okstra 0.195.1 → 0.195.3

package/docs/architecture.md

@@ -944,6 +944,7 @@ Tokens used in each run are collected from lead/worker session transcripts and w
   - Antigravity CLI: the `usage` snapshot in the wrapper `<prompt>.status.json` — the runner records the last `usage` the `agy` stream reported (`result.usage` on a run that closed). The CLI writes no transcript under the home directory, and the worker `.log` is the stream rewritten as readable lines, not stream-json.
 - CLI execution evidence and token attribution are independent. A wrapper `.status.json` proves `not-started`, `started`, `exited`, `timeout`, or `failed` and supplies the worker's collection window; only a matching transcript with a final token snapshot — or, for a provider without a home transcript, the `usage` snapshot the runner wrote into that `.status.json` — proves attributable usage. If a wrapper exited successfully but no attributable transcript exists, the worker remains `source: "unavailable"` with `cliExecutionStatus: "exited"` and a reason instead of becoming zero usage or being described as never invoked.
 - Records billable-equivalent token math and USD cost estimates. It applies Anthropic billing ratios (`cache_creation_5m=1.25x`, `cache_creation_1h=2.0x`, `cache_read=0.1x`, `output=5x`). When the transcript provides separate `usage.cache_creation.ephemeral_5m_input_tokens` / `ephemeral_1h_input_tokens` values, they are counted separately.
+- CLI providers (codex, grok, kimi) report cache reads inside their input count (`cached_input_tokens ⊂ input_tokens`). Their usage blocks carry the same keys as a Claude block — `totalTokens` with the cached part removed, `cacheReadTokens`, and `billableEquivalentTokens` normalized by that model's own rate ratios (`provider_billable_equivalent`) — so the report's cache-read and billable columns are filled for every agent. Their cost stays in `cliEstimatedCostUsd` and on the report's separate CLI row.
 - Pricing is centrally managed in `scripts/okstra_token_usage/pricing.py` (Claude and Gemini rate tables) and in each provider catalog's `ModelSpec(pricing=...)` (codex, grok, kimi — merged through `catalog_pricing`). Update it when model prices change. Model IDs that fail price matching are exposed to the user in `usageSummary.unmatchedModels`, preventing silent-zero incidents.
 - **Cost is always the public list price, regardless of how the account is billed.** The report answers "how much was consumed", not "what the invoice says": a model served under a ChatGPT/Claude subscription is still priced at its API rate, so every selectable catalog row must carry a price. The one row without a price is `codex-auto-review`, for which no public rate exists.
 - Project-wide historical usage is exposed through the read-only `okstra usage-report` command (`scripts/okstra_ctl/usage_report.py`) and the `okstra-usage` skill. It defaults to the whole current project's last 30 days and returns run coverage, raw and billable-equivalent tokens, known USD cost, CPU-sum milliseconds, and wall-clock milliseconds grouped by task type. Runs without usable Phase 7 usage are excluded from resource totals and reported through unavailable reason counts rather than treated as zero usage; unmatched model names remain visible when their tokens and time are included but their cost is not. Use `okstra-inspect` for one task's elapsed/context detail and `okstra-rollup` for task-group or project status/report digests.

package/docs/cli.md

@@ -791,6 +791,7 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra convergence apply-round --work-state <path> --plan <path> --results <path>` | Validate one complete structured result set and atomically reduce it into working state |
 | `okstra convergence critic-prompt --run-manifest <path>` | Render the coverage-critic task instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes. The body carries the run's Round 0 consolidated findings, one line per Phase 4 analyser (worker id, result path, its finding ids), the two mandates plus the `duplicateOf` declaration rule, and — on an implementation-planning re-run — an already-covered index of the prior report's requirement-coverage row ids, clarification row ids, and stage titles (ids and titles only, never body text). Emits the `**Prompt Delivery Mode:**` header and the `Primary analysis packet` line the critic dispatch contract requires, so no part of the critic body is hand-written. Exits 2 when the run has published no grouping yet, or when the manifest carries no `analysisPacketPath` |
 | `okstra convergence reverify-prompt --run-manifest <path> --plan <round-plan.json> --worker <worker-id>` | Render one worker's reverify task instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes. The body carries the round's mandate (adversarial or collaborative, from the grouping's `config`), the plan row's findings in plan order — each with its summary, origin worker, cited-evidence line, the origin worker's result file and `### <item-id>` section, and the origin audit sidecar the verifier is told it may open — and the response format the collector parses. Exits 2 when the plan dispatches nothing to that worker, names a finding the grouping lacks, or is not a `dispatch` plan |
+| `okstra convergence critic-verify-prompt --run-manifest <path> --gaps <coverage-batch.json> --worker <worker-id>` | Render one Phase 4 analyser's coverage-critic gap verification instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes and materializes it with `--dispatch-kind critic-verify` under the analyser's `reverify/<worker-id>` assignment ref. Input is the pre-vote coverage batch (`mode: coverage`, `gaps[]` with `gapId`, `summary`, `category`, `ticketIds`, `originEvidence`, optional `duplicateOf`) the lead later passes to `apply-critic-gaps`; gaps are assigned round-robin over the grouping's analysis roster exactly as `apply-critic-gaps` checks them, and the body carries only this analyser's share — each gap with the critic's result file (`<provider>-worker-critic-<task-type>-<seq>.md`) and `### [<gapId>]` section, the critic audit sidecar, and the adversarial response format. Exits 2 when the batch's taskKey or mode does not match, the run has no critic assignment, the critic result is not collected yet, the worker is not an analyser, or round-robin assigns it no gap |
 | `okstra convergence apply-critic-gaps --work-state <path> --results <path>` | Apply one verified coverage-critic batch after the main queue reaches a terminal state |
 | `okstra convergence finalize --work-state <path> --output <path>` | Materialize the terminal schema v1.3 convergence state |
 | `okstra convergence validate --state <path> --kind <working\|final>` | Validate replayable working state or a terminal final state |

package/docs/project-structure-overview.md

@@ -353,6 +353,7 @@ Important modules:
 | `convergence_store.py`, `convergence_migration.py` | atomic JSON persistence plus legacy/new-engine seed decisions; valid terminal finals are reused, while invalid state requires byte-preserving archival before restart |
 | `convergence.py` | `okstra convergence` internal CLI orchestration for `seed`, `plan-round`, `apply-round`, `critic-prompt`, `apply-critic-gaps`, `finalize`, `validate`, and `example`; it composes the reducer, store, and migration policy without duplicating their decisions |
 | `convergence_reverify_prompt.py` | renders one worker's reverify instruction body `okstra convergence reverify-prompt` prints — the round mandate, the plan row's findings with each origin worker's result file, item id, and audit sidecar (declared openable), and the collector's response format. Replaces the hand-written instruction whose abbreviated evidence line and `- Verdict:` format cost a round |
+| `convergence_critic_verify_prompt.py` | renders one analyser's coverage-critic gap verification instruction body `okstra convergence critic-verify-prompt` prints — round-robin share of the pre-vote coverage batch (same assignment as `apply-critic-gaps`), each gap with the critic result file's `### [<gapId>]` section and audit sidecar, the adversarial response format, and the `**Rendered by:**` signature `validate_reverify_prompt` requires for dispatch kind `critic-verify` |
 | `convergence_critic_prompt.py` | renders the coverage-critic seed body `okstra convergence critic-prompt` prints — the Round 0 consolidated findings, one line per Phase 4 analyser (worker id, result path, its finding ids), the two mandates plus the `duplicateOf` rule, and, on an implementation-planning re-run, an already-covered index of the prior report's requirement-coverage row ids, clarification row ids, and stage titles. Ids and titles only; the prior report's body is never copied |
 | `plan_items.py`, `plan_items_cli.py` | deterministic extraction of the report-writer narrative `P-*` plan-item queue plus the `okstra plan-items extract` / `validate` / `seed` / `collect-verdicts` / `apply-verdicts` / `derivations` adapter; v2 data.json remains a read input |
 | `claim_reproduction.py` | reproduces a plan-body single-vote `fact` claim before it can block on one vote — runs the declared probe (`path-exists` / `path-absent` / `literal-present` / `literal-absent` / `citations-differ`) inside the resolved project root and returns `reproduced` / `not-reproduced` / `not-runnable`, which `plan-items apply-verdicts --run-manifest` writes into `reproductionResult` (always overwriting the worker-sent value so a verifier cannot score its own claim). A `judgement` claim, or a `fact` that does not reproduce, takes the quorum route |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.195.1",
+  "version": "0.195.3",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.195.1",
-  "builtAt": "2026-09-09T11:12:46.377Z",
+  "package": "0.195.3",
+  "builtAt": "2026-09-09T16:13:30.574Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/convergence.md

@@ -647,6 +647,8 @@ critic sets `duplicateOf` to that finding's id (`schemas/convergence-critic-resu
 ### Gap verification (1 adversarial reverify round)
 Each critic gap enters the verification queue as a finding with `originWorker = "<provider>-critic"` and `source = "critic"`, except a gap the critic declared `duplicateOf` — that one is recorded and never dispatched. The lead runs ONE adversarial reverify round (§"Adversarial Verification Mode" classifier) in which **each gap is verified by exactly one Phase 4 analyser**: walk the analyser roster in `criticVerification.analyserRoster` order and assign gap *i* to `roster[i % len(roster)]`, then dispatch each assigned analyser once with its own gaps. Rejecting a gap costs the same as accepting one and this round is off the books (`rounds: []`, no `roundHistory` entry) on the serial path, so a batch of two gaps no longer wakes four analysers. **Enforced:** `okstra_ctl.convergence_engine._critic_gap_coverage_errors` accepts a dispatch set that is either the assignee set or the full roster, and rejects anything else — the full roster stays valid because a run finished before this rule cannot say which shape it used, the same dual acceptance `_validate_round_ledger_counts` gives the two round-counting arithmetics. Choosing a critic provider that is already in the analyser roster costs nothing: the critic is a different role contract, a different duty and a different session, so an analyser is not disqualified by sharing its provider name (ADR-0017 — provider and model are not role identity, and the same model assigned to two roles gets two independent workers). The critic cannot judge its own gaps because it is not an analyser: the voter roster is `workers[]` filtered to `audience == "analysis"`, and a critic is not even representable there (the allowed values are `analysis` / `lead` / `report-writer`). `okstra apply-critic-gaps` refuses a vote from anyone outside that roster (`critic voter must be a non-critic analyser`). Only gaps classified `full-consensus` / `partial-consensus` merge into the final report findings; `contested` / `worker-unique` gaps are treated as hallucinations and dropped (recorded in the convergence state, not promoted).
 
+**Dispatching the gap round.** The gap round is off the round ledger, so `plan-round` writes no plan for it and `reverify-prompt` cannot render it; it has its own generator and dispatch kind. Assemble the coverage batch first — the same `{ schemaVersion, taskKey, mode: "coverage", provider, modelExecutionValue, gaps[] }` document `apply-critic-gaps` will take, with each candidate as a gap (`gapId` = the critic's item id, `summary`, `category`, `ticketIds`, `originEvidence`, `duplicateOf` where declared) and no `votes` or `dispatches` yet. Then, for each assigned analyser, render `okstra convergence critic-verify-prompt --run-manifest <run-manifest> --gaps <coverage-batch.json> --worker <worker-id>` and write its output verbatim as the instruction file: it applies the same round-robin as `apply-critic-gaps` (`okstra_ctl.convergence_engine.critic_gap_assignees`) and carries only that analyser's gaps, each with the critic's result file and `### [<gapId>]` section, the critic audit sidecar the verifier may open, and the adversarial response format the collector parses (gap votes are always read as adversarial). Materialize with the analyser's existing `reverify/<worker-id>` assignment ref, `--dispatch-kind critic-verify`, `--audience reverification-worker`, and on a v2 run the analyser's own `--source-role-execution-ref` exactly as a numbered reverify round; name the prompt `<worker-id>-worker-critic-verify-<task-type>-<seq>.md` and the result `worker-results/<worker-id>-worker-critic-verify-<task-type>-<seq>.md`. Collect each result with `parse_finding_votes` semantics (the `### <gapId>` blocks), write the votes and one `dispatches[]` row per assigned analyser into the batch, and run `apply-critic-gaps`. **Enforced (rendering):** `okstra_ctl.convergence_critic_verify_prompt`. **Enforced (pre-dispatch):** `validate_reverify_prompt` in `scripts/okstra_ctl/worker_prompt_contract.py` requires the `**Rendered by:** okstra convergence critic-verify-prompt` line for dispatch kind `critic-verify`, so a hand-written gap instruction cannot be materialized; `worker_prompt_policy.is_verification_dispatch_kind` routes the kind through the reverify prompt plan, and `convergence_store.reserve_dynamic_verifier` records the kind on the v2 reservation. Before this path existed (2026-09-09, dev-10642 requirements-discovery 001) every attempt to dispatch the round was refused and all three gaps ended `gapsUnverified`.
+
 **A gap that received no verdict is NOT a rejected gap (BLOCKING).** Dropping applies only to gaps the voters actually judged. A gap can also end the round *unjudged* — the verification dispatch returned a terminal non-result (`timeout`, `error`, no result file), the returned result covered only some of the gaps, or no non-critic analyser was available to vote at all. Nobody inspected those, so classifying them as hallucinations is a fabricated verdict. Each one MUST be recorded as a `## 5. Missing Information and Risks` row (`missingInformation`, `source: "critic-unverified"`) whose `risk` names the gap and the reason verification did not complete, and counted in `config.critic.gapsUnverified`. They are **not** promoted to findings (unverified) and **not** raised as `clarification` items — an unverified gap needs an analyser to verify it on the next run, not a decision from the user. Silently losing them is a contract violation: the batch that times out is exactly the batch of gaps too expensive to check, so the highest-risk items are the ones that vanish.
 
 **`category: "unrequested-scope"` candidates are classified the same way but disposed of differently.** A coverage gap the voters contest is a hallucination — nothing was actually missing, so dropping it costs one wasted verification. An over-scope candidate the voters contest is a *disagreement about whether the work was asked for*, and dropping that silently returns the run to the state this half exists to change. So:

package/runtime/prompts/lead/report-writer.md

@@ -89,7 +89,7 @@ This section adds report-specific checks to [okstra-lead-contract](./okstra-lead
 4. When the check reports `mechanical: true` (every entry is a `replace` or `remove`), run `okstra agent-prompt apply-corrections` with the same arguments: okstra writes the corrected narrative to `reportNarrativePath` and records a `lead-correction-applied` activity row naming the ledger and its correction ids. No writer dispatch, `record-dispatch`, or `link-result` follows; the roster row's result already exists.
 5. Otherwise materialize the writer prompt with the same `--corrections <ledger>` under a new invocation id and prompt path (retire the first attempt's link with `reject-result` as [plan-body-verification](./plan-body-verification.md) describes). okstra renders `## Corrections` (each entry with its label path, current value, replacement or rule, schema constraint, and reason) and `## Output`; the instruction body carries only context.
 
-A report-writer materialization without `--corrections` whose narrative already exists and parses is refused before any prompt is written — free-form corrections cannot be checked before the writer runs, and four of six re-runs in the 2026-09-03 measurement were lead instructions that contradicted the authoring contract. Only a narrative whose structure does not parse (line grammar, an unknown top-level field) is re-authored, not corrected: that dispatch needs no ledger, and its body quotes the parser's message. A narrative that breaks the line grammar is not a produced artifact: the dispatcher settles that attempt as `required worker artifact is unusable: narrative does not parse: …` and retries it inside the same batch, so you see the parser's message at collection, not at Phase 7 assembly (**Enforced:** `okstra_ctl.dispatch_state.unusable_result_defect`, read by `missing_completion_paths` and the `team await` record path). The synthesis packet's Authoring Contract carries the line grammar itself (`report_narrative.NARRATIVE_GRAMMAR_INSTRUCTIONS`), so a writer that reads only the packet still sees it. Value defects — an id outside its pattern, a value outside its enum, a missing required field — leave the structure readable and are exactly what the ledger fixes; the a3 attempt of the 2026-09-03 run carried twenty `SC-` ids that assembly refused and was still a corrective base.
+A report-writer materialization without `--corrections` whose narrative already exists and parses is refused before any prompt is written — free-form corrections cannot be checked before the writer runs, and four of six re-runs in the 2026-09-03 measurement were lead instructions that contradicted the authoring contract. Only a narrative whose structure does not parse (line grammar, an unknown top-level field) is re-authored, not corrected: that dispatch needs no ledger, and its body quotes the parser's message. Because re-authoring overwrites the live file in place, okstra copies the existing narrative to `worker-results/<narrative-name>.pre-<invocation-id>.md` at materialization and renders a `## Previous Attempt` section naming that copy (**Enforced:** `_preserve_reauthored_narrative` in `scripts/okstra_ctl/agent/prompt_cli/materialize.py`); the 2026-09-09 dev-10642 run lost a 579-line attempt to a failed in-place re-indent command with no copy to fall back on. A narrative that breaks the line grammar is not a produced artifact: the dispatcher settles that attempt as `required worker artifact is unusable: narrative does not parse: …` and retries it inside the same batch, so you see the parser's message at collection, not at Phase 7 assembly (**Enforced:** `okstra_ctl.dispatch_state.unusable_result_defect`, read by `missing_completion_paths` and the `team await` record path). The synthesis packet's Authoring Contract carries the line grammar itself (`report_narrative.NARRATIVE_GRAMMAR_INSTRUCTIONS`), so a writer that reads only the packet still sees it. Value defects — an id outside its pattern, a value outside its enum, a missing required field — leave the structure readable and are exactly what the ledger fixes; the a3 attempt of the 2026-09-03 run carried twenty `SC-` ids that assembly refused and was still a corrective base.
 
 **Enforced:** `_with_report_writer_sections` / `_refuse_free_form_correction` in `scripts/okstra_ctl/agent/prompt_cli/materialize.py`, `report_corrections.check_corrections`, `agent/prompt_cli/corrections.run_corrections_apply`; `tests/run/test_agent_prompt_corrections.py` and `tests/contract/test_report_writer_v3_contract.py` keep this procedure in the lead contract.
 

package/runtime/prompts/wizard/prompts.ko.json

@@ -621,14 +621,14 @@
       "options": {
         "model": "{model_ref} — {display}",
         "skip": "추가 안 함{skip_warning}",
-        "__free_input__": "직접 선택 (실행 가능한 전체 후보 {total}개에서 고르기)",
         "skip_warnings": {
           "critic": " — 차단 kind 에서 분석자 표가 1대1 동수면 가를 주체가 없어, 그 항목마다 승인 결정과 Blocks=approval clarification 행이 열립니다 (자동 tie-break 대신 사용자 질문. phase 는 계속 진행됩니다)"
         }
       },
       "labels": {
         "range": "허용 {minimum}..{maximum}개, 권장 {recommended}개",
-        "exact": "정확히 {count}개"
+        "exact": "정확히 {count}개",
+        "single": "{role} 역할의 모델을 하나 고르세요 — 인스턴스는 1개입니다 ({range}). 1번 추천은 프로젝트 modelDefaults(없으면 카탈로그 기본값)이고, 이 역할을 빼려면 '추가 안 함' 입니다"
       },
       "errors": {
         "count_out_of_range": "{range} 골라야 합니다 — 고른 수 {count}개",
@@ -636,31 +636,6 @@
         "unknown_option": "목록에 없는 항목입니다: {values}"
       },
       "echo_variants": {
-        "custom": "role-models: (전체 후보에서 직접 선택)",
-        "skipped": "role-models: (추가 안 함)"
-      }
-    },
-    "role_models_custom": {
-      "label": "{role} 역할의 모델을 전체 후보에서 고르세요 — 고른 만큼 인스턴스를 띄웁니다 ({range})",
-      "echo_template": "role-models: {value}",
-      "options": {
-        "model": "{model_ref} — {display}",
-        "skip": "추가 안 함{skip_warning}",
-        "skip_warnings": {
-          "critic": " — 차단 kind 에서 분석자 표가 1대1 동수면 가를 주체가 없어, 그 항목마다 승인 결정과 Blocks=approval clarification 행이 열립니다 (자동 tie-break 대신 사용자 질문. phase 는 계속 진행됩니다)"
-        }
-      },
-      "labels": {
-        "range": "허용 {minimum}..{maximum}개, 권장 {recommended}개",
-        "exact": "정확히 {count}개"
-      },
-      "errors": {
-        "count_out_of_range": "{range} 골라야 합니다 — 고른 수 {count}개",
-        "min_one_required": "모델을 {range} 고르세요 (이 역할을 빼려면 '추가 안 함')",
-        "unknown_option": "목록에 없는 항목입니다: {values}"
-      },
-      "echo_variants": {
-        "custom": "role-models: (전체 후보에서 직접 선택)",
         "skipped": "role-models: (추가 안 함)"
       }
     }

package/runtime/python/okstra_ctl/agent/prompt_cli/dynamic_verifier.py

@@ -25,6 +25,7 @@ from ...convergence_store import (
     DYNAMIC_VERIFIER_SOURCE_ROLES,
     reserve_dynamic_verifier,
 )
+from ...worker_prompt_policy import CRITIC_VERIFY_DISPATCH_KIND
 from .inputs import AgentPromptCliError
 
 
@@ -46,7 +47,8 @@ def _reserve_dynamic_verifier_request(
         manifest_path,
         source_role_execution_ref=source_role_execution_ref,
         duty_id=args.audience,
-        round_number=_reverify_round(args.dispatch_kind),
+        round_number=_reservation_round(args.dispatch_kind),
+        dispatch_kind=args.dispatch_kind,
         task_key=_required_manifest_string(manifest, "taskKey"),
         input_digest="sha256:" + hashlib.sha256(agent_prompt_task_bytes(prompt_bytes)).hexdigest(),
         invocation_ref=args.invocation_id,
@@ -100,12 +102,18 @@ def _dynamic_verifier_source(
     return None
 
 
-def _reverify_round(dispatch_kind: str) -> int:
+def _reservation_round(dispatch_kind: str) -> int:
+    """예약에 적는 라운드 번호. critic gap 검증은 라운드 원장 밖이라 1 이다 —
+    dispatch 가 attempt 행에 적는 값(`_dispatch_round`: 번호 없는 kind 는 1)과
+    같아야 한다."""
+    if dispatch_kind == CRITIC_VERIFY_DISPATCH_KIND:
+        return 1
     prefix = "reverify-r"
     value = dispatch_kind.removeprefix(prefix)
     if not dispatch_kind.startswith(prefix) or not value.isdigit() or int(value) < 1:
         raise AgentPromptCliError(
-            "dynamic verifier dispatch kind must be reverify-r<N>"
+            "dynamic verifier dispatch kind must be reverify-r<N> or "
+            f"{CRITIC_VERIFY_DISPATCH_KIND}"
         )
     return int(value)
 

package/runtime/python/okstra_ctl/agent/prompt_cli/inputs.py

@@ -37,7 +37,14 @@ def _authorized_path(
         for value in raw_roots
     ]
     if not any(_is_relative_to(path, root) for root in roots):
-        raise AgentPromptCliError(f"{label} path is outside authorized roots: {path}")
+        # 루트를 말하지 않으면 시행착오로 찾는다(2026-09-09 실측: ledger 의
+        # baseNarrativePath 를 `state/` 에 두었다가 거부돼 `worker-results/` 로
+        # 옮겨서야 통과).
+        listed = ", ".join(str(value) for value in raw_roots)
+        raise AgentPromptCliError(
+            f"{label} path is outside authorized roots: {path}; authorized "
+            f"{label} roots (project-relative): {listed}"
+        )
     return path
 
 

package/runtime/python/okstra_ctl/agent/prompt_cli/materialize.py

@@ -34,6 +34,7 @@ from ...assignment_resolver import AssignmentContext, resolve_dispatch_assignmen
 from ...path_hints import hydrate_active_run_context
 from ...worker_prompt_headers import worker_prompt_headers
 from ...worker_prompt_contract import complete_reverify_instruction, validate_reverify_prompt
+from ...worker_prompt_policy import is_verification_dispatch_kind
 from ...paths import okstra_home
 from ...final_report_paths import final_report_data_path
 from ...final_report_schema import load_schema_version
@@ -299,7 +300,7 @@ def _materialize_run(
         active_context=active_context,
     ))
     body = instruction_path.read_text(encoding="utf-8")
-    is_reverify = args.dispatch_kind.startswith("reverify-r")
+    is_reverify = is_verification_dispatch_kind(args.dispatch_kind)
     if is_reverify:
         body = _complete_run_reverify_body(args, manifest, active_context, assignment, body, instruction_path)
     if args.audience == "report-writer":
@@ -370,6 +371,7 @@ def _materialize_run(
             candidate, task_type=str(manifest["taskType"]),
             forbidden_actions=str(active_context["workflow"]["forbiddenActions"]),
             expected_model=assignment.model_execution_value,
+            dispatch_kind=args.dispatch_kind,
         )
         if errors:
             raise AgentPromptCliError("; ".join(errors))
@@ -441,7 +443,8 @@ def _with_report_writer_sections(
         raise AgentPromptCliError(
             f"instruction body must not contain {', '.join(conflicts)}: okstra "
             "renders those sections itself (## Output from the run manifest, "
-            "## Corrections from the --corrections ledger)"
+            "## Corrections from the --corrections ledger, ## Previous Attempt "
+            "from the narrative a re-authoring dispatch replaces)"
         )
     sections: list[str] = []
     if getattr(args, "corrections", None):
@@ -472,16 +475,57 @@ def _with_report_writer_sections(
         sections.append("")
     else:
         _refuse_free_form_correction(project_root, narrative_path)
+        preserved = _preserve_reauthored_narrative(
+            project_root, narrative_path, invocation_id=str(args.invocation_id),
+        )
+        if preserved is not None:
+            sections.extend(_render_previous_attempt_section(preserved))
+            sections.append("")
     sections.extend(render_output_section())
     return body.rstrip("\n") + "\n\n" + "\n".join(sections) + "\n"
 
 
+def _preserve_reauthored_narrative(
+    project_root: Path, narrative_path: Path, *, invocation_id: str,
+) -> str | None:
+    """재저작 디스패치 전에 기존 서사를 사본으로 남기고 그 상대 경로를 돌려준다.
+
+    교정(ledger) 경로는 리드가 `baseNarrativePath` 사본을 만들지만, 구조가 안
+    읽히는 서사는 원장 없이 재저작으로 통과해 사본 요구가 없었다. 실측
+    (2026-09-09 dev-10642 requirements-discovery 001): 들여쓰기만 고치는 재저작에서
+    작성자의 변환 명령이 실패해 579줄 서사가 0 바이트로 덮였고, `.okstra` 는
+    gitignore 라 복구본이 없었다. 재저작은 live 파일을 제자리에서 덮어쓰므로
+    okstra 가 사본을 남긴다. 빈 파일은 남길 내용이 없어 건너뛴다.
+    """
+    if not narrative_path.is_file() or narrative_path.stat().st_size == 0:
+        return None
+    copy_path = narrative_path.with_name(
+        f"{narrative_path.stem}.pre-{invocation_id}{narrative_path.suffix}"
+    )
+    if os.path.normpath(copy_path) == os.path.normpath(narrative_path):
+        raise AgentPromptCliError("preserved narrative copy resolves to the live narrative")
+    shutil.copyfile(narrative_path, copy_path)
+    return _relative(project_root, copy_path)
+
+
+def _render_previous_attempt_section(preserved_rel: str) -> list[str]:
+    return [
+        "## Previous Attempt",
+        "",
+        f"Your previous attempt is preserved at `{preserved_rel}`. Read that copy for "
+        "its content and write the re-authored narrative to `**Result Path:**` as a "
+        "fresh file. Do not transform the file at `**Result Path:**` in place with a "
+        "shell or script command: a failed command leaves an empty file and the run "
+        "loses the attempt. The preserved copy is read-only for you.",
+    ]
+
+
 def _refuse_free_form_correction(project_root: Path, narrative_path: Path) -> None:
     """서사가 이미 있고 구조가 읽히면 이 디스패치는 교정이다 — 원장 없이는 거절한다.
 
     구조가 읽히지 않는 서사(줄 문법·소유권 결함)는 교정 대상이 아니라 재저작
     대상이다(원장의 경로가 해소될 자료가 없다). 그 디스패치는 원장 없이
-    통과한다. 값 결함(패턴 밖 id, enum 밖 값)은 구조가 읽히는 서사이고, 그것이
+    통과하고, `_preserve_reauthored_narrative` 가 기존 파일의 사본을 남긴다. 값 결함(패턴 밖 id, enum 밖 값)은 구조가 읽히는 서사이고, 그것이
     원장이 고치는 자리다 — 실측(dev-10626 a3)의 `SC-` id 20곳이 이 경우다.
     """
     if not narrative_path.is_file():

package/runtime/python/okstra_ctl/blocking_checks.py

@@ -135,6 +135,18 @@ _BLOCKING: tuple[tuple[str, str], ...] = (
         "승인 경계(scripts/okstra_ctl/run.py `_validate_approved_plan_conformance`)"
         "가 같은 형식을 하드 거부한다 — 같은 이유로 구현 준비가 막힌다.",
     ),
+    # Stage 관계 검사(S-검사: depends-on DAG, 병렬 stage 파일 안전, RED→GREEN
+    # 순서, TDD 면제 어휘). 계획 런은 validate-run.py `_append_stage_data_failures`
+    # 가 이 접두로 기록하고, 구현 진입은 같은 검증기를 subprocess 로 돌려
+    # exit≠0 이면 PrepareError 로 거부한다. 2026-09-09 dev-10628 실측: Stage 1
+    # 첫 단계가 `RED:` 가 아닌 계획(S10c)이 advisory 로 승인까지 갔다가 구현
+    # 준비에서 거부돼, 승인된 불변 계획을 되돌려 다시 계획해야 했다.
+    (
+        "implementation-planning stage contract invalid",
+        "구현 진입(scripts/okstra_ctl/run.py `_validate_stage_structure`)이 같은 "
+        "검증기를 하드 거부한다 — 통과 발행된 계획이 다음 phase 에서 준비 자체가 "
+        "안 된다.",
+    ),
     # 3. 게이트 결과가 없거나 무의미하다.
     #
     # `conformance gate BLOCKING` 이 실제로 잡는 범위는 "스크립트가 안 돌았다"

package/runtime/python/okstra_ctl/convergence.py

@@ -22,6 +22,13 @@ from .convergence_engine import (
     validate_final_state,
     validate_working_state,
 )
+from .worker_prompt_policy import critic_assignment_ref
+from .convergence_critic_verify_prompt import (
+    CriticVerifyPromptError,
+    critic_result_paths,
+    critic_verify_gaps,
+    critic_verify_prompt_body,
+)
 from .convergence_reverify_prompt import (
     ReverifyPromptError,
     reverify_findings,
@@ -414,6 +421,30 @@ def _parser() -> argparse.ArgumentParser:
     reverify_prompt.add_argument("--plan", type=Path, required=True)
     reverify_prompt.add_argument("--worker", required=True)
 
+    critic_verify_prompt = subparsers.add_parser(
+        "critic-verify-prompt",
+        help="render one analyser's critic gap verification instructions to stdout",
+        description=(
+            "Print the gap-verification instruction body for one Phase 4 analyser. "
+            "The lead writes it verbatim to the file the prompt materializer's "
+            "`--instruction` takes, with `--dispatch-kind critic-verify`. Input is "
+            "the coverage batch the lead will later pass to `apply-critic-gaps` "
+            "(`gaps[]` filled, votes and dispatches not yet) — gaps are assigned "
+            "round-robin over the grouping's analysis roster exactly as "
+            "`apply-critic-gaps` checks them, and this analyser gets its own share. "
+            "Each gap carries the critic's result file and `### [<gapId>]` section, "
+            "the critic audit sidecar the verifier may open, and the adversarial "
+            "response format the collector parses. Nothing here is hand-written."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    critic_verify_prompt.add_argument("--run-manifest", type=Path, required=True)
+    critic_verify_prompt.add_argument(
+        "--gaps", type=Path, required=True,
+        help="coverage batch JSON (schemaVersion 1.0, mode coverage, gaps[])",
+    )
+    critic_verify_prompt.add_argument("--worker", required=True)
+
     apply_critic = subparsers.add_parser(
         "apply-critic-gaps",
         help="apply one coverage-critic verification batch",
@@ -1462,6 +1493,48 @@ def _reverify_prompt(args: argparse.Namespace) -> str:
     )
 
 
+def _critic_verify_prompt(args: argparse.Namespace) -> str:
+    """한 분석자의 critic gap 검증 지시문 본문. 입력은 매니페스트·coverage 배치·워커 id."""
+    authority = validated_run_authority(args.run_manifest)
+    groups_path = authority.run_dir / "state" / _canonical_run_artifact_name(
+        "convergence-groups", authority.task_type, authority.state_sequence
+    )
+    if not groups_path.is_file():
+        raise ConvergenceContractError(
+            "the gap verification prompt needs the Round 0 grouping; run "
+            f"`okstra convergence prepare-groups` first: {groups_path}"
+        )
+    groups = load_owned_json_object(groups_path)
+    batch = load_owned_json_object(args.gaps)
+    task_key = _manifest_authority_string(authority.payload, "taskKey")
+    if batch.get("taskKey") != task_key:
+        raise ConvergenceContractError("coverage batch taskKey does not match the run manifest")
+    if batch.get("mode") != "coverage":
+        raise ConvergenceContractError(
+            "critic-verify-prompt accepts coverage mode only; acceptance candidates "
+            "use confirm-or-downgrade"
+        )
+    critic_ref = critic_assignment_ref(authority.task_type)
+    assignments = authority.payload.get("invocationAssignments")
+    critic = assignments.get(critic_ref) if isinstance(assignments, Mapping) else None
+    if not isinstance(critic, Mapping):
+        raise ConvergenceContractError(
+            f"run manifest has no `{critic_ref}` assignment: this run has no critic"
+        )
+    provider = str(critic.get("provider") or "")
+    result_path, audit_path = critic_result_paths(
+        groups, critic_provider=provider,
+        project_root=authority.project_root, run_dir=authority.run_dir,
+    )
+    return critic_verify_prompt_body(
+        task_key=task_key,
+        critic_worker=f"{provider}-critic",
+        critic_result_path=result_path,
+        critic_audit_path=audit_path,
+        gaps=critic_verify_gaps(batch, groups, args.worker),
+    )
+
+
 def _execute(args: argparse.Namespace) -> tuple[str, Path]:
     operations: dict[str, Any] = {
         "prepare-groups": _prepare_groups,
@@ -1495,8 +1568,12 @@ def main(argv: list[str] | None = None) -> int:
         if args.operation == "reverify-prompt":
             print(_reverify_prompt(args), end="")
             return 0
+        if args.operation == "critic-verify-prompt":
+            print(_critic_verify_prompt(args), end="")
+            return 0
         action, path = _execute(args)
     except (ConvergenceContractError, VerdictBlockError, ReverifyPromptError,
+            CriticVerifyPromptError,
             json.JSONDecodeError, ValueError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return 2

package/runtime/python/okstra_ctl/convergence_critic_prompt.py

@@ -82,7 +82,7 @@ def _project_relative(project_root: Path, path: Path) -> str:
         return path.as_posix()
 
 
-def _analysis_roster(groups: Mapping[str, Any]) -> list[str]:
+def analysis_roster(groups: Mapping[str, Any]) -> list[str]:
     workers = groups.get("workers")
     if not isinstance(workers, list):
         return []
@@ -152,7 +152,7 @@ def analyser_results(
             ),
             finding_ids=tuple(by_worker.get(worker, ())),
         )
-        for worker in _analysis_roster(groups)
+        for worker in analysis_roster(groups)
     ]