okstra 0.195.2 → 0.195.4

package/docs/cli.md

@@ -791,6 +791,7 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra convergence apply-round --work-state <path> --plan <path> --results <path>` | Validate one complete structured result set and atomically reduce it into working state |
 | `okstra convergence critic-prompt --run-manifest <path>` | Render the coverage-critic task instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes. The body carries the run's Round 0 consolidated findings, one line per Phase 4 analyser (worker id, result path, its finding ids), the two mandates plus the `duplicateOf` declaration rule, and — on an implementation-planning re-run — an already-covered index of the prior report's requirement-coverage row ids, clarification row ids, and stage titles (ids and titles only, never body text). Emits the `**Prompt Delivery Mode:**` header and the `Primary analysis packet` line the critic dispatch contract requires, so no part of the critic body is hand-written. Exits 2 when the run has published no grouping yet, or when the manifest carries no `analysisPacketPath` |
 | `okstra convergence reverify-prompt --run-manifest <path> --plan <round-plan.json> --worker <worker-id>` | Render one worker's reverify task instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes. The body carries the round's mandate (adversarial or collaborative, from the grouping's `config`), the plan row's findings in plan order — each with its summary, origin worker, cited-evidence line, the origin worker's result file and `### <item-id>` section, and the origin audit sidecar the verifier is told it may open — and the response format the collector parses. Exits 2 when the plan dispatches nothing to that worker, names a finding the grouping lacks, or is not a `dispatch` plan |
+| `okstra convergence critic-verify-prompt --run-manifest <path> --gaps <coverage-batch.json> --worker <worker-id>` | Render one Phase 4 analyser's coverage-critic gap verification instructions to stdout; the lead writes the output verbatim into the file the prompt materializer's `--instruction` takes and materializes it with `--dispatch-kind critic-verify` under the analyser's `reverify/<worker-id>` assignment ref. Input is the pre-vote coverage batch (`mode: coverage`, `gaps[]` with `gapId`, `summary`, `category`, `ticketIds`, `originEvidence`, optional `duplicateOf`) the lead later passes to `apply-critic-gaps`; gaps are assigned round-robin over the grouping's analysis roster exactly as `apply-critic-gaps` checks them, and the body carries only this analyser's share — each gap with the critic's result file (`<provider>-worker-critic-<task-type>-<seq>.md`) and `### [<gapId>]` section, the critic audit sidecar, and the adversarial response format. Exits 2 when the batch's taskKey or mode does not match, the run has no critic assignment, the critic result is not collected yet, the worker is not an analyser, or round-robin assigns it no gap |
 | `okstra convergence apply-critic-gaps --work-state <path> --results <path>` | Apply one verified coverage-critic batch after the main queue reaches a terminal state |
 | `okstra convergence finalize --work-state <path> --output <path>` | Materialize the terminal schema v1.3 convergence state |
 | `okstra convergence validate --state <path> --kind <working\|final>` | Validate replayable working state or a terminal final state |

package/docs/project-structure-overview.md

@@ -353,6 +353,7 @@ Important modules:
 | `convergence_store.py`, `convergence_migration.py` | atomic JSON persistence plus legacy/new-engine seed decisions; valid terminal finals are reused, while invalid state requires byte-preserving archival before restart |
 | `convergence.py` | `okstra convergence` internal CLI orchestration for `seed`, `plan-round`, `apply-round`, `critic-prompt`, `apply-critic-gaps`, `finalize`, `validate`, and `example`; it composes the reducer, store, and migration policy without duplicating their decisions |
 | `convergence_reverify_prompt.py` | renders one worker's reverify instruction body `okstra convergence reverify-prompt` prints — the round mandate, the plan row's findings with each origin worker's result file, item id, and audit sidecar (declared openable), and the collector's response format. Replaces the hand-written instruction whose abbreviated evidence line and `- Verdict:` format cost a round |
+| `convergence_critic_verify_prompt.py` | renders one analyser's coverage-critic gap verification instruction body `okstra convergence critic-verify-prompt` prints — round-robin share of the pre-vote coverage batch (same assignment as `apply-critic-gaps`), each gap with the critic result file's `### [<gapId>]` section and audit sidecar, the adversarial response format, and the `**Rendered by:**` signature `validate_reverify_prompt` requires for dispatch kind `critic-verify` |
 | `convergence_critic_prompt.py` | renders the coverage-critic seed body `okstra convergence critic-prompt` prints — the Round 0 consolidated findings, one line per Phase 4 analyser (worker id, result path, its finding ids), the two mandates plus the `duplicateOf` rule, and, on an implementation-planning re-run, an already-covered index of the prior report's requirement-coverage row ids, clarification row ids, and stage titles. Ids and titles only; the prior report's body is never copied |
 | `plan_items.py`, `plan_items_cli.py` | deterministic extraction of the report-writer narrative `P-*` plan-item queue plus the `okstra plan-items extract` / `validate` / `seed` / `collect-verdicts` / `apply-verdicts` / `derivations` adapter; v2 data.json remains a read input |
 | `claim_reproduction.py` | reproduces a plan-body single-vote `fact` claim before it can block on one vote — runs the declared probe (`path-exists` / `path-absent` / `literal-present` / `literal-absent` / `citations-differ`) inside the resolved project root and returns `reproduced` / `not-reproduced` / `not-runnable`, which `plan-items apply-verdicts --run-manifest` writes into `reproductionResult` (always overwriting the worker-sent value so a verifier cannot score its own claim). A `judgement` claim, or a `fact` that does not reproduce, takes the quorum route |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.195.2",
+  "version": "0.195.4",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.195.2",
-  "builtAt": "2026-09-09T14:40:36.284Z",
+  "package": "0.195.4",
+  "builtAt": "2026-09-09T19:01:57.276Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/convergence.md

@@ -647,6 +647,8 @@ critic sets `duplicateOf` to that finding's id (`schemas/convergence-critic-resu
 ### Gap verification (1 adversarial reverify round)
 Each critic gap enters the verification queue as a finding with `originWorker = "<provider>-critic"` and `source = "critic"`, except a gap the critic declared `duplicateOf` — that one is recorded and never dispatched. The lead runs ONE adversarial reverify round (§"Adversarial Verification Mode" classifier) in which **each gap is verified by exactly one Phase 4 analyser**: walk the analyser roster in `criticVerification.analyserRoster` order and assign gap *i* to `roster[i % len(roster)]`, then dispatch each assigned analyser once with its own gaps. Rejecting a gap costs the same as accepting one and this round is off the books (`rounds: []`, no `roundHistory` entry) on the serial path, so a batch of two gaps no longer wakes four analysers. **Enforced:** `okstra_ctl.convergence_engine._critic_gap_coverage_errors` accepts a dispatch set that is either the assignee set or the full roster, and rejects anything else — the full roster stays valid because a run finished before this rule cannot say which shape it used, the same dual acceptance `_validate_round_ledger_counts` gives the two round-counting arithmetics. Choosing a critic provider that is already in the analyser roster costs nothing: the critic is a different role contract, a different duty and a different session, so an analyser is not disqualified by sharing its provider name (ADR-0017 — provider and model are not role identity, and the same model assigned to two roles gets two independent workers). The critic cannot judge its own gaps because it is not an analyser: the voter roster is `workers[]` filtered to `audience == "analysis"`, and a critic is not even representable there (the allowed values are `analysis` / `lead` / `report-writer`). `okstra apply-critic-gaps` refuses a vote from anyone outside that roster (`critic voter must be a non-critic analyser`). Only gaps classified `full-consensus` / `partial-consensus` merge into the final report findings; `contested` / `worker-unique` gaps are treated as hallucinations and dropped (recorded in the convergence state, not promoted).
 
+**Dispatching the gap round.** The gap round is off the round ledger, so `plan-round` writes no plan for it and `reverify-prompt` cannot render it; it has its own generator and dispatch kind. Assemble the coverage batch first — the same `{ schemaVersion, taskKey, mode: "coverage", provider, modelExecutionValue, gaps[] }` document `apply-critic-gaps` will take, with each candidate as a gap (`gapId` = the critic's item id, `summary`, `category`, `ticketIds`, `originEvidence`, `duplicateOf` where declared) and no `votes` or `dispatches` yet. Then, for each assigned analyser, render `okstra convergence critic-verify-prompt --run-manifest <run-manifest> --gaps <coverage-batch.json> --worker <worker-id>` and write its output verbatim as the instruction file: it applies the same round-robin as `apply-critic-gaps` (`okstra_ctl.convergence_engine.critic_gap_assignees`) and carries only that analyser's gaps, each with the critic's result file and `### [<gapId>]` section, the critic audit sidecar the verifier may open, and the adversarial response format the collector parses (gap votes are always read as adversarial). Materialize with the analyser's existing `reverify/<worker-id>` assignment ref, `--dispatch-kind critic-verify`, `--audience reverification-worker`, and on a v2 run the analyser's own `--source-role-execution-ref` exactly as a numbered reverify round; name the prompt `<worker-id>-worker-critic-verify-<task-type>-<seq>.md` and the result `worker-results/<worker-id>-worker-critic-verify-<task-type>-<seq>.md`. Collect each result with `parse_finding_votes` semantics (the `### <gapId>` blocks), write the votes and one `dispatches[]` row per assigned analyser into the batch, and run `apply-critic-gaps`. **Enforced (rendering):** `okstra_ctl.convergence_critic_verify_prompt`. **Enforced (pre-dispatch):** `validate_reverify_prompt` in `scripts/okstra_ctl/worker_prompt_contract.py` requires the `**Rendered by:** okstra convergence critic-verify-prompt` line for dispatch kind `critic-verify`, so a hand-written gap instruction cannot be materialized; `worker_prompt_policy.is_verification_dispatch_kind` routes the kind through the reverify prompt plan, and `convergence_store.reserve_dynamic_verifier` records the kind on the v2 reservation. Before this path existed (2026-09-09, dev-10642 requirements-discovery 001) every attempt to dispatch the round was refused and all three gaps ended `gapsUnverified`.
+
 **A gap that received no verdict is NOT a rejected gap (BLOCKING).** Dropping applies only to gaps the voters actually judged. A gap can also end the round *unjudged* — the verification dispatch returned a terminal non-result (`timeout`, `error`, no result file), the returned result covered only some of the gaps, or no non-critic analyser was available to vote at all. Nobody inspected those, so classifying them as hallucinations is a fabricated verdict. Each one MUST be recorded as a `## 5. Missing Information and Risks` row (`missingInformation`, `source: "critic-unverified"`) whose `risk` names the gap and the reason verification did not complete, and counted in `config.critic.gapsUnverified`. They are **not** promoted to findings (unverified) and **not** raised as `clarification` items — an unverified gap needs an analyser to verify it on the next run, not a decision from the user. Silently losing them is a contract violation: the batch that times out is exactly the batch of gaps too expensive to check, so the highest-risk items are the ones that vanish.
 
 **`category: "unrequested-scope"` candidates are classified the same way but disposed of differently.** A coverage gap the voters contest is a hallucination — nothing was actually missing, so dropping it costs one wasted verification. An over-scope candidate the voters contest is a *disagreement about whether the work was asked for*, and dropping that silently returns the run to the state this half exists to change. So:

package/runtime/prompts/lead/report-writer.md

@@ -89,7 +89,7 @@ This section adds report-specific checks to [okstra-lead-contract](./okstra-lead
 4. When the check reports `mechanical: true` (every entry is a `replace` or `remove`), run `okstra agent-prompt apply-corrections` with the same arguments: okstra writes the corrected narrative to `reportNarrativePath` and records a `lead-correction-applied` activity row naming the ledger and its correction ids. No writer dispatch, `record-dispatch`, or `link-result` follows; the roster row's result already exists.
 5. Otherwise materialize the writer prompt with the same `--corrections <ledger>` under a new invocation id and prompt path (retire the first attempt's link with `reject-result` as [plan-body-verification](./plan-body-verification.md) describes). okstra renders `## Corrections` (each entry with its label path, current value, replacement or rule, schema constraint, and reason) and `## Output`; the instruction body carries only context.
 
-A report-writer materialization without `--corrections` whose narrative already exists and parses is refused before any prompt is written — free-form corrections cannot be checked before the writer runs, and four of six re-runs in the 2026-09-03 measurement were lead instructions that contradicted the authoring contract. Only a narrative whose structure does not parse (line grammar, an unknown top-level field) is re-authored, not corrected: that dispatch needs no ledger, and its body quotes the parser's message. A narrative that breaks the line grammar is not a produced artifact: the dispatcher settles that attempt as `required worker artifact is unusable: narrative does not parse: …` and retries it inside the same batch, so you see the parser's message at collection, not at Phase 7 assembly (**Enforced:** `okstra_ctl.dispatch_state.unusable_result_defect`, read by `missing_completion_paths` and the `team await` record path). The synthesis packet's Authoring Contract carries the line grammar itself (`report_narrative.NARRATIVE_GRAMMAR_INSTRUCTIONS`), so a writer that reads only the packet still sees it. Value defects — an id outside its pattern, a value outside its enum, a missing required field — leave the structure readable and are exactly what the ledger fixes; the a3 attempt of the 2026-09-03 run carried twenty `SC-` ids that assembly refused and was still a corrective base.
+A report-writer materialization without `--corrections` whose narrative already exists and parses is refused before any prompt is written — free-form corrections cannot be checked before the writer runs, and four of six re-runs in the 2026-09-03 measurement were lead instructions that contradicted the authoring contract. Only a narrative whose structure does not parse (line grammar, an unknown top-level field) is re-authored, not corrected: that dispatch needs no ledger, and its body quotes the parser's message. Because re-authoring overwrites the live file in place, okstra copies the existing narrative to `worker-results/<narrative-name>.pre-<invocation-id>.md` at materialization and renders a `## Previous Attempt` section naming that copy (**Enforced:** `_preserve_reauthored_narrative` in `scripts/okstra_ctl/agent/prompt_cli/materialize.py`); the 2026-09-09 dev-10642 run lost a 579-line attempt to a failed in-place re-indent command with no copy to fall back on. A narrative that breaks the line grammar is not a produced artifact: the dispatcher settles that attempt as `required worker artifact is unusable: narrative does not parse: …` and retries it inside the same batch, so you see the parser's message at collection, not at Phase 7 assembly (**Enforced:** `okstra_ctl.dispatch_state.unusable_result_defect`, read by `missing_completion_paths` and the `team await` record path). The synthesis packet's Authoring Contract carries the line grammar itself (`report_narrative.NARRATIVE_GRAMMAR_INSTRUCTIONS`), so a writer that reads only the packet still sees it. Value defects — an id outside its pattern, a value outside its enum, a missing required field — leave the structure readable and are exactly what the ledger fixes; the a3 attempt of the 2026-09-03 run carried twenty `SC-` ids that assembly refused and was still a corrective base.
 
 **Enforced:** `_with_report_writer_sections` / `_refuse_free_form_correction` in `scripts/okstra_ctl/agent/prompt_cli/materialize.py`, `report_corrections.check_corrections`, `agent/prompt_cli/corrections.run_corrections_apply`; `tests/run/test_agent_prompt_corrections.py` and `tests/contract/test_report_writer_v3_contract.py` keep this procedure in the lead contract.
 

package/runtime/python/okstra_ctl/adapters/hosts/capability_adapter.py

@@ -151,6 +151,11 @@ class CapabilityInteractionPort:
         """
         return self._limits.max_options
 
+    @property
+    def native_question_limit(self) -> int:
+        """이 호스트의 네이티브 질문 묶음이 한 화면에 받는 질문 수."""
+        return self._limits.max_questions
+
     def _native_options_fit(self, prompt: WizardPrompt) -> bool:
         labels = tuple(option.label for option in prompt.options)
         return (

package/runtime/python/okstra_ctl/agent/prompt_cli/dynamic_verifier.py

@@ -25,6 +25,7 @@ from ...convergence_store import (
     DYNAMIC_VERIFIER_SOURCE_ROLES,
     reserve_dynamic_verifier,
 )
+from ...worker_prompt_policy import CRITIC_VERIFY_DISPATCH_KIND
 from .inputs import AgentPromptCliError
 
 
@@ -46,7 +47,8 @@ def _reserve_dynamic_verifier_request(
         manifest_path,
         source_role_execution_ref=source_role_execution_ref,
         duty_id=args.audience,
-        round_number=_reverify_round(args.dispatch_kind),
+        round_number=_reservation_round(args.dispatch_kind),
+        dispatch_kind=args.dispatch_kind,
         task_key=_required_manifest_string(manifest, "taskKey"),
         input_digest="sha256:" + hashlib.sha256(agent_prompt_task_bytes(prompt_bytes)).hexdigest(),
         invocation_ref=args.invocation_id,
@@ -100,12 +102,18 @@ def _dynamic_verifier_source(
     return None
 
 
-def _reverify_round(dispatch_kind: str) -> int:
+def _reservation_round(dispatch_kind: str) -> int:
+    """예약에 적는 라운드 번호. critic gap 검증은 라운드 원장 밖이라 1 이다 —
+    dispatch 가 attempt 행에 적는 값(`_dispatch_round`: 번호 없는 kind 는 1)과
+    같아야 한다."""
+    if dispatch_kind == CRITIC_VERIFY_DISPATCH_KIND:
+        return 1
     prefix = "reverify-r"
     value = dispatch_kind.removeprefix(prefix)
     if not dispatch_kind.startswith(prefix) or not value.isdigit() or int(value) < 1:
         raise AgentPromptCliError(
-            "dynamic verifier dispatch kind must be reverify-r<N>"
+            "dynamic verifier dispatch kind must be reverify-r<N> or "
+            f"{CRITIC_VERIFY_DISPATCH_KIND}"
         )
     return int(value)
 

package/runtime/python/okstra_ctl/agent/prompt_cli/inputs.py

@@ -37,7 +37,14 @@ def _authorized_path(
         for value in raw_roots
     ]
     if not any(_is_relative_to(path, root) for root in roots):
-        raise AgentPromptCliError(f"{label} path is outside authorized roots: {path}")
+        # 루트를 말하지 않으면 시행착오로 찾는다(2026-09-09 실측: ledger 의
+        # baseNarrativePath 를 `state/` 에 두었다가 거부돼 `worker-results/` 로
+        # 옮겨서야 통과).
+        listed = ", ".join(str(value) for value in raw_roots)
+        raise AgentPromptCliError(
+            f"{label} path is outside authorized roots: {path}; authorized "
+            f"{label} roots (project-relative): {listed}"
+        )
     return path
 
 

package/runtime/python/okstra_ctl/agent/prompt_cli/materialize.py

@@ -34,6 +34,7 @@ from ...assignment_resolver import AssignmentContext, resolve_dispatch_assignmen
 from ...path_hints import hydrate_active_run_context
 from ...worker_prompt_headers import worker_prompt_headers
 from ...worker_prompt_contract import complete_reverify_instruction, validate_reverify_prompt
+from ...worker_prompt_policy import is_verification_dispatch_kind
 from ...paths import okstra_home
 from ...final_report_paths import final_report_data_path
 from ...final_report_schema import load_schema_version
@@ -299,7 +300,7 @@ def _materialize_run(
         active_context=active_context,
     ))
     body = instruction_path.read_text(encoding="utf-8")
-    is_reverify = args.dispatch_kind.startswith("reverify-r")
+    is_reverify = is_verification_dispatch_kind(args.dispatch_kind)
     if is_reverify:
         body = _complete_run_reverify_body(args, manifest, active_context, assignment, body, instruction_path)
     if args.audience == "report-writer":
@@ -370,6 +371,7 @@ def _materialize_run(
             candidate, task_type=str(manifest["taskType"]),
             forbidden_actions=str(active_context["workflow"]["forbiddenActions"]),
             expected_model=assignment.model_execution_value,
+            dispatch_kind=args.dispatch_kind,
         )
         if errors:
             raise AgentPromptCliError("; ".join(errors))
@@ -441,7 +443,8 @@ def _with_report_writer_sections(
         raise AgentPromptCliError(
             f"instruction body must not contain {', '.join(conflicts)}: okstra "
             "renders those sections itself (## Output from the run manifest, "
-            "## Corrections from the --corrections ledger)"
+            "## Corrections from the --corrections ledger, ## Previous Attempt "
+            "from the narrative a re-authoring dispatch replaces)"
         )
     sections: list[str] = []
     if getattr(args, "corrections", None):
@@ -472,16 +475,57 @@ def _with_report_writer_sections(
         sections.append("")
     else:
         _refuse_free_form_correction(project_root, narrative_path)
+        preserved = _preserve_reauthored_narrative(
+            project_root, narrative_path, invocation_id=str(args.invocation_id),
+        )
+        if preserved is not None:
+            sections.extend(_render_previous_attempt_section(preserved))
+            sections.append("")
     sections.extend(render_output_section())
     return body.rstrip("\n") + "\n\n" + "\n".join(sections) + "\n"
 
 
+def _preserve_reauthored_narrative(
+    project_root: Path, narrative_path: Path, *, invocation_id: str,
+) -> str | None:
+    """재저작 디스패치 전에 기존 서사를 사본으로 남기고 그 상대 경로를 돌려준다.
+
+    교정(ledger) 경로는 리드가 `baseNarrativePath` 사본을 만들지만, 구조가 안
+    읽히는 서사는 원장 없이 재저작으로 통과해 사본 요구가 없었다. 실측
+    (2026-09-09 dev-10642 requirements-discovery 001): 들여쓰기만 고치는 재저작에서
+    작성자의 변환 명령이 실패해 579줄 서사가 0 바이트로 덮였고, `.okstra` 는
+    gitignore 라 복구본이 없었다. 재저작은 live 파일을 제자리에서 덮어쓰므로
+    okstra 가 사본을 남긴다. 빈 파일은 남길 내용이 없어 건너뛴다.
+    """
+    if not narrative_path.is_file() or narrative_path.stat().st_size == 0:
+        return None
+    copy_path = narrative_path.with_name(
+        f"{narrative_path.stem}.pre-{invocation_id}{narrative_path.suffix}"
+    )
+    if os.path.normpath(copy_path) == os.path.normpath(narrative_path):
+        raise AgentPromptCliError("preserved narrative copy resolves to the live narrative")
+    shutil.copyfile(narrative_path, copy_path)
+    return _relative(project_root, copy_path)
+
+
+def _render_previous_attempt_section(preserved_rel: str) -> list[str]:
+    return [
+        "## Previous Attempt",
+        "",
+        f"Your previous attempt is preserved at `{preserved_rel}`. Read that copy for "
+        "its content and write the re-authored narrative to `**Result Path:**` as a "
+        "fresh file. Do not transform the file at `**Result Path:**` in place with a "
+        "shell or script command: a failed command leaves an empty file and the run "
+        "loses the attempt. The preserved copy is read-only for you.",
+    ]
+
+
 def _refuse_free_form_correction(project_root: Path, narrative_path: Path) -> None:
     """서사가 이미 있고 구조가 읽히면 이 디스패치는 교정이다 — 원장 없이는 거절한다.
 
     구조가 읽히지 않는 서사(줄 문법·소유권 결함)는 교정 대상이 아니라 재저작
     대상이다(원장의 경로가 해소될 자료가 없다). 그 디스패치는 원장 없이
-    통과한다. 값 결함(패턴 밖 id, enum 밖 값)은 구조가 읽히는 서사이고, 그것이
+    통과하고, `_preserve_reauthored_narrative` 가 기존 파일의 사본을 남긴다. 값 결함(패턴 밖 id, enum 밖 값)은 구조가 읽히는 서사이고, 그것이
     원장이 고치는 자리다 — 실측(dev-10626 a3)의 `SC-` id 20곳이 이 경우다.
     """
     if not narrative_path.is_file():

package/runtime/python/okstra_ctl/blocking_checks.py

@@ -135,6 +135,18 @@ _BLOCKING: tuple[tuple[str, str], ...] = (
         "승인 경계(scripts/okstra_ctl/run.py `_validate_approved_plan_conformance`)"
         "가 같은 형식을 하드 거부한다 — 같은 이유로 구현 준비가 막힌다.",
     ),
+    # Stage 관계 검사(S-검사: depends-on DAG, 병렬 stage 파일 안전, RED→GREEN
+    # 순서, TDD 면제 어휘). 계획 런은 validate-run.py `_append_stage_data_failures`
+    # 가 이 접두로 기록하고, 구현 진입은 같은 검증기를 subprocess 로 돌려
+    # exit≠0 이면 PrepareError 로 거부한다. 2026-09-09 dev-10628 실측: Stage 1
+    # 첫 단계가 `RED:` 가 아닌 계획(S10c)이 advisory 로 승인까지 갔다가 구현
+    # 준비에서 거부돼, 승인된 불변 계획을 되돌려 다시 계획해야 했다.
+    (
+        "implementation-planning stage contract invalid",
+        "구현 진입(scripts/okstra_ctl/run.py `_validate_stage_structure`)이 같은 "
+        "검증기를 하드 거부한다 — 통과 발행된 계획이 다음 phase 에서 준비 자체가 "
+        "안 된다.",
+    ),
     # 3. 게이트 결과가 없거나 무의미하다.
     #
     # `conformance gate BLOCKING` 이 실제로 잡는 범위는 "스크립트가 안 돌았다"

package/runtime/python/okstra_ctl/convergence.py

@@ -22,6 +22,13 @@ from .convergence_engine import (
     validate_final_state,
     validate_working_state,
 )
+from .worker_prompt_policy import critic_assignment_ref
+from .convergence_critic_verify_prompt import (
+    CriticVerifyPromptError,
+    critic_result_paths,
+    critic_verify_gaps,
+    critic_verify_prompt_body,
+)
 from .convergence_reverify_prompt import (
     ReverifyPromptError,
     reverify_findings,
@@ -414,6 +421,30 @@ def _parser() -> argparse.ArgumentParser:
     reverify_prompt.add_argument("--plan", type=Path, required=True)
     reverify_prompt.add_argument("--worker", required=True)
 
+    critic_verify_prompt = subparsers.add_parser(
+        "critic-verify-prompt",
+        help="render one analyser's critic gap verification instructions to stdout",
+        description=(
+            "Print the gap-verification instruction body for one Phase 4 analyser. "
+            "The lead writes it verbatim to the file the prompt materializer's "
+            "`--instruction` takes, with `--dispatch-kind critic-verify`. Input is "
+            "the coverage batch the lead will later pass to `apply-critic-gaps` "
+            "(`gaps[]` filled, votes and dispatches not yet) — gaps are assigned "
+            "round-robin over the grouping's analysis roster exactly as "
+            "`apply-critic-gaps` checks them, and this analyser gets its own share. "
+            "Each gap carries the critic's result file and `### [<gapId>]` section, "
+            "the critic audit sidecar the verifier may open, and the adversarial "
+            "response format the collector parses. Nothing here is hand-written."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    critic_verify_prompt.add_argument("--run-manifest", type=Path, required=True)
+    critic_verify_prompt.add_argument(
+        "--gaps", type=Path, required=True,
+        help="coverage batch JSON (schemaVersion 1.0, mode coverage, gaps[])",
+    )
+    critic_verify_prompt.add_argument("--worker", required=True)
+
     apply_critic = subparsers.add_parser(
         "apply-critic-gaps",
         help="apply one coverage-critic verification batch",
@@ -1462,6 +1493,48 @@ def _reverify_prompt(args: argparse.Namespace) -> str:
     )
 
 
+def _critic_verify_prompt(args: argparse.Namespace) -> str:
+    """한 분석자의 critic gap 검증 지시문 본문. 입력은 매니페스트·coverage 배치·워커 id."""
+    authority = validated_run_authority(args.run_manifest)
+    groups_path = authority.run_dir / "state" / _canonical_run_artifact_name(
+        "convergence-groups", authority.task_type, authority.state_sequence
+    )
+    if not groups_path.is_file():
+        raise ConvergenceContractError(
+            "the gap verification prompt needs the Round 0 grouping; run "
+            f"`okstra convergence prepare-groups` first: {groups_path}"
+        )
+    groups = load_owned_json_object(groups_path)
+    batch = load_owned_json_object(args.gaps)
+    task_key = _manifest_authority_string(authority.payload, "taskKey")
+    if batch.get("taskKey") != task_key:
+        raise ConvergenceContractError("coverage batch taskKey does not match the run manifest")
+    if batch.get("mode") != "coverage":
+        raise ConvergenceContractError(
+            "critic-verify-prompt accepts coverage mode only; acceptance candidates "
+            "use confirm-or-downgrade"
+        )
+    critic_ref = critic_assignment_ref(authority.task_type)
+    assignments = authority.payload.get("invocationAssignments")
+    critic = assignments.get(critic_ref) if isinstance(assignments, Mapping) else None
+    if not isinstance(critic, Mapping):
+        raise ConvergenceContractError(
+            f"run manifest has no `{critic_ref}` assignment: this run has no critic"
+        )
+    provider = str(critic.get("provider") or "")
+    result_path, audit_path = critic_result_paths(
+        groups, critic_provider=provider,
+        project_root=authority.project_root, run_dir=authority.run_dir,
+    )
+    return critic_verify_prompt_body(
+        task_key=task_key,
+        critic_worker=f"{provider}-critic",
+        critic_result_path=result_path,
+        critic_audit_path=audit_path,
+        gaps=critic_verify_gaps(batch, groups, args.worker),
+    )
+
+
 def _execute(args: argparse.Namespace) -> tuple[str, Path]:
     operations: dict[str, Any] = {
         "prepare-groups": _prepare_groups,
@@ -1495,8 +1568,12 @@ def main(argv: list[str] | None = None) -> int:
         if args.operation == "reverify-prompt":
             print(_reverify_prompt(args), end="")
             return 0
+        if args.operation == "critic-verify-prompt":
+            print(_critic_verify_prompt(args), end="")
+            return 0
         action, path = _execute(args)
     except (ConvergenceContractError, VerdictBlockError, ReverifyPromptError,
+            CriticVerifyPromptError,
             json.JSONDecodeError, ValueError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return 2

package/runtime/python/okstra_ctl/convergence_critic_prompt.py

@@ -82,7 +82,7 @@ def _project_relative(project_root: Path, path: Path) -> str:
         return path.as_posix()
 
 
-def _analysis_roster(groups: Mapping[str, Any]) -> list[str]:
+def analysis_roster(groups: Mapping[str, Any]) -> list[str]:
     workers = groups.get("workers")
     if not isinstance(workers, list):
         return []
@@ -152,7 +152,7 @@ def analyser_results(
             ),
             finding_ids=tuple(by_worker.get(worker, ())),
         )
-        for worker in _analysis_roster(groups)
+        for worker in analysis_roster(groups)
     ]
 
 

package/runtime/python/okstra_ctl/convergence_critic_verify_prompt.py

@@ -0,0 +1,221 @@
+"""coverage-critic gap 검증 지시문을 gap 배치와 로스터에서 결정적으로 렌더한다.
+
+`prompts/lead/convergence.md` §"Gap verification" 은 critic 의 gap 마다 Phase 4
+분석자 한 명이 1라운드 adversarial 반박을 하라고 요구한다. 그런데 그 라운드는
+번호 라운드 원장 밖이라 `plan-round` 가 계획을 내지 않고, `reverify-prompt` 는
+계획 행만 렌더하며, 검증 audience 의 프롬프트는 렌더러 서명 없이는 materialize
+가 거절한다. 실측(2026-09-09 dev-10642 requirements-discovery 001): 리드가 세
+경로를 다 시도해 전부 거부됐고 gap 3건이 `gapsUnverified` 로 남았다.
+
+이 모듈이 그 지시문을 만든다. 입력은 리드가 `apply-critic-gaps` 에 줄 것과 같은
+coverage 배치(투표 전, `gaps[]` 만 채운 상태)와 Round 0 그룹(분석 로스터)이다.
+배정은 엔진과 같은 규칙(`critic_gap_assignees`, 로스터 순서 round-robin)이라
+`apply-critic-gaps` 의 커버리지 검사와 어긋나지 않는다. gap 마다 critic 결과
+파일의 `### [<gapId>]` 절과 critic 감사 사이드카를 실어, 검증자가 리드의 전사가
+아니라 critic 이 실제로 인용한 것을 판단하게 한다. 응답 형식은 번호 라운드와
+같은 adversarial 정본이다 — `apply-critic-gaps` 는 gap 표를 언제나
+adversarial 로 읽는다(`_parse_critic_gap` 의 `adversarial=True`).
+
+산출물은 프롬프트 materializer 의 `--instruction` 이 받는 본문이다. `## Instructions`
+로 시작하므로 `complete_reverify_instruction` 이 모델·task type·금지 목록을 그
+앞에 붙이고 출력 계약을 뒤에 덧붙인다.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .convergence_critic_prompt import analysis_roster
+from .convergence_engine import critic_gap_assignees
+from .convergence_provenance import worker_result_suffix
+from .convergence_reverify_prompt import (
+    ADVERSARIAL_MANDATE,
+    ADVERSARIAL_RESPONSE,
+)
+from .worker_artifact_paths import WorkerArtifactPathError, audit_sidecar_rel
+from .worker_prompt_policy import CRITIC_VERIFY_DISPATCH_KIND
+
+
+class CriticVerifyPromptError(ValueError):
+    """지시문을 결정적으로 만들 수 없다."""
+
+
+# 렌더된 지시문의 서명. `validate_reverify_prompt` 가 dispatch kind
+# `critic-verify` 에 이 줄을 요구한다 — 번호 라운드의 `reverify-prompt` 서명과
+# 같은 역할이고, 손으로 쓴 지시문은 materialize 에서 거절된다.
+RENDERED_BY_LINE = "**Rendered by:** okstra convergence critic-verify-prompt"
+
+
+@dataclass(frozen=True)
+class CriticGap:
+    """검증 큐의 gap 하나와, critic 결과 파일 안의 실물 인용 위치."""
+
+    gap_id: str
+    summary: str
+    category: str
+    ticket_ids: tuple[str, ...]
+    origin_evidence: str
+
+
+def _nonempty_string(value: Any) -> str:
+    return value if isinstance(value, str) and value.strip() else ""
+
+
+def _project_relative(project_root: Path, path: Path) -> str:
+    try:
+        return path.resolve().relative_to(project_root.resolve()).as_posix()
+    except ValueError as exc:
+        raise CriticVerifyPromptError(
+            f"critic result resolves outside the project root: {path}"
+        ) from exc
+
+
+def critic_result_paths(
+    groups: Mapping[str, Any],
+    *,
+    critic_provider: str,
+    project_root: Path,
+    run_dir: Path,
+) -> tuple[str, str]:
+    """critic 결과 파일과 그 감사 사이드카의 프로젝트 상대 경로.
+
+    critic 결과는 `<provider>-worker-critic-<task-type>-<workerResults seq>.md`
+    로 쓰인다(`-worker-` 토큰이 사이드카 이름을 결정한다 — convergence.md
+    §"Coverage critic pass"). 접미사는 분석자 결과와 같은 규칙으로 그룹의
+    `runManifestPath` 에서 읽는다. 파일이 없으면 critic 결과가 아직 수집되지
+    않은 것이라 거절한다 — gap 검증은 critic 결과 뒤에만 온다.
+    """
+    if not _nonempty_string(critic_provider):
+        raise CriticVerifyPromptError("run manifest has no critic assignment provider")
+    suffix = worker_result_suffix(Path(run_dir), groups)
+    if suffix is None:
+        raise CriticVerifyPromptError(
+            "cannot resolve the worker-result suffix from the grouping's runManifestPath"
+        )
+    result = Path(run_dir) / "worker-results" / f"{critic_provider}-worker-critic-{suffix}.md"
+    if not result.is_file():
+        raise CriticVerifyPromptError(
+            f"critic result is not collected yet: {result}; gap verification "
+            "follows the critic result"
+        )
+    result_rel = _project_relative(project_root, result)
+    try:
+        return result_rel, audit_sidecar_rel(result_rel)
+    except WorkerArtifactPathError as exc:
+        raise CriticVerifyPromptError(str(exc)) from exc
+
+
+def critic_verify_gaps(
+    batch: Mapping[str, Any],
+    groups: Mapping[str, Any],
+    worker_id: str,
+) -> list[CriticGap]:
+    """이 워커에게 배정된 gap 을 배치 순서대로.
+
+    배정은 `critic_gap_assignees` 와 같다: 선언된 중복을 뺀 gap *i* 가
+    `roster[i % len(roster)]` 에게 간다. 로스터는 Round 0 그룹의 분석 audience
+    워커 순서다 — `apply-critic-gaps` 가 `analyserRoster` 로 적는 것과 같은
+    순서다.
+    """
+    gaps_value = batch.get("gaps")
+    if not isinstance(gaps_value, list) or not gaps_value:
+        raise CriticVerifyPromptError("coverage batch has no gaps array")
+    roster = analysis_roster(groups)
+    # `<worker>-worker` 슬러그도 같은 워커다 — reverify 의 `plan_row_for_worker`
+    # 와 validate-run 의 `_plan_dispatch_finding_ids` 가 같은 규칙으로 맞춘다.
+    if worker_id not in roster and worker_id.removesuffix("-worker") in roster:
+        worker_id = worker_id.removesuffix("-worker")
+    if worker_id not in roster:
+        raise CriticVerifyPromptError(
+            f"`{worker_id}` is not an analysis worker of this run; roster: "
+            f"{', '.join(roster) or 'none'}"
+        )
+    verifiable = [
+        gap for gap in gaps_value
+        if isinstance(gap, Mapping) and not gap.get("duplicateOf")
+    ]
+    assignees = critic_gap_assignees(roster, verifiable)
+    assigned: list[CriticGap] = []
+    seen: set[str] = set()
+    for gap, assignee in zip(verifiable, assignees):
+        gap_id = _nonempty_string(gap.get("gapId"))
+        if not gap_id:
+            raise CriticVerifyPromptError("coverage batch gap has no gapId")
+        if gap_id in seen:
+            raise CriticVerifyPromptError(f"duplicate critic gapId: {gap_id}")
+        seen.add(gap_id)
+        if assignee != worker_id:
+            continue
+        ticket_ids = gap.get("ticketIds")
+        assigned.append(CriticGap(
+            gap_id=gap_id,
+            summary=_nonempty_string(gap.get("summary")),
+            category=_nonempty_string(gap.get("category")),
+            ticket_ids=tuple(
+                str(ticket) for ticket in ticket_ids
+            ) if isinstance(ticket_ids, list) else (),
+            origin_evidence=_nonempty_string(gap.get("originEvidence")),
+        ))
+    if not assigned:
+        raise CriticVerifyPromptError(
+            f"round-robin assigns no gap to `{worker_id}`; assignees in batch "
+            f"order: {', '.join(assignees) or 'none'}"
+        )
+    return assigned
+
+
+_EVIDENCE_ACCESS = """The `**Cited evidence**` line is the lead's summary of what the critic cited.
+The complete citation is the critic's own item: before judging, open the
+`**Origin item**` file at the named `### [<gap-id>]` section and read every path,
+line, command, and quote it cites. The `**Origin audit sidecar**` records the
+read-only commands the critic ran and their output; it counts as cited evidence
+and you may open it. A gap claims that something was NOT covered — to refute it,
+show where the coverage exists (an analyser result item, a file, a test); to
+let it survive, confirm the coverage is absent where the critic says it is."""
+
+
+def critic_verify_prompt_body(
+    *,
+    task_key: str,
+    critic_worker: str,
+    critic_result_path: str,
+    critic_audit_path: str,
+    gaps: Sequence[CriticGap],
+) -> str:
+    """critic gap 검증 지시문 본문. 같은 입력이면 같은 바이트를 낸다."""
+    if not _nonempty_string(task_key):
+        raise CriticVerifyPromptError("run manifest carries no taskKey")
+    if not gaps:
+        raise CriticVerifyPromptError("no gaps to verify")
+    rows = [
+        "## Instructions\n\n",
+        f"{RENDERED_BY_LINE}\n\n",
+        f"Perform ADVERSARIAL coverage-gap verification for {task_key} "
+        f"(dispatch kind `{CRITIC_VERIFY_DISPATCH_KIND}`, one round).\n\n",
+        ADVERSARIAL_MANDATE, "\n\n",
+        _EVIDENCE_ACCESS, "\n\n",
+        "## Findings to verify\n",
+    ]
+    for gap in gaps:
+        rows.append(f"\n### {gap.gap_id}: {gap.summary or '(no summary)'}\n")
+        rows.append(f"**Origin**: {critic_worker}\n")
+        rows.append(f"**Category**: {gap.category or '(none recorded)'}\n")
+        if gap.ticket_ids:
+            rows.append(f"**Tickets**: {', '.join(gap.ticket_ids)}\n")
+        rows.append(f"**Cited evidence**: {gap.origin_evidence or '(none recorded)'}\n")
+        rows.append(
+            f"**Origin item**: `{critic_result_path}` — section `### [{gap.gap_id}]`\n"
+        )
+        rows.append(f"**Origin audit sidecar**: `{critic_audit_path}`\n")
+    rows.append("\n## Response format\n\n")
+    rows.append(
+        "One block per gap, headed by the gap id at exactly three hashes. "
+        "Field labels are bold with the colon outside (`**Verdict**: …`); the "
+        "collector also reads `**Verdict:** …` and `- Verdict: …` as the same field.\n\n"
+    )
+    rows.append(ADVERSARIAL_RESPONSE.replace("<finding-id>", gaps[0].gap_id))
+    rows.append("\n")
+    if len(gaps) > 1:
+        rows.append(f"\n### {gaps[1].gap_id}\n**Verdict**: ...\n")
+    return "".join(rows)

package/runtime/python/okstra_ctl/convergence_engine.py

@@ -952,7 +952,7 @@ def _parse_critic_dispatches(
     return dispatches, completed
 
 
-def _critic_gap_assignees(
+def critic_gap_assignees(
     roster_order: list[str],
     gaps: list[Mapping[str, Any]],
 ) -> list[str]:
@@ -990,7 +990,7 @@ def _critic_gap_coverage_errors(
     계약 위반이 아니라 더 본 것이고, 그 사이 방치된 gap 은 표가 없어
     `unverifiedGaps` 로 스스로 드러난다.
     """
-    assignees = set(_critic_gap_assignees(roster_order, gaps))
+    assignees = set(critic_gap_assignees(roster_order, gaps))
     if dispatched == set(roster_order) or dispatched == assignees:
         return []
     missing = sorted(assignees - dispatched)

package/runtime/python/okstra_ctl/convergence_reverify_prompt.py

@@ -53,7 +53,7 @@ class ReverifyFinding:
     origin_audit_path: str
 
 
-_ADVERSARIAL_MANDATE = """Your job is to BREAK each finding below, not to confirm it. For EACH finding,
+ADVERSARIAL_MANDATE = """Your job is to BREAK each finding below, not to confirm it. For EACH finding,
 open the cited evidence directly and actively search for evidence that the claim
 is wrong, overstated, or unproven. Then respond with exactly one verdict:
 
@@ -95,7 +95,7 @@ commands that worker ran and their output; it counts as cited evidence and you m
 open it. Judge the claim against what the origin worker actually cited, never against
 the summary line alone."""
 
-_ADVERSARIAL_RESPONSE = """### <finding-id>
+ADVERSARIAL_RESPONSE = """### <finding-id>
 **Verdict**: REFUTED | SURVIVES | SURVIVES-WITH-CAVEAT | UNVERIFIABLE
 **Basis** (only if REFUTED): counter-evidence | burden-not-met
 **Explanation**: <2-3 sentences; for counter-evidence include the file:line you found>"""
@@ -206,8 +206,8 @@ def reverify_prompt_body(
     if not findings:
         raise ReverifyPromptError("no findings to verify")
     mode = "ADVERSARIAL re-verification" if adversarial else "re-verification"
-    mandate = _ADVERSARIAL_MANDATE if adversarial else _COLLABORATIVE_MANDATE
-    response = _ADVERSARIAL_RESPONSE if adversarial else _COLLABORATIVE_RESPONSE
+    mandate = ADVERSARIAL_MANDATE if adversarial else _COLLABORATIVE_MANDATE
+    response = ADVERSARIAL_RESPONSE if adversarial else _COLLABORATIVE_RESPONSE
     rows = [
         "## Instructions\n\n",
         f"{RENDERED_BY_LINE}\n\n",

package/runtime/python/okstra_ctl/convergence_store.py

@@ -106,9 +106,16 @@ def reserve_dynamic_verifier(
     *,
     input_digest: str,
     invocation_ref: str | None = None,
+    dispatch_kind: str | None = None,
 ) -> tuple[RoleExecution, Invocation]:
     """Reserve one provider-neutral verifier identity for a logical round.
 
+    ``dispatch_kind`` 를 주지 않으면 번호 라운드(`reverify-r<N>`)다. critic gap
+    검증(`critic-verify`)은 같은 verifier 신원을 예약하되 kind 를 그대로 적는다 —
+    validate-run 이 team-state 의 dispatch kind 와 예약된 invocation 의
+    `dispatchKind` 를 대조하므로 예약이 `reverify-r1` 로 남으면 그 디스패치가
+    거부된다.
+
     예약은 정체성만 잡는다. 쓰기 계약은 디스패치가 attempt 를 열 때 한 번만
     계산해 그 attempt 행에 적는다 — 예약이 같은 값을 두 번째로 계산하던 동안,
     두 계산의 입력(worktree)이 갈리면 같은 invocationRef 가 `invocationRef
@@ -156,7 +163,7 @@ def reserve_dynamic_verifier(
             source_invocation_ref=None,
             recovery_ref=None,
             duty_id=duty_id,
-            dispatch_kind=f"reverify-r{round_number}",
+            dispatch_kind=dispatch_kind or f"reverify-r{round_number}",
             round=round_number,
             input_digest=input_digest,
         )

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -61,6 +61,7 @@ from .worker_prompt_contract import (
     validate_prompt_model_header,
     validate_reverify_prompt,
 )
+from .worker_prompt_policy import is_verification_dispatch_kind
 from .worker_runner import LIVE, QUIET
 from .worker_request import verifier_extra_dirs
 from .worker_artifact_paths import audit_sidecar_rel
@@ -1880,13 +1881,13 @@ def validate_dispatch_prompts(
     if isinstance(manifest.get("agentContract"), Mapping):
         _validate_agent_invocations(manifest, jobs)
     initial_jobs = [
-        job for job in jobs if not job.dispatch_kind.startswith("reverify-r")
+        job for job in jobs if not is_verification_dispatch_kind(job.dispatch_kind)
     ]
     if initial_jobs:
         validate_initial_prompts(manifest, initial_jobs)
 
     reverify_jobs = [
-        job for job in jobs if job.dispatch_kind.startswith("reverify-r")
+        job for job in jobs if is_verification_dispatch_kind(job.dispatch_kind)
     ]
     if not reverify_jobs:
         return
@@ -1919,6 +1920,7 @@ def validate_dispatch_prompts(
                 task_type=task_type,
                 forbidden_actions=forbidden_actions,
                 expected_model=job.model_execution_value or None,
+                dispatch_kind=job.dispatch_kind,
             )
         )
     if errors:

package/runtime/python/okstra_ctl/final_report_schema.py

@@ -334,6 +334,65 @@ class _Validator:
         self.errors.append(f"{_format_path(path)}: {message}")
 
 
+def follow_up_task_rules(schema: Mapping[str, Any], task_type: str) -> tuple[str, ...]:
+    """이 task type 의 `followUpTasks` 에 스키마가 못 박은 행 규칙, 저작 문장으로.
+
+    `allOf` 의 if/then 가지 하나가 비종결 task type 에 phase-continuation 행
+    하나를 요구하고(`minItems`, `contains.origin.const`), `FollowUpRow` 의
+    가지가 그 행의 `autoSpawn` 을 `no` 로 고정한다. 작성자는 둘 다 읽지 못해
+    빈 배열을 냈고 조립이 `array length 0 < minItems 1` 로 거절했다(2026-09-09
+    실측, dev-10642 requirements-discovery: 이 계열로만 라운드 3회). 가지가
+    이 task type 에 없으면 빈 튜플이다 — 제약이 없다는 뜻이지 실패가 아니다.
+    """
+    def _task_matches(condition: Any) -> bool:
+        if not isinstance(condition, dict):
+            return False
+        header = (condition.get("properties") or {}).get("header") or {}
+        selector = (header.get("properties") or {}).get("taskType") or {}
+        allowed = selector.get("enum")
+        if allowed is None and "const" in selector:
+            allowed = [selector["const"]]
+        return isinstance(allowed, list) and task_type in allowed
+
+    rules: list[str] = []
+    for branch in schema.get("allOf") or []:
+        if not isinstance(branch, dict) or not _task_matches(branch.get("if")):
+            continue
+        follow_up = ((branch.get("then") or {}).get("properties") or {}).get("followUpTasks")
+        if not isinstance(follow_up, dict):
+            continue
+        min_items = follow_up.get("minItems")
+        origin = (
+            ((follow_up.get("contains") or {}).get("properties") or {}).get("origin") or {}
+        ).get("const")
+        if isinstance(min_items, int) and min_items > 0:
+            rules.append(
+                f"`Follow Up Tasks`: at least {min_items} `- Item N` row(s) for task "
+                f"type `{task_type}`; an empty list is refused."
+            )
+        if isinstance(origin, str) and origin:
+            rules.append(
+                f"`Follow Up Tasks`: one row must carry `Origin` `{origin}` — the "
+                "next phase of this task."
+            )
+            row_schema = (schema.get("$defs") or {}).get("FollowUpRow") or {}
+            for row_branch in row_schema.get("allOf") or []:
+                if not isinstance(row_branch, dict):
+                    continue
+                condition = ((row_branch.get("if") or {}).get("properties") or {}).get("origin") or {}
+                if condition.get("const") != origin:
+                    continue
+                pinned = ((row_branch.get("then") or {}).get("properties") or {})
+                for key, value in pinned.items():
+                    if isinstance(value, dict) and "const" in value:
+                        rules.append(
+                            f"`Follow Up Tasks`: the `{origin}` row's `{key}` "
+                            f"(schema key; write its Title Case label) is exactly "
+                            f"`{value['const']}`."
+                        )
+    return tuple(rules)
+
+
 def verdict_token_rule(schema: Mapping[str, Any], task_type: str) -> tuple[str, ...]:
     """이 task type 의 `finalVerdict.verdictToken` 에 스키마가 허용하는 값.
 

package/runtime/python/okstra_ctl/report_corrections.py

@@ -35,7 +35,7 @@ from .report_narrative import (
 CORRECTION_KINDS = ("replace", "remove", "rewrite")
 MECHANICAL_KINDS = frozenset({"replace", "remove"})
 # okstra 가 렌더하는 절. 지시문 본문에 있으면 두 절이 갈라지므로 거절한다.
-OKSTRA_OWNED_SECTIONS = ("## Corrections", "## Output")
+OKSTRA_OWNED_SECTIONS = ("## Corrections", "## Previous Attempt", "## Output")
 
 _SCHEMA_RELATIVE = ("schemas", "report-writer-corrections-v1.0.schema.json")
 _SEGMENT_RE = re.compile(r"^([A-Za-z][A-Za-z0-9]*)((?:\[\d+\])*)$")

package/runtime/python/okstra_ctl/report_narrative.py

@@ -40,7 +40,10 @@ NARRATIVE_GRAMMAR_INSTRUCTIONS: tuple[str, ...] = (
     "nest a child by indenting two more spaces), `- Item <N>` (one array entry, "
     "numbered 1..N without gaps), and `> value` (one scalar; repeat the line for a "
     "multi-line value; `> _none_` for null, an empty object, or an empty array). "
-    "Blank lines are ignored.",
+    "A `> value` line is indented exactly two spaces deeper than the `- **Label**` "
+    "or `- Item N` line it belongs to — a label at column 0 takes its value at "
+    "column 2, a label at column 2 takes it at column 4; a value at column 0 is "
+    "outside every field and the file is refused. Blank lines are ignored.",
     "Every other line is rejected — YAML frontmatter (`---` blocks), Markdown "
     "headings (`#`, `##`, `###`), pipe tables at column 0, code fences, bare "
     "paragraphs, JSON. Put such text inside a `> ` value instead. Report assembly "

package/runtime/python/okstra_ctl/report_synthesis_packet.py

@@ -26,7 +26,7 @@ from .report_narrative import writer_owned_data
 from .scope_provenance import brief_end_state_id_sequence
 
 from .exact_coverage import COVERAGE_VERDICT_PRECEDENCE
-from .final_report_schema import task_block_rules, verdict_token_rule
+from .final_report_schema import follow_up_task_rules, task_block_rules, verdict_token_rule
 from .report_contract import TASK_TYPE_DATA_PROPERTY
 from .report_markdown import humanise
 from .report_narrative import NarrativeContractError, allowed_top_level_fields
@@ -87,6 +87,10 @@ class ReportSynthesisPacket:
     # (2026-09-03 실측: implementation-option-selection 네 회차).
     block_key: str = ""
     block_rules: tuple[str, ...] = ()
+    # 비종결 task type 의 `followUpTasks` 행 규칙(최소 행 수, phase-continuation
+    # 행, 그 행의 autoSpawn). 스키마의 if/then 가지라 작성자에게 도달하지 않았고
+    # 빈 배열이 조립에서야 거절됐다(2026-09-09 실측, dev-10642).
+    follow_up_rules: tuple[str, ...] = ()
     # 작성자가 최상위에 쓸 수 있는 필드 전체(서사 스키마의 properties). 필수만
     # 적던 동안 리드가 어느 task type 에도 없는 절을 지시했고, 작성자는 조립이
     # 거절할 때까지 그 지시를 거를 근거가 없었다(2026-09-03 실측).
@@ -142,6 +146,7 @@ class ReportSynthesisPacket:
                 f"contain: {labels}. Report assembly refuses any other top-level "
                 "field, whichever instruction asked for it."
             )
+        lines.extend(self.follow_up_rules)
         if self.block_rules:
             lines.append(
                 f"Shape of the `{self.block_key}` block, one line per object, from "
@@ -736,8 +741,8 @@ def build_report_synthesis_packet(
                 for worker in roster
                 if _string(worker) and _string(worker) != "report-writer"
             )
-    required_top_level, verdict_tokens, block_rules = _schema_authoring_rules(
-        sources, task_type
+    required_top_level, verdict_tokens, block_rules, follow_up_rules = (
+        _schema_authoring_rules(sources, task_type)
     )
     return ReportSynthesisPacket(
         task_key=_string(manifest.get("taskKey")),
@@ -745,6 +750,7 @@ def build_report_synthesis_packet(
         result_path=_relative(project_root, narrative_path),
         required_top_level=required_top_level,
         verdict_tokens=verdict_tokens,
+        follow_up_rules=follow_up_rules,
         block_key=TASK_TYPE_DATA_PROPERTY.get(task_type, "") if block_rules else "",
         block_rules=block_rules,
         allowed_top_level=_allowed_top_level_labels(),
@@ -758,12 +764,13 @@ def build_report_synthesis_packet(
 
 def _schema_authoring_rules(
     sources: tuple[ReportSynthesisSource, ...], task_type: str,
-) -> tuple[tuple[str, ...], tuple[str, ...], tuple[str, ...]]:
-    """넘겨받은(동결된) 완성 리포트 스키마에서 작성자 몫의 규칙 세 가지를 뽑는다.
+) -> tuple[tuple[str, ...], tuple[str, ...], tuple[str, ...], tuple[str, ...]]:
+    """넘겨받은(동결된) 완성 리포트 스키마에서 작성자 몫의 규칙 네 가지를 뽑는다.
 
     최상위 `required` 가운데 작성자 소유 이름(서사 스키마의 properties)만
-    사람이 읽는 라벨로, 이 task type 의 `Verdict Token` 허용값, 그리고 이 task
-    type 의 데이터 블록 안쪽 모양(`task_block_rules`). 스키마 소스가 없거나
+    사람이 읽는 라벨로, 이 task type 의 `Verdict Token` 허용값, 이 task type 의
+    데이터 블록 안쪽 모양(`task_block_rules`), 그리고 `followUpTasks` 행 규칙
+    (`follow_up_task_rules`). 스키마 소스가 없거나
     JSON 이 아니면 빈 값이다 — 이 함수는 조립 검증을 대신하지 않고 도달하지
     못하던 규칙을 저작 계약에 옮길 뿐이다.
     """
@@ -789,7 +796,12 @@ def _schema_authoring_rules(
     )
     block_key = TASK_TYPE_DATA_PROPERTY.get(task_type, "")
     block_rules = task_block_rules(schema, block_key) if block_key else ()
-    return required_top_level, verdict_token_rule(schema, task_type), block_rules
+    return (
+        required_top_level,
+        verdict_token_rule(schema, task_type),
+        block_rules,
+        follow_up_task_rules(schema, task_type),
+    )
 
 
 def _allowed_top_level_labels() -> tuple[str, ...]:

package/runtime/python/okstra_ctl/wizard/engine.py

@@ -33,7 +33,13 @@ from .ids import (
 )
 from .state import Prompt, WizardError, WizardState, _is_role_selection_step
 from .prompts import _domain_prompt
-from .picker_navigation import present_picker, accept_picker_answer
+from .picker_navigation import (
+    accept_picker_answer,
+    is_split_checkbox,
+    merge_split_checkbox_answer,
+    present_picker,
+    split_checkbox,
+)
 from .roles import _submit_role_prompt, next_role_prompt
 from .steps_identity import _submit_task_pick
 from .steps_analysis import _advance_design_prep_item
@@ -135,12 +141,14 @@ def _native_picker_screen(state: WizardState, prompt: Prompt) -> Prompt:
     """호스트 네이티브 선택기 한도에 맞춘 화면.
 
     단일 선택이 한도를 넘으면 쪽으로 나눈다(`present_picker`). 체크박스(`multi`)는
-    나누지 않는다 — 네이티브 체크박스에 못 실으면 `CapabilityInteractionPort.plan`
-    이 `numbered-multi` 로 내려 전체 목록을 한 번에 보인다. 종전엔 체크박스도
-    한 줄씩 토글하는 쪽으로 내렸는데, claude-code 한도 4 에서 후보 12개는 쪽당
-    2개가 됐고, 쪽 사본이 추천 표시를 단 채 단일 선택이 돼 `Prompt` 의 추천
-    불변식(단일 선택은 추천 정확히 하나)에 걸려 화면이 열리지 않았다(실측
-    2026-09-09, verifier 전체 후보 화면).
+    쪽으로 나누지 않는다 — 종전엔 한 줄씩 토글하는 쪽으로 내렸는데, claude-code
+    한도 4 에서 후보 12개는 쪽당 2개가 됐고, 쪽 사본이 추천 표시를 단 채 단일
+    선택이 돼 `Prompt` 의 추천 불변식(단일 선택은 추천 정확히 하나)에 걸려
+    화면이 열리지 않았다(실측 2026-09-09, verifier 전체 후보 화면). 대신
+    네이티브 질문 묶음에 실리는 크기(claude-code 4×4=16)면 같은 화면의 체크박스
+    질문 여러 개로 자른다(`split_checkbox`) — 묶음이 네이티브에 실릴 때만이고,
+    아니면 `CapabilityInteractionPort.plan` 이 `numbered-multi` 로 내려 전체
+    목록을 한 번에 보인다.
     """
     if "native_single_select" not in state.available_functions:
         return prompt
@@ -148,10 +156,17 @@ def _native_picker_screen(state: WizardState, prompt: Prompt) -> Prompt:
         if _interaction_plan(state, prompt).kind == "native-group":
             return prompt
         prompt = prompt.questions[0]
+    port = default_host_registry().resolve(state.host_runtime).interaction()
     if prompt.multi:
+        split = split_checkbox(
+            prompt,
+            max_options=port.native_option_limit,
+            max_questions=port.native_question_limit,
+        )
+        if split is not prompt and _interaction_plan(state, split).kind == "native-group":
+            return split
         return prompt
-    limit = default_host_registry().resolve(state.host_runtime).interaction().native_option_limit
-    return present_picker(state, prompt, limit=limit)
+    return present_picker(state, prompt, limit=port.native_option_limit)
 
 
 def _next_prompt_screen(state: WizardState) -> Prompt:
@@ -204,6 +219,9 @@ def _sim_answer(prompt: Prompt) -> str:
 def _sim_advance(state: WizardState, prompt: Prompt) -> None:
     """기본답으로 한 화면 전진한다. progress 를 재계산하는 submit()/
     _submit_group() 은 호출하지 않고 step.submit 만 직접 호출해 재귀를 막는다."""
+    if is_split_checkbox(prompt):
+        # 조각 질문의 step 은 등록된 step 이 아니다 — 잘리지 않은 원본으로 낸다.
+        prompt = _next_prompt_screen(state)
     try:
         if _is_role_selection_step(prompt.step):
             # 화면은 호스트 한도에 맞춰 쪽으로 잘린 사본일 수 있다 — 기본답은
@@ -384,7 +402,12 @@ def submit(state: WizardState, value: str) -> dict[str, Any]:
         value = accept_picker_answer(state, original, value)
         if value is None:
             return {"echo": "", "next": prompt_payload(state, next_prompt(state))}
-    if prompt.kind == "pick_group":
+    if is_split_checkbox(prompt):
+        # 질문 묶음으로 잘린 체크박스 — 탭별 CSV 를 한 줄로 합쳐 원본 step 의
+        # 제출 경로로 보낸다. 원본의 선택지로 검증한다.
+        value = merge_split_checkbox_answer(prompt, value)
+        prompt = _next_prompt_screen(state)
+    elif prompt.kind == "pick_group":
         return _submit_group(state, prompt, value)
     if _is_role_selection_step(prompt.step):
         # 고정 단일 역할의 화면은 호스트 한도에 맞춰 쪽으로 잘린 사본일 수

package/runtime/python/okstra_ctl/wizard/picker_navigation.py

@@ -1,16 +1,93 @@
-"""호스트 선택기 한도 안에서 단일 선택의 원래 선택지를 보존하는 쪽 나누기.
+"""호스트 선택기 한도 안에서 원래 선택지를 보존하는 두 가지 강등.
 
-체크박스(`multi`)는 여기 오지 않는다 — 네이티브 체크박스에 못 실으면
-`numbered-multi` 로 전체 목록을 한 번에 보인다(`engine._native_picker_screen`).
-쪽 사본이 추천 표시를 단 채 단일 선택으로 바뀌면 `Prompt` 의 추천 불변식에
-걸리므로, 한 줄씩 토글하던 체크박스 쪽 나누기는 2026-09-09 에 뺐다.
+단일 선택은 쪽으로 나눈다(`present_picker`). 체크박스(`multi`)는 쪽으로 나누지
+않는다 — 쪽 사본이 추천 표시를 단 채 단일 선택으로 바뀌면 `Prompt` 의 추천
+불변식에 걸리므로, 한 줄씩 토글하던 체크박스 쪽 나누기는 2026-09-09 에 뺐다.
+대신 네이티브 질문 묶음(claude-code `AskUserQuestion` 의 질문 4개 × 옵션 4개)에
+실리는 크기면 같은 화면 안의 체크박스 질문 여러 개로 자른다(`split_checkbox`):
+사용자는 탭마다 체크하고, 답은 하나의 CSV 로 합쳐져(`merge_split_checkbox_answer`)
+원래 step 의 제출 경로로 간다. 그 크기도 넘으면 `numbered-multi` 로 전체 목록을
+한 번에 보인다(`engine._native_picker_screen`).
 """
+import json
+import math
 from dataclasses import replace
 
 from .ids import PICK_TYPE_CUSTOM
 from .state import Option, Prompt, WizardError, WizardState
 
 _PAGE_PREFIX = "__okstra_picker_page__:"
+_SPLIT_SEPARATOR = "#"
+
+
+def split_checkbox(
+    prompt: Prompt, *, max_options: int, max_questions: int,
+) -> Prompt:
+    """옵션이 `max_options` 를 넘는 체크박스를 같은 화면의 질문 묶음으로 자른다.
+
+    질문 수는 옵션이 들어가는 최소 개수이고 옵션은 질문에 고르게 나눈다 —
+    마지막 질문이 한 줄짜리가 되면 호스트 최소 옵션 수(2)에 걸려 묶음 전체가
+    네이티브에 못 실린다. 추천은 원래 목록의 앞머리 run 이라 어느 조각에서도
+    앞머리 run 이 된다(`Prompt._check_recommendations`). `max_questions` 도
+    넘으면 자르지 않고 그대로 돌려준다.
+    """
+    if prompt.kind != "pick" or not prompt.multi or len(prompt.options) <= max_options:
+        return prompt
+    count = len(prompt.options)
+    questions = math.ceil(count / max_options)
+    if questions > max_questions:
+        return prompt
+    base, extra = divmod(count, questions)
+    chunks: list[Prompt] = []
+    offset = 0
+    for index in range(questions):
+        size = base + (1 if index < extra else 0)
+        shown = prompt.options[offset:offset + size]
+        chunks.append(replace(
+            prompt,
+            step=f"{prompt.step}{_SPLIT_SEPARATOR}{index + 1}",
+            label=f"{prompt.label} ({offset + 1}–{offset + size}/{count})",
+            options=shown,
+        ))
+        offset += size
+    return Prompt(
+        step=prompt.step,
+        kind="pick_group",
+        label=prompt.label,
+        help=prompt.help,
+        echo_template=prompt.echo_template,
+        questions=chunks,
+    )
+
+
+def is_split_checkbox(prompt: Prompt) -> bool:
+    return prompt.kind == "pick_group" and bool(prompt.questions) and all(
+        question.multi
+        and question.step.startswith(f"{prompt.step}{_SPLIT_SEPARATOR}")
+        for question in prompt.questions
+    )
+
+
+def merge_split_checkbox_answer(prompt: Prompt, value: str) -> str:
+    """질문 묶음 답(JSON, 조각 step → CSV)을 원래 체크박스의 CSV 한 줄로 합친다."""
+    try:
+        answers = json.loads(value or "{}")
+    except json.JSONDecodeError as exc:
+        raise WizardError(f"pick_group answer must be a JSON object: {exc}") from exc
+    if not isinstance(answers, dict):
+        raise WizardError("pick_group answer must be a JSON object")
+    known = {question.step for question in prompt.questions}
+    unknown = sorted(set(answers) - known)
+    if unknown:
+        raise WizardError(
+            f"wizard step {prompt.step!r}: answer names unknown questions {unknown}; "
+            f"expected {sorted(known)}"
+        )
+    chosen: list[str] = []
+    for question in prompt.questions:
+        raw = str(answers.get(question.step, "") or "")
+        chosen.extend(item.strip() for item in raw.split(",") if item.strip())
+    return ",".join(chosen)
 
 
 def present_picker(state: WizardState, prompt: Prompt, *, limit: int) -> Prompt:

package/runtime/python/okstra_ctl/wizard/roles.py

@@ -10,10 +10,12 @@ verifier: `max > 1`)은 체크박스 한 장이고, 고른 모델 수가 곧 인
 체크박스 화면(`role-models:<role>`)은 실행 가능한 전체 후보를 한 번에 싣는다.
 기본 후보(프로젝트 `modelDefaults`, 없으면 카탈로그 기본값)가 앞이고 권장
 수만큼의 앞줄이 추천이다. 호스트 네이티브 선택기의 옵션 한도(claude-code 4,
-codex 3, grok 15)를 넘으면 `CapabilityInteractionPort.plan` 이 `numbered-multi`
-로 내려 번호 목록이 된다 — 기본 후보만 실은 짧은 화면과 "직접 선택" 이 여는
-두 번째 화면으로 나누던 설계는 2026-09-09 사용자 요청으로 뺐다(후보 12개 중
-3개만 보이고, 두 번째 화면은 쪽 나누기가 추천 불변식을 깨 열리지도 않았다).
+codex 3, grok 15)를 넘으면 네이티브 질문 묶음에 실리는 크기(claude-code 4×4)
+까지는 같은 화면의 체크박스 질문 여러 개로 자르고(`picker_navigation.split_checkbox`),
+그것도 넘으면 `CapabilityInteractionPort.plan` 이 `numbered-multi` 로 내려 번호
+목록이 된다 — 기본 후보만 실은 짧은 화면과 "직접 선택" 이 여는 두 번째 화면으로
+나누던 설계는 2026-09-09 사용자 요청으로 뺐다(후보 12개 중 3개만 보이고, 두
+번째 화면은 쪽 나누기가 추천 불변식을 깨 열리지도 않았다).
 """
 from __future__ import annotations
 

package/runtime/python/okstra_ctl/worker_prompt_contract.py

@@ -10,11 +10,15 @@ from pathlib import Path
 from typing import Any, Iterable, Mapping, Sequence
 
 from .convergence_reverify_prompt import RENDERED_BY_LINE
+from .convergence_critic_verify_prompt import (
+    RENDERED_BY_LINE as CRITIC_VERIFY_RENDERED_BY_LINE,
+)
 from .worker_prompt_body import analysis_worker_label
 from .json_boundary import load_owned_object
 from .worker_prompt_policy import (
     ERRORS_PATH_HEADERS,
     IMPLEMENTATION_HEADERS,
+    CRITIC_VERIFY_DISPATCH_KIND,
     PromptPlan,
     resolve_prompt_plan_for_manifest,
 )
@@ -273,6 +277,7 @@ def validate_reverify_prompt(
     task_type: str,
     forbidden_actions: str,
     expected_model: str | None = None,
+    dispatch_kind: str = "reverify-r1",
 ) -> list[str]:
     """Require the active phase boundary in a lightweight reverify prompt.
 
@@ -281,6 +286,11 @@ def validate_reverify_prompt(
     a model the runtime does not serve does not fail here — it fails as a
     provider 400 once the worker launches, where it reads as a worker fault.
     Pass the dispatch's model so the mismatch is caught before launch.
+
+    ``dispatch_kind`` selects the renderer whose signature the instruction must
+    carry: a numbered round is rendered by `okstra convergence reverify-prompt`,
+    the critic gap round (`critic-verify`) by `okstra convergence
+    critic-verify-prompt`. Either way a hand-written instruction is refused.
     """
     normalized = text.replace("\r\n", "\n").replace("\r", "\n")
     errors: list[str] = _validate_model_header(normalized, expected_model)
@@ -314,7 +324,18 @@ def validate_reverify_prompt(
         and boundary_position > first_heading.start()
     ):
         errors.append("phase boundary block must precede reverify instructions")
-    if RENDERED_BY_LINE not in normalized[_task_instructions_offset(normalized):]:
+    instructions = normalized[_task_instructions_offset(normalized):]
+    if dispatch_kind == CRITIC_VERIFY_DISPATCH_KIND:
+        if CRITIC_VERIFY_RENDERED_BY_LINE not in instructions:
+            errors.append(
+                "critic-verify instruction is not the output of `okstra convergence "
+                "critic-verify-prompt` (missing the `**Rendered by:**` line) — render "
+                "it with `okstra convergence critic-verify-prompt --run-manifest "
+                "<run-manifest> --gaps <coverage-batch.json> --worker <worker-id>` and "
+                "pass that output verbatim as --instruction; hand-written gap "
+                "verification instructions are refused"
+            )
+    elif RENDERED_BY_LINE not in instructions:
         # 손으로 쓴 지시문이 한 라운드를 버렸다(2026-09-09: `- Verdict:` 형식과 축약된
         # 근거). 렌더러의 서명 줄이 없으면 그 지시문은 렌더러 출력이 아니다.
         errors.append(

package/runtime/python/okstra_ctl/worker_prompt_policy.py

@@ -78,6 +78,19 @@ WORKER_PREAMBLE_FILENAME_BY_AUDIENCE = {
     "report-writer": "report-writer-prompt-preamble.md",
 }
 WORKER_ERROR_CONTRACT_FILENAME = "worker-error-contract.md"
+# coverage-critic gap 검증 라운드의 dispatch kind. 번호 라운드(`reverify-r<N>`)와
+# 같은 검증 계약(audience `reverification-worker`, 렌더러 서명, 출력 계약)을
+# 따르되 라운드 원장 밖이라 번호가 없다. 실측(2026-09-09 dev-10642): 이 kind 가
+# 없어 gap 검증 프롬프트를 만들 수 없었고 gap 3건 전부 `gapsUnverified` 로 남았다.
+CRITIC_VERIFY_DISPATCH_KIND = "critic-verify"
+
+
+def is_verification_dispatch_kind(dispatch_kind: str) -> bool:
+    """번호 reverify 라운드와 critic gap 검증 — 검증 프롬프트 계약을 받는 kind."""
+    return (
+        dispatch_kind.startswith("reverify-r")
+        or dispatch_kind == CRITIC_VERIFY_DISPATCH_KIND
+    )
 
 
 @dataclass(frozen=True)
@@ -114,7 +127,7 @@ def resolve_prompt_plan(
         if worker_id != "translator" or dispatch_kind != "translator":
             raise ValueError("translator worker and dispatch kind must match")
         return _plan("translator", duty_audience="translator")
-    if dispatch_kind.startswith("reverify-r"):
+    if is_verification_dispatch_kind(dispatch_kind):
         return _plan("reverify")
     # A critic pass keeps the full analysis contract — worker anchor headers, the
     # audit sidecar, the packet boundary — but is exempt from the equality group.

package/runtime/skills/okstra-run/SKILL.md

@@ -198,7 +198,7 @@ That is the entire interactive flow. The wizard handles:
 - base-ref pick + git rev-parse validation (skipped when reusing an active worktree),
 - `implementation`-only sub-flow: approved-plan path (frontmatter `approved: true` check) + stage pick (`auto` = the earliest incomplete stage whose dependencies are satisfied, or a specific stage number). Implementer slots use role-count / role-model like every other role (`executor` is only a compatibility alias for `implementer`). When an approved plan is selected and a `## PLAN DECISION` sidecar carrying `Status: approved`, exported from the report — matching the plan on source-report·seq — is detected in that run's sibling `user-responses/`, the approve-confirm step expands to 3 options (`yes_apply` recommended: approve + apply the option as exported / `yes` approve only / `no` abort) — `yes_apply` validates the option against the plan's `optionCandidates` before applying it via the existing approval·option path,
 - `release-handoff`-only sub-flow: after the approved plan auto-resolves, a `handoff_stage_pick` multi-select — choose an eligible stage bundle (stage-group) or the whole task (when an accepted whole-task verification report exists); the result goes out as render-args' `stages` key (csv, empty when whole-task),
-- launch selection after identity/worktree steps: one screen per static role, in profile order. A role that can run several instances (`max > 1`) is a checkbox step `role-models:<role>` (`multi: true`) — the number of models checked is the number of instances, there is no separate count question; the label states the profile range and recommended count, every executable candidate is listed on that one screen (defaults first, the recommended set flagged), and when the list exceeds the host's native checkbox limit the interaction plan is `numbered-multi` — render the whole list, never a shortlist or pages. An optional role (`min = 0`, e.g. critic) carries a `추가 안 함` row. A fixed single role (`min = max = 1`, e.g. report-writer) is a single pick `role-model:<role>:1`. current-session lead is this session and is listed on the confirmation summary, not as a wizard step. The wizard does not fork on defaults-vs-customize, does not show a provider roster multi-pick, and does not offer a separate implementer-provider pick. Dynamic verifiers are not chosen at launch. `--workers` is compatibility-only, not a launch picker. Repeated `--role-count` / `--role-model` tokens on `renderArgv` are intentional,
+- launch selection after identity/worktree steps: one screen per static role, in profile order. A role that can run several instances (`max > 1`) is a checkbox step `role-models:<role>` (`multi: true`) — the number of models checked is the number of instances, there is no separate count question; the label states the profile range and recommended count, every executable candidate is listed on that one screen (defaults first, the recommended set flagged), and when the list exceeds the host's native checkbox limit the runtime either splits it into several checkbox questions on one `pick_group` screen (interaction plan `native-group`; the question steps are `role-models:<role>#1`, `#2`, … and the answer is one JSON object keyed by them, each value a CSV) when the host's native question group holds every option, or returns the interaction plan `numbered-multi` — render the whole list, never a shortlist or pages. An optional role (`min = 0`, e.g. critic) carries a `추가 안 함` row. A fixed single role (`min = max = 1`, e.g. report-writer) is a single pick `role-model:<role>:1`. current-session lead is this session and is listed on the confirmation summary, not as a wizard step. The wizard does not fork on defaults-vs-customize, does not show a provider roster multi-pick, and does not offer a separate implementer-provider pick. Dynamic verifiers are not chosen at launch. `--workers` is compatibility-only, not a launch picker. Repeated `--role-count` / `--role-model` tokens on `renderArgv` are intentional,
 - **resume-clarification (in-session equivalent)** — there is no separate mode or flag matching the shell's `okstra.sh --resume-clarification`; two steps of the standard flow carry out its substance. (1) `reuse_previous` (yes/no to reuse the previous run's settings — in `requirements-discovery` / `error-analysis` / `implementation-planning`, only when prior run-inputs exist): YES prefills role-count·role-model·directive·related-tasks at once. (2) `clarification_pick`: if the **task-type's own** previous `final-report` exists it is auto-recommended as the carry-in input (falling back to the newest by mtime across all phases when absent), and the same run's `user-responses/` sidecar (answers the user filled in) is attached alongside. The chosen path is passed to prepare as `--clarification-response` — the user makes the sidecar via the report's `Export user response`, places it in `runs/<task-type>/user-responses/`, and re-runs the same phase,
 - **re-verification scope (`reverify_scope_pick`, `implementation-planning` clarification re-runs only)** — asked right before `confirm` when the re-run is narrowable **or** an answered `C-NNN` traces to no stage. When every answered id traces to a stage: 3 options — `auto` (recommended — leave it to the lead's `okstra incremental-scope` decision) / `full` (re-verify every stage) / Enter directly (a stage-number CSV, validated against the prior report's Stage Map). When an id is unlinked, `auto` is omitted and the user names stages or picks `full`; that unlinked id does not freeze the run at full. The answer goes out as `--reverify-scope` and reaches the lead prompt as the `REVERIFY_SCOPE_MODE` / `REVERIFY_SCOPE_STAGES` tokens; it shapes that CLI's inputs rather than replacing the decision. The confirmation block's `reverify-scope` line names unlinked ids as needing stage numbers, not as a forced full re-run,
 - `release-handoff` PR template override + persist scope,