
+
 def validate_worker_results_audit(
     report_path: Path,
     task_type: str,
@@ -3090,29 +3112,21 @@ PLAN_VERIFY_GATE_VALUES = (
 # the approved-frontmatter gate (the `.match` would otherwise return None).
 _FRONTMATTER_BLOCK_RE = re.compile(r"\A\ufeff?\s*---\n(.*?)\n---\n", re.DOTALL)
 def _validate_verdict_card_fields(data: dict, failures: list[str]) -> None:
-    """`verdictCard.direction` must byte-match its authoritative home in §7.
-
-    The markdown check above compares only the Verdict Token, so a Card whose
-    Direction contradicted §7 shipped silently. `nextStep` is deliberately NOT
-    compared: every shipped fixture authors the Card's cell as the actionable
-    command (`/okstra-run task-type=release-handoff`) while §7 states the same
-    action as prose ("Proceed to release-handoff."), so a byte-match rule there
-    would reject the reference reports.
-    """
+    """Verdict Card의 정본 표시 값이 §7의 값과 같은지 모두 검사한다."""
     card = data.get("verdictCard")
     final = data.get("finalVerdict")
     if not isinstance(card, dict) or not isinstance(final, dict):
         return
-    card_value = str(card.get("direction") or "").strip()
-    final_value = str(final.get("direction") or "").strip()
-    if not card_value or not final_value or card_value == final_value:
-        return
-    failures.append(
-        f"final-report data.json: verdictCard.direction `{card_value}` does not "
-        f"match finalVerdict.direction `{final_value}` — the Card is a "
-        "non-authoritative index and MUST byte-match §7 "
-        "(_common-contract.md Verdict Card)."
-    )
+    for field in ("finalConclusion", "direction", "nextStep"):
+        card_value = str(card.get(field) or "").strip()
+        final_value = str(final.get(field) or "").strip()
+        if not card_value or not final_value or card_value == final_value:
+            continue
+        failures.append(
+            f"final-report data.json: verdictCard.{field} value `{card_value}` "
+            f"does not match finalVerdict.{field} value `{final_value}` — the "
+            "Card is a non-authoritative index and must preserve the §7 value."
+        )
 
 
 def _route_target_matches(value: Any, target: str, *, command: bool) -> bool:
@@ -3585,8 +3599,12 @@ def validate_final_report_data(
 # namespaced audit ref (claude:F-005), or a §section reference (§5.4) — any one
 # satisfies "this claim is anchored". A bare brief/worker ID (RC-*/RF-*/F-*) is
 # handled separately by `_validate_no_opaque_id_references`.
-_EVIDENCE_TOKEN = re.compile(
-    r"[\w./-]+\.\w+:\d+|\b[A-Z]{1,3}(?:-[a-z]+)?-\d+\b|§\s*\d")
+_PATH_LINE_EVIDENCE_TOKEN = re.compile(r"[\w./-]+\.\w+:\d+")
+_SECTION_EVIDENCE_TOKEN = re.compile(r"§\s*\d")
+_IN_REPORT_ID_TOKEN = re.compile(r"\b[A-Z]{1,3}(?:-[a-z]+)?-\d+\b")
+_NAMESPACED_EVIDENCE_TOKEN = re.compile(
+    r"(?<![\w-])[a-z][a-z0-9-]*:[A-Z]{1,3}(?:-[a-z]+)?-\d+(?![\w-])"
+)
 # Explicit "I don't know" escapes — anti-fabrication's other valid answer.
 _INSUFFICIENCY_MARKERS = (
     "근거 불충분", "근거가 불충분", "증거 불충분", "증거가 불충분",
@@ -3596,6 +3614,44 @@ _INSUFFICIENCY_MARKERS = (
 _RATIONALE_FIELDS = ("motivation", "problem", "approach", "justification")
 
 
+def _report_reference_ids(data: Mapping[str, Any]) -> set[str]:
+    references: set[str] = set()
+
+    def visit(value: Any, key: str = "") -> None:
+        if isinstance(value, Mapping):
+            for child_key, child_value in value.items():
+                visit(child_value, str(child_key))
+            return
+        if isinstance(value, list):
+            for child in value:
+                visit(child, key)
+            return
+        if not isinstance(value, str):
+            return
+        if (key == "id" or key.endswith("Id")) and _IN_REPORT_ID_TOKEN.fullmatch(value):
+            references.add(value)
+        if key == "sourceItems":
+            references.update(_NAMESPACED_EVIDENCE_TOKEN.findall(value))
+
+    visit(data)
+    return references
+
+
+def _rationale_reference_status(
+    text: str,
+    known_references: set[str],
+) -> tuple[bool, tuple[str, ...]]:
+    if _PATH_LINE_EVIDENCE_TOKEN.search(text) or _SECTION_EVIDENCE_TOKEN.search(text):
+        return True, ()
+    namespaced = tuple(_NAMESPACED_EVIDENCE_TOKEN.findall(text))
+    without_namespaced = _NAMESPACED_EVIDENCE_TOKEN.sub("", text)
+    report_ids = tuple(_IN_REPORT_ID_TOKEN.findall(without_namespaced))
+    candidates = (*namespaced, *report_ids)
+    if any(candidate in known_references for candidate in candidates):
+        return True, ()
+    return False, tuple(dict.fromkeys(candidates))
+
+
 def _validate_rationale_evidence(data: dict, failures: list[str]) -> None:
     """Every `## 작업 배경과 근거` field must anchor its claim: carry at least
     one evidence reference (path:line, report ID, §section) OR an explicit
@@ -3605,14 +3661,25 @@ def _validate_rationale_evidence(data: dict, failures: list[str]) -> None:
     rationale = data.get("rationale")
     if not isinstance(rationale, dict):
         return  # absence/shape is the schema's job; don't double-report.
+    known_references = _report_reference_ids(data)
     for field in _RATIONALE_FIELDS:
         text = rationale.get(field)
         if not isinstance(text, str):
             continue
-        if _EVIDENCE_TOKEN.search(text):
+        grounded, unknown_references = _rationale_reference_status(
+            text,
+            known_references,
+        )
+        if grounded:
             continue
         if any(m in text.lower() for m in _INSUFFICIENCY_MARKERS):
             continue
+        if unknown_references:
+            failures.append(
+                f"final-report data.json: rationale.{field} cites unknown "
+                "in-report reference(s): " + ", ".join(unknown_references) + "."
+            )
+            continue
         failures.append(
             f"final-report data.json: rationale.{field} cites no evidence "
             f"(expected a path:line, an in-report ID like C-001, or a §"
@@ -3787,6 +3854,42 @@ def _is_variation_point_item(item: dict) -> bool:
     return str(item.get("id") or "").upper().startswith("P-VAR")
 
 
+def _single_vote_dissents(item: dict, kinds: set[str]) -> list[dict]:
+    """이 항목에서 1표 차단을 주장하는 DISAGREE 행들."""
+    return [
+        row for row in (item.get("verdicts") or [])
+        if isinstance(row, dict)
+        and str(row.get("verdict") or "").strip().upper() == "DISAGREE"
+        and str(row.get("breakageKind") or "").strip().lower() in kinds
+    ]
+
+
+def _single_vote_block_survives(item: dict, kinds: set[str]) -> bool:
+    """1표 차단이 성립하는지.
+
+    1표 차단에는 근거가 있다 — 명시된 두 인용이 서로 모순이라는 것은 한 명이
+    실측으로 확정할 수 있는 사실이고, 사실을 다수결로 기각하면 안 된다. 문제는
+    1표라는 것이 아니라 **1표에 재현 요구가 없었다**는 것이다. "이 경로는 존재하지
+    않는다" 라고 쓰기만 하면 그대로 차단이 됐다.
+
+    이제 주장이 스스로 `fact` 를 선언하고 okstra 가 그것을 재현했을 때만 1표로
+    막는다. 선언했는데 재현되지 않았거나 `judgement` 였다면 정족수로 내려간다.
+
+    아무 행도 `claimKind` 를 선언하지 않았으면 종전대로 막는다. 그 필드를 실을 수
+    없던 시절의 판정을 뒤에서 뒤집지 않기 위해서다 — 도입은 완화 방향으로만
+    작동하고, 선언한 주장만 재현을 요구받는다.
+    """
+    dissents = _single_vote_dissents(item, kinds)
+    declared = [row for row in dissents if row.get("claimKind")]
+    if not declared:
+        return bool(dissents)
+    return any(
+        str(row.get("claimKind") or "") == "fact"
+        and str(row.get("reproductionResult") or "") == "reproduced"
+        for row in declared
+    )
+
+
 def _classify_plan_item_gate(item: dict) -> str:
     """Recompute one plan item's gate class from its per-worker verdicts,
     per `prompts/lead/plan-body-verification.md` "Round protocol". Returns one of
@@ -3831,8 +3934,11 @@ def _classify_plan_item_gate(item: dict) -> str:
     # `a` for any item except `P-Var-*` (majority-gated, see
     # `_is_variation_point_item`); `f` only for P-Req items (requirement coverage).
     is_req = str(item.get("id") or "").upper().startswith("P-REQ")
-    if not _is_variation_point_item(item) and (
-        blocking_kinds & _SINGLE_VOTE_BLOCKING_KINDS or (is_req and "f" in blocking_kinds)
+    single_vote_kinds = set(_SINGLE_VOTE_BLOCKING_KINDS) | ({"f"} if is_req else set())
+    if (
+        not _is_variation_point_item(item)
+        and blocking_kinds & single_vote_kinds
+        and _single_vote_block_survives(item, single_vote_kinds)
     ):
         # "One confirmed DISAGREE" presupposes the item was actually
         # cross-verified. When the peer returned a non-result nothing confirmed
@@ -4029,6 +4135,103 @@ def _is_dissent_downgraded(
     )
 
 
+_STARTABLE_STAGE_STATUSES = frozenset({"ready", "active"})
+
+
+def _stage_scope_bucket(item: dict, pbv: dict) -> str:
+    """Whether this item has standing to block the stage about to start.
+
+    The plan covers every stage; implementation runs one at a time. Judging all
+    of them at once means a defect in a stage nobody has reached, or in one
+    already frozen, stops the next stage from starting — and a frozen stage's
+    item cannot be fixed at all, because the Stage Ledger forbids editing its
+    commands. Measured on one run, 9 of 13 blockers were that shape, 6 of them
+    frozen.
+
+    Returns `in-scope` (may block), `observed` (only frozen stages), or
+    `deferred` (only stages not yet startable). Anything unresolvable is
+    `in-scope`: an absent ledger is no basis to narrow, and an item with no
+    `stageScope` belongs to the plan as a whole — `P-Opt-*` and `P-Var-*` live
+    there permanently, and scoping them out would stop an unrequested-work
+    verdict from blocking a start.
+    """
+    ledger = pbv.get("stageLedger")
+    if not isinstance(ledger, dict) or not ledger:
+        return "in-scope"
+    scope = item.get("stageScope")
+    stages = [
+        value for value in scope
+        if isinstance(value, int) and not isinstance(value, bool)
+    ] if isinstance(scope, list) else []
+    if not stages:
+        return "in-scope"
+    statuses = {str(ledger.get(str(stage)) or "") for stage in stages}
+    if statuses & _STARTABLE_STAGE_STATUSES:
+        return "in-scope"
+    return "observed" if "done" in statuses else "deferred"
+
+
+def _set_aside_reason(item: dict, pbv: dict, accepted_item_ids: set[str]) -> str | None:
+    """Why this item stopped blocking, or ``None`` if it never did.
+
+    A gate that passes while defects were set aside has to say which ones and on
+    what grounds. Without that the two halves of the acceptance condition — the
+    next stage can start, and the known risks are written down — collapse into
+    the first, and a defect deferred for a good reason is indistinguishable in
+    the record from one nobody found.
+    """
+    raw = (
+        "has-dissent"
+        if _is_dissent_downgraded(item, pbv, accepted_item_ids)
+        else _classify_plan_item_gate(item)
+    )
+    if raw != "majority-disagree":
+        return None
+    bucket = _stage_scope_bucket(item, pbv)
+    if bucket != "in-scope":
+        return bucket
+    return "record" if str(item.get("block") or "") == "record" else None
+
+
+def _set_aside_register(pbv: dict, accepted_item_ids: set[str]) -> list[dict]:
+    """Every set-aside item, in id order, as the gate records them."""
+    register = [
+        {"id": str(item.get("id") or ""), "reason": reason}
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+        for reason in [_set_aside_reason(item, pbv, accepted_item_ids)]
+        if reason is not None
+    ]
+    return sorted(register, key=lambda row: row["id"])
+
+
+def _plan_item_gate_class(
+    item: dict, pbv: dict, accepted_item_ids: set[str],
+) -> str:
+    """The gate class for one item, after stage scope is applied.
+
+    An out-of-scope blocker is not dropped — it lands on `has-dissent`, so the
+    gate still reads `passed-with-dissent` rather than `passed` and the record
+    says something is outstanding. Silently scoring it `passed` would hide the
+    defect instead of deferring it.
+    """
+    classification = (
+        "has-dissent"
+        if _is_dissent_downgraded(item, pbv, accepted_item_ids)
+        else _classify_plan_item_gate(item)
+    )
+    if classification != "majority-disagree":
+        return classification
+    if _stage_scope_bucket(item, pbv) != "in-scope":
+        return "has-dissent"
+    if str(item.get("block") or "") == "record":
+        # 자기 기록의 부정확은 기록되고 다음 run 의 입력이 되지, 구현 착수를 막지
+        # 않는다. 요구사항이 실제로 안 만들어지는 경우는 이 경로가 아니라
+        # `_independent_coverage_blockers` 의 `coverage-gap` 이 계속 막는다.
+        return "has-dissent"
+    return classification
+
+
 def _recompute_plan_body_gate(
     pbv: dict,
     accepted_item_ids: set[str] | None = None,
@@ -4038,9 +4241,7 @@ def _recompute_plan_body_gate(
     no plan items to judge (disabled / empty round)."""
     accepted = accepted_item_ids or set()
     classes = [
-        "has-dissent"
-        if _is_dissent_downgraded(it, pbv, accepted)
-        else _classify_plan_item_gate(it)
+        _plan_item_gate_class(it, pbv, accepted)
         for it in (pbv.get("planItems") or [])
         if isinstance(it, dict)
     ]
@@ -4062,6 +4263,60 @@ def _recompute_plan_body_gate(
     return "passed"
 
 
+def _validate_set_aside_register(
+    data: dict, failures: list[str], accepted_item_ids: set[str] | None = None,
+) -> None:
+    """A gate that set defects aside must say which ones and why.
+
+    The gate stops blocking on a defect that belongs to a frozen or unreached
+    stage, or to the plan's own record. That is the point — but a reader of the
+    report cannot tell such a defect from one that was never raised unless the
+    run writes the register down. `gateBlockedBy` names what blocked; this names
+    what did not, and why.
+
+    Declared against recomputed, the same shape as `_validate_gate_blocked_by`:
+    a hand-written register drifts from the verdicts it claims to summarise, and
+    the drift is invisible precisely because nothing else reads it.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    accepted = (
+        _resolved_noncritical_dissent_ids(data)
+        if accepted_item_ids is None
+        else accepted_item_ids
+    )
+    expected = _set_aside_register(pbv, accepted)
+    declared_raw = pbv.get("setAside")
+    declared = sorted(
+        (
+            {"id": str(row.get("id") or ""), "reason": str(row.get("reason") or "")}
+            for row in declared_raw
+            if isinstance(row, dict)
+        ),
+        key=lambda row: row["id"],
+    ) if isinstance(declared_raw, list) else None
+    if declared == expected:
+        return
+    if declared is None and not expected:
+        return
+    failures.append(
+        "final-report data.json: planBodyVerification.setAside is "
+        f"{declared!r} but the recorded verdicts set aside {expected!r}. The "
+        "gate stopped blocking on those items — a frozen or unreached stage, or "
+        "the plan's own record — and a run that passes without listing them "
+        "leaves a deferred defect indistinguishable from one nobody raised. "
+        "Re-record the round with `okstra plan-items complete-round`, which "
+        "writes this register from the same computation."
+    )
+
+
 def _validate_plan_body_gate_recompute(
     data: dict,
     failures: list[str],
@@ -4121,6 +4376,29 @@ def _blocks_approval(row: dict) -> bool:
     return status == "documented-deviation" and disposition.startswith("blocked C-")
 
 
+def _plan_item_clarification_ids(item: object) -> set[str]:
+    """이 plan item 이 가리키는 `C-NNN` 들.
+
+    계약 v3 에서 리포트 정본의 이 링크는 복수형 `clarificationRefs[]` 다 —
+    `report_assembly` 가 활동 원장의 `clarificationRefs[]` + `planItemIds[]` 에서
+    유도해 쓰고, v3.0 스키마의 `planItems[]` 는 `additionalProperties: false` 아래
+    그 이름만 허용한다. 단수형 `clarificationId` 는 lead 가 쓰는 plan-body 상태
+    파일과 v2 리포트에 남아 있으므로 읽을 때는 둘 다 받는다
+    (`incremental_scope` 가 이미 그렇게 한다).
+    """
+    if not isinstance(item, dict):
+        return set()
+    ids = {
+        str(ref).strip()
+        for ref in (item.get("clarificationRefs") or [])
+        if str(ref).strip()
+    }
+    single = item.get("clarificationId")
+    if isinstance(single, str) and single.strip():
+        ids.add(single.strip())
+    return ids
+
+
 def _plan_body_promoted_clarification_ids(pbv: dict) -> set[str]:
     """`C-NNN` ids this run's own plan-body round created by promoting a
     majority-disagree item (step 8). Used to break the Requirement Coverage
@@ -4128,11 +4406,9 @@ def _plan_body_promoted_clarification_ids(pbv: dict) -> set[str]:
     the gate already counted, rather than contributing an independent one.
     """
     return {
-        item["clarificationId"].strip()
+        clarification_id
         for item in (pbv.get("planItems") or [])
-        if isinstance(item, dict)
-        and isinstance(item.get("clarificationId"), str)
-        and item["clarificationId"].strip()
+        for clarification_id in _plan_item_clarification_ids(item)
     }
 
 
@@ -5793,8 +6069,7 @@ def _has_clarification_backtrace(
     resolver cannot disagree about what counts as a link.
     """
     if isinstance(plan_items, list) and any(
-        isinstance(item, dict) and item.get("clarificationId") == row_id
-        for item in plan_items
+        row_id in _plan_item_clarification_ids(item) for item in plan_items
     ):
         return True
     return isinstance(coverage, list) and any(
@@ -6278,6 +6553,7 @@ def _validate_plan_body_state_file(
     data: dict,
     report_path: Path,
     failures: list[str],
+    state_path: Path | None = None,
 ) -> None:
     """The per-round state file must exist once a round has run.
 
@@ -6301,20 +6577,34 @@ def _validate_plan_body_state_file(
     round_count = pbv.get("roundCount")
     if not isinstance(round_count, int) or round_count < 1:
         return
-    seq = _report_run_seq(report_path)
-    if seq is None:
-        return
     state_dir = report_path.parent.parent / "state"
-    expected = state_dir / f"plan-body-verification-implementation-planning-{seq}.json"
-    if not expected.is_file():
-        failures.append(
-            f"plan-body verification ran ({round_count} round(s)) but "
-            f"`state/{expected.name}` was not written. It is the only record "
-            "of superseded rounds — data.json keeps just the final verdicts, "
-            "so without it a self-fixed run leaves no trace of what the "
-            'earlier rounds found (plan-body-verification.md §"schema").'
-        )
-        return
+    if state_path is not None:
+        # 호출자가 경로를 넘겼으면 그걸 본다. 리드는 launch 프롬프트의
+        # `Run Paths` 에서 정본 경로를 받으므로, 여기서 이름을 다시 만들면
+        # 그 정본과 어긋날 수 있다 — 실제로 그랬다.
+        written = [state_path] if state_path.is_file() else []
+    else:
+        # 이름을 유도할 근거가 없다. run 은 seq 계열을 둘 갖고(`state` /
+        # `reports`) 리포트 정본은 자기 run 의 state seq 를 담지 않으므로,
+        # 리포트 seq 로 만든 이름은 추측이다. 이 검사가 묻는 것은 "덮어써진
+        # 라운드의 기록이 남았는가" 이지 파일 이름이 아니므로, 이 run 의 상태
+        # 디렉터리에 사이드카가 있는지만 본다. 이름의 정본은 `paths.py` 다.
+        written = sorted(
+            state_dir.glob("plan-body-verification-implementation-planning-*.json")
+        )
+    if not written:
+        failures.append(
+            f"plan-body verification ran ({round_count} round(s)) but no "
+            f"`state/plan-body-verification-*.json` was written. It is the only "
+            "record of superseded rounds — data.json keeps just the final "
+            "verdicts, so without it a self-fixed run leaves no trace of what "
+            'the earlier rounds found (plan-body-verification.md §"schema"). '
+            "The path is rendered into the launch prompt's `Run Paths` block; "
+            "write it there rather than deriving a name."
+        )
+        return
+    # 여럿이면 가장 최신(seq 가 큰) 것이 이 run 의 것이다.
+    expected = written[-1]
     try:
         state = json.loads(expected.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError) as exc:
@@ -7132,7 +7422,15 @@ def _validate_plan_body_verdict_provenance(
     if not voters:
         return
 
-    task_type = str((data.get("header") or {}).get("taskType") or "")
+    task_type = (
+        str((data.get("header") or {}).get("taskType") or "")
+        or _report_task_type(report_path)
+    )
+    if not task_type:
+        # Neither source names it, so the glob below would be built from an
+        # empty segment and match nothing — reporting every verdict as unbacked
+        # on the strength of a path this check could not construct.
+        return
     dispatched = _plan_verify_result_workers(report_path, task_type)
     if dispatched is None:
         return
@@ -7800,15 +8098,20 @@ def _validate_plan_body_clarification_matching(
         if _is_dissent_downgraded(item, pbv, accepted):
             continue
         item_id = item.get("id") or "<unknown>"
-        cid = item.get("clarificationId")
-        if not cid:
+        cids = _plan_item_clarification_ids(item)
+        if not cids:
             failures.append(
                 f"final-report data.json: plan item `{item_id}` is majority-disagree "
-                "but carries no `clarificationId`. A blocking disagreement MUST "
+                "but carries no `clarificationRefs`. A blocking disagreement MUST "
                 "surface as a `## 1. Clarification Items` row (blocks=approval) so "
-                "the user sees the blocker (implementation-planning.md self-review step 7)."
+                "the user sees the blocker (implementation-planning.md self-review "
+                "step 12). Report assembly derives this link from the activity "
+                "ledger's `clarificationRefs[]` + `planItemIds[]`, so record the "
+                "decision through `okstra approval-decision` rather than editing "
+                "the report."
             )
-        elif cid not in approval_ids:
+            continue
+        for cid in sorted(cids - approval_ids):
             reason = (
                 "references a non-existent §1 row"
                 if cid not in all_ids
@@ -7816,8 +8119,9 @@ def _validate_plan_body_clarification_matching(
             )
             failures.append(
                 f"final-report data.json: plan item `{item_id}` (majority-disagree) "
-                f"has clarificationId `{cid}` which {reason}. Every majority-disagree "
-                "item MUST map 1:1 to a `blocks: approval` Clarification row."
+                f"has clarificationRefs entry `{cid}` which {reason}. Every "
+                "majority-disagree item MUST reach a `blocks: approval` "
+                "Clarification row."
             )
 
 
@@ -7984,6 +8288,7 @@ def validate_plan_body_section(
     _validate_aborted_gate_has_clarification(data, failures)
     _validate_round_recorded_verdicts(data, failures)
     _validate_verdicts_match_current_subjects(data, failures)
+    _validate_set_aside_register(data, failures, accepted_item_ids)
     _validate_verdict_rounds_outlive_self_fix(data, failures)
     _validate_unresolved_tie_was_reverified(data, failures)
     _validate_plan_item_extraction_completeness(data, failures)
@@ -8000,16 +8305,16 @@ def _gate_summary_item(
     accepted_item_ids: set[str],
 ) -> dict:
     """One `gate.items[]` row: the gate class plus its state-file counterpart."""
-    classification = (
-        "has-dissent"
-        if _is_dissent_downgraded(item, pbv, accepted_item_ids)
-        else _classify_plan_item_gate(item)
-    )
+    classification = _plan_item_gate_class(item, pbv, accepted_item_ids)
     return {
         "id": item.get("id"),
         "classification": classification,
         "stateClassification": _state_classification(item, classification),
         "correctnessCritical": _is_correctness_critical(item),
+        # 왜 안 막는지가 기록에 남아야 한다. 이 값이 없으면 범위 밖 강등과
+        # 실제 합의가 산출물에서 같은 모양으로 읽힌다.
+        "stageScope": _stage_scope_bucket(item, pbv),
+        "block": str(item.get("block") or "execution"),
     }
 
 
@@ -8050,6 +8355,7 @@ def plan_body_gate_summary(data: dict) -> dict | None:
             _gate_blocking_causes(pbv, coverage_blockers, accepted_item_ids)
         ),
         "coverageBlockers": coverage_blockers,
+        "setAside": _set_aside_register(pbv, accepted_item_ids),
         "blockingItems": [
             item["id"] for item in items if item["classification"] == "majority-disagree"
         ],
@@ -9425,7 +9731,9 @@ SECTION_PLAN_BODY = "plan-body"
 _FULL_ONLY_REQUIRED_FLAGS = ("team_state", "run_manifest", "task_manifest")
 
 
-def run_plan_body_section(report_path: Path) -> int:
+def run_plan_body_section(
+    report_path: Path, state_path: Path | None = None
+) -> int:
     """`--section plan-body` — the §5.5.9 checks a self-fix round can run on
     its own, plus the recomputed gate the lead records for that round.
 
@@ -9452,7 +9760,7 @@ def run_plan_body_section(report_path: Path) -> int:
         return 2
     failures = _data_schema_failures(data)
     warnings = validate_plan_body_section(data, report_path, failures)
-    _validate_plan_body_state_file(data, report_path, failures)
+    _validate_plan_body_state_file(data, report_path, failures, state_path)
     payload = {
         "ok": not failures,
         "section": SECTION_PLAN_BODY,
@@ -9588,7 +9896,10 @@ def main() -> int:
                 Path(args.narrative).resolve(), Path(args.state).resolve()
             )
         if args.report and not args.narrative and not args.state:
-            return run_plan_body_section(Path(args.report).resolve())
+            return run_plan_body_section(
+                Path(args.report).resolve(),
+                Path(args.state).resolve() if args.state else None,
+            )
         parser.error(
             "--section plan-body requires either --report or both --narrative and --state"
         )
@@ -9798,7 +10109,12 @@ def main() -> int:
             validation_data, project_root, failures
         )
     if task_type == "implementation-planning":
-        _validate_plan_body_state_file(validation_data, report_path, failures)
+        _validate_plan_body_state_file(
+            validation_data,
+            report_path,
+            failures,
+            Path(args.state).resolve() if args.state else None,
+        )
     if task_type == "final-verification":
         _validate_verification_target_match(
             validation_data,