okstra 0.206.0 → 0.207.0

package/runtime/python/okstra_ctl/phases/implementation_planning/plan_body.py

@@ -0,0 +1,3295 @@
+"""구현 계획 본문·재검증·승인 근거의 전용 판정."""
+
+from __future__ import annotations
+from okstra_ctl.json_boundary import JsonBoundaryError, load_owned_object
+
+
+import re
+
+
+from pathlib import Path
+
+
+from okstra_ctl.conformance import (  # noqa: E402
+    declared_stage_surface_gaps,
+    exempt_stage_surface_conflicts,
+    parse_conformance_tests as _parse_conformance_tests,
+)
+
+
+from okstra_ctl.build_tools import (  # noqa: E402
+    command_invokes_build_tool,
+    resolve_build_tool_tokens,
+)
+
+
+from okstra_ctl.clarification_items import (  # noqa: E402
+    clarification_disposition,
+    incorporated_clarification_ids,
+    row_blocks_progress,
+)
+
+
+from okstra_ctl.final_report_paths import (  # noqa: E402
+    final_report_data_path as _data_path_for,
+)
+
+
+from okstra_ctl.plan_items import (  # noqa: E402
+    CRITIC_WORKER_ID,
+    advisory_plan_body_gating,
+    requires_plan_repair,
+    analyser_key as _analyser_key,
+    is_critic_worker,
+    lead_decision_basis,
+    self_fix_rounds,
+    stage_scope_bucket as _item_stage_scope_bucket,
+    voting_analyser_keys,
+)
+
+
+from okstra_ctl.incremental_scope import (  # noqa: E402
+    coverage_row_blocked_on,
+    stages_for_clarification,
+)
+
+
+from okstra_ctl.design_prep import (  # noqa: E402
+    DesignPrepError,
+    _planning_seq as _design_prep_planning_seq,
+    _render_request as _render_design_prep_request,
+    _report_language as _design_prep_report_language,
+    _request_identity as _design_prep_request_identity,
+)
+
+
+from okstra_ctl.design_surfaces import DesignSurfaceError  # noqa: E402
+
+
+from okstra_ctl.plan_items import (  # noqa: E402
+    expected_plan_item_ids,
+    extract_plan_items,
+)
+
+
+from okstra_ctl.report_validation_identity import _report_run_seq, _report_task_type
+
+# Plan-body gate outcomes ranked by how favorable each is to approval.
+# A higher rank claims a healthier verification result. The recompute check
+# below fails only when the *declared* gate outranks what the recorded
+# per-worker verdicts support — i.e. the lead claimed a better outcome than
+# the votes justify. A lead writing a conservatively *worse* gate is allowed,
+# so genuine edge cases in this recompute never manufacture false failures.
+_PLAN_GATE_RANK = {
+    "aborted-non-result": 0,
+    "blocked-by-disagreement": 0,
+    "passed-with-dissent": 1,
+    "passed": 2,
+}
+
+
+# Breakage kinds where a single DISAGREE blocks the gate on its own (no majority
+# needed), because the defect is concrete, safety-critical, and adversarially
+# verifiable: `a` = cited path/symbol mismatch. `b`/`c`/`e` still need a
+# majority — `b` in particular is prone to planning-vs-implementation
+# environment false positives.
+_SINGLE_VOTE_BLOCKING_KINDS = {"a"}
+
+
+# Rollback ordering (`d`) is executed by a human, not by okstra's workers or
+# verifiers, so a rollback-ordering dissent is recorded but never gates
+# approval: it is dropped from the blocking-disagree tally entirely, so an item
+# whose only DISAGREEs are advisory-only can never rise above `has-dissent`.
+_ADVISORY_ONLY_KINDS = {"d"}
+
+
+# Stop reasons that justify promoting a still-broken planner-fixable item to the
+# user: the self-fix budget ran out, or a round produced no net resolution so
+# further rounds would repeat themselves.
+#
+# `cause-group-recurrence` is the legacy spelling of that same exhaustion
+# (plan-body-verification.md "Loop termination"). A pre-activity-contract report
+# carrying it is a report whose loop stopped because the cause kept recurring —
+# refusing it here left such a run with no exit at all: the loop may not run
+# again, and the surviving item may not be promoted either.
+_SELF_FIX_EXHAUSTED_REASONS = frozenset(
+    {"max-rounds-reached", "no-progress", "cause-group-recurrence"}
+)
+
+
+def _is_variation_point_item(item: dict) -> bool:
+    """Whether this is a `P-Var-*` variation-point item, which is majority-gated
+    (`prompts/lead/plan-body-verification.md` "`P-Var-<N>` … is majority-gated").
+    Whether a behavior has two implementations, and whether the plan extracted the
+    right interface for it, is a design judgement — it lacks the concrete certainty
+    of kind `a`, where a verifier points at two spelled-out references that
+    contradict each other. So kind `a` carries no extra weight on a P-Var item: it
+    neither single-vote-blocks nor counts as correctness-critical, exactly like the
+    `b` / `c` / `e` kinds the prompt routes P-Var defects to. Only a
+    `majority-disagree` gates it — that part is unchanged.
+    """
+    return str(item.get("id") or "").upper().startswith("P-VAR")
+
+
+def _single_vote_dissents(item: dict, kinds: set[str]) -> list[dict]:
+    """이 항목에서 1표 차단을 주장하는 DISAGREE 행들."""
+    return [
+        row
+        for row in (item.get("verdicts") or [])
+        if isinstance(row, dict)
+        and str(row.get("verdict") or "").strip().upper() == "DISAGREE"
+        and str(row.get("breakageKind") or "").strip().lower() in kinds
+    ]
+
+
+def _single_vote_block_survives(item: dict, kinds: set[str]) -> bool:
+    """1표 차단이 성립하는지.
+
+    1표 차단에는 근거가 있다 — 명시된 두 인용이 서로 모순이라는 것은 한 명이
+    실측으로 확정할 수 있는 사실이고, 사실을 다수결로 기각하면 안 된다. 문제는
+    1표라는 것이 아니라 **1표에 재현 요구가 없었다**는 것이다. "이 경로는 존재하지
+    않는다" 라고 쓰기만 하면 그대로 차단이 됐다.
+
+    이제 주장이 스스로 `fact` 를 선언하고 okstra 가 그것을 재현했을 때만 1표로
+    막는다. 선언했는데 재현되지 않았거나 `judgement` 였다면 정족수로 내려간다.
+
+    아무 행도 `claimKind` 를 선언하지 않았으면 종전대로 막는다. 그 필드를 실을 수
+    없던 시절의 판정을 뒤에서 뒤집지 않기 위해서다 — 도입은 완화 방향으로만
+    작동하고, 선언한 주장만 재현을 요구받는다.
+    """
+    dissents = _single_vote_dissents(item, kinds)
+    declared = [row for row in dissents if row.get("claimKind")]
+    if not declared:
+        return bool(dissents)
+    return any(
+        str(row.get("claimKind") or "") == "fact"
+        and str(row.get("reproductionResult") or "") == "reproduced"
+        for row in declared
+    )
+
+
+def _critic_non_error_verdicts(item: dict) -> list[dict]:
+    """현재 기록된 비판 검토자의 최신 유효 판정."""
+    rows = [row for row in item.get("verdicts", []) if isinstance(row, dict)]
+    critic = [
+        row
+        for row in rows
+        if is_critic_worker(row.get("worker", ""))
+        and str(row.get("verdict", "")).upper() in {"AGREE", "SUPPLEMENT", "DISAGREE"}
+    ]
+    latest = max((row.get("round", 1) for row in critic), default=0)
+    return [row for row in critic if row.get("round", 1) == latest]
+
+
+def _critic_gate_class(item: dict) -> str | None:
+    """비판 검토자의 교정 권한은 분석자의 표수나 동수 여부에 의존하지 않는다."""
+    critic = _critic_non_error_verdicts(item)
+    if not critic:
+        return None
+    critic_dissent = [
+        row for row in critic if str(row.get("verdict", "")).upper() == "DISAGREE"
+    ]
+    if critic_dissent:
+        if str(item.get("id", "")).upper().startswith("P-RB"):
+            return "has-dissent"
+        return (
+            "majority-disagree"
+            if any(
+                str(row.get("breakageKind", "")).lower() not in _ADVISORY_ONLY_KINDS
+                for row in critic_dissent
+            )
+            else "has-dissent"
+        )
+    dissent = any(
+        str(row.get("verdict", "")).upper() == "DISAGREE"
+        for row in item.get("verdicts", [])
+    )
+    return "has-dissent" if dissent else "full-consensus"
+
+
+def _classify_plan_item_gate(item: dict) -> str:
+    """Recompute one plan item's gate class from its per-worker verdicts,
+    per `prompts/lead/plan-body-verification.md` "Round protocol". Returns one of
+    ``majority-disagree`` / ``needs-reverify`` / ``has-dissent`` /
+    ``full-consensus`` / ``all-non-result``. Blocking-kind minority dissent
+    (``dissent-isolated`` / ``partial-consensus`` on ``b``/``c``/``e``) is
+    ``majority-disagree`` so the user gate sees it. ``has-dissent`` remains
+    advisory-only, rollback items, and a single-vote kind that lost its
+    reproduction. An analyser 1-1 is ``needs-reverify`` until ``critic-worker``
+    settles it.
+    """
+    corrected = _critic_gate_class(item)
+    if corrected is not None:
+        return corrected
+    tokens = [
+        (
+            str(v.get("verdict") or "").strip().upper(),
+            str(v.get("breakageKind") or "").strip().lower(),
+        )
+        for v in (item.get("verdicts") or [])
+        if isinstance(v, dict) and not is_critic_worker(str(v.get("worker") or ""))
+    ]
+    non_error = [(vd, bk) for (vd, bk) in tokens if vd and vd != "VERIFICATION-ERROR"]
+    if not non_error:
+        return "all-non-result"
+    disagree = [(vd, bk) for (vd, bk) in non_error if vd == "DISAGREE"]
+    agree = [(vd, bk) for (vd, bk) in non_error if vd in ("AGREE", "SUPPLEMENT")]
+    if not disagree:
+        return "full-consensus"
+    # Rollback is a human-run operation, so rollback dissent never blocks the
+    # gate — closed from two angles so a verifier cannot re-block it by relabelling:
+    #   (1) a whole rollback plan item (`P-Rb-*`) is advisory regardless of
+    #       breakage kind — otherwise a `DISAGREE(b)` "rollback command is
+    #       ambiguous" would sail past the kind-`d` exemption and block;
+    #   (2) a rollback-ordering dissent (`d`) is advisory on ANY item, since a
+    #       rollback-order defect raised against a non-rollback item is still a
+    #       human-run concern.
+    # Both are recorded as dissent and fold into `has-dissent`, never blocking.
+    if str(item.get("id") or "").upper().startswith("P-RB"):
+        return "has-dissent"
+    blocking_disagree = [
+        (vd, bk) for (vd, bk) in disagree if bk not in _ADVISORY_ONLY_KINDS
+    ]
+    if not blocking_disagree:
+        return "has-dissent"
+    blocking_kinds = {bk for (_vd, bk) in blocking_disagree if bk}
+    # Single-vote-blocking kinds: one confirmed DISAGREE on a concrete,
+    # safety-critical, adversarially-verifiable defect is enough to block, even
+    # in a two-worker roster — a lone correct dissent must not be outvoted here.
+    # `a` for any item except `P-Var-*` (majority-gated, see
+    # `_is_variation_point_item`); `f` only for P-Req items (requirement coverage).
+    is_req = str(item.get("id") or "").upper().startswith("P-REQ")
+    single_vote_kinds = set(_SINGLE_VOTE_BLOCKING_KINDS) | ({"f"} if is_req else set())
+    if (
+        not _is_variation_point_item(item)
+        and blocking_kinds & single_vote_kinds
+        and _single_vote_block_survives(item, single_vote_kinds)
+    ):
+        # "One confirmed DISAGREE" presupposes the item was actually
+        # cross-verified. When the peer returned a non-result nothing confirmed
+        # the dissent, so blocking here would reproduce the same
+        # worker-failure-makes-the-gate-stricter paradox the majority branch
+        # below guards against. Route it to a re-verify round instead.
+        if len(non_error) < 2:
+            return "needs-reverify"
+        return "majority-disagree"
+    # Otherwise a genuine majority is required — and a majority needs at least
+    # two participating votes, so a lone surviving DISAGREE (its peer returned a
+    # non-result) does NOT block. That fixes the paradox where a worker failure
+    # made the gate stricter than a healthy roster would.
+    if len(non_error) >= 2 and len(blocking_disagree) > len(agree):
+        return "majority-disagree"
+    if len(blocking_disagree) == len(agree) and len(non_error) >= 2:
+        return "needs-reverify"
+    if (
+        len(non_error) >= 2
+        and blocking_disagree
+        and (not (blocking_kinds & single_vote_kinds) or _is_variation_point_item(item))
+    ):
+        # 판단 종류의 소수 반대는 표로 기각하지 않는다. 양쪽이 표를 냈으면
+        # 사용자가 고른다. 재현에 실패한 1표 종류 `a`/`f` 는 위에서 이미
+        # 근거를 잃었으므로 이 분기에 안 들어온다.
+        return "majority-disagree"
+    return "has-dissent"
+
+
+def _is_even_analyser_split(item: dict) -> bool:
+    tokens = [
+        str(row.get("verdict") or "").strip().upper()
+        for row in (item.get("verdicts") or [])
+        if isinstance(row, dict)
+        and not is_critic_worker(str(row.get("worker") or ""))
+        and str(row.get("verdict") or "").strip().upper()
+        not in ("", "VERIFICATION-ERROR")
+    ]
+    if len(tokens) < 2:
+        return False
+    disagree = sum(1 for token in tokens if token == "DISAGREE")
+    agree = sum(1 for token in tokens if token in {"AGREE", "SUPPLEMENT"})
+    return disagree == agree and disagree > 0
+
+
+def _is_unsettled_tie(item: dict) -> bool:
+    """분석자는 갈렸고 critic 표가 아직 없는 동수 항목."""
+    return _is_even_analyser_split(item) and not _critic_non_error_verdicts(item)
+
+
+def _disagree_breakage_kinds(item: dict) -> set[str]:
+    return {
+        str(v.get("breakageKind") or "").strip().lower()
+        for v in (item.get("verdicts") or [])
+        if isinstance(v, dict)
+        and str(v.get("verdict") or "").strip().upper() == "DISAGREE"
+        and str(v.get("breakageKind") or "").strip()
+    }
+
+
+def _has_planner_fixable_majority(item: dict) -> bool:
+    disagrees = [
+        v
+        for v in (item.get("verdicts") or [])
+        if isinstance(v, dict) and str(v.get("verdict") or "").upper() == "DISAGREE"
+    ]
+    fixable = [v for v in disagrees if v.get("fixability") == "planner-fixable"]
+    return bool(disagrees) and len(fixable) * 2 > len(disagrees)
+
+
+def _is_correctness_critical(item: dict) -> bool:
+    """Whether this item's defect would make `implementation` produce wrong or
+    unsafe code — the single-vote-blocking kind `a` (cited path/symbol mismatch)
+    on any item but `P-Var-*`, or `f` (requirement-coverage mismatch) on a
+    `P-Req-*` item.
+    Kinds `b`/`c`/`e` are plan-prose defects: they degrade the document, not the
+    resulting code. Rollback ordering (`d`) is advisory — a human runs the
+    rollback — so it never counts as correctness-critical. A `P-Var-*` item is
+    majority-gated end to end, so a kind-`a` dissent on one is no more critical
+    than the `b`/`e` its defect should have been raised under; otherwise the same
+    mis-tag that no longer single-vote-blocks would still veto the downgrade.
+    """
+    if _is_variation_point_item(item):
+        return False
+    kinds = _disagree_breakage_kinds(item)
+    is_req = str(item.get("id") or "").upper().startswith("P-REQ")
+    return bool(kinds & _SINGLE_VOTE_BLOCKING_KINDS) or (is_req and "f" in kinds)
+
+
+def _self_fix_budget_exhausted(pbv: dict) -> bool:
+    rounds_applied = pbv.get("selfFixRoundsApplied")
+    return (
+        isinstance(rounds_applied, int)
+        and rounds_applied >= 1
+        and pbv.get("selfFixStopReason") in _SELF_FIX_EXHAUSTED_REASONS
+    )
+
+
+def _state_classification(item: dict, gate_class: str) -> str:
+    """This item's `planItems[].rounds[].classification` for the state file.
+
+    Blocking-kind `dissent-isolated` / `partial-consensus` is already
+    `majority-disagree` at the gate. `has-dissent` that remains is advisory
+    or a single-vote kind that lost reproduction; the state file then splits
+    that remainder into `dissent-isolated` vs `partial-consensus`.
+
+    *gate_class* is passed in rather than recomputed so that the caller's
+    effective classification — which may have been downgraded by
+    `_is_dissent_downgraded` — is the one this translates.
+
+    `contested` never appears: it is only meaningful at `maxRounds > 1`, and at
+    the default `maxRounds=1` the round protocol folds any otherwise-unresolved
+    item into `partial-consensus`.
+    """
+    if gate_class == "all-non-result":
+        # No non-error vote at all is the `needs-reverify` shape taken to its
+        # limit — "fewer than 2 participating votes" covers zero.
+        return "needs-reverify"
+    if gate_class != "has-dissent":
+        return gate_class
+    dissenting = sum(
+        1
+        for vote in (item.get("verdicts") or [])
+        if isinstance(vote, dict)
+        and str(vote.get("verdict") or "").strip().upper() == "DISAGREE"
+    )
+    return "dissent-isolated" if dissenting == 1 else "partial-consensus"
+
+
+def _clarification_ids_on_activity(activity: dict) -> set[str]:
+    refs: set[str] = set()
+    for key in ("clarificationRefs", "evidenceRefs"):
+        for value in activity.get(key) or []:
+            if isinstance(value, str) and _APPROVAL_CLARIFICATION_ID_RE.fullmatch(
+                value
+            ):
+                refs.add(value)
+    return refs
+
+
+def _plan_item_ids_for_clarification(
+    row: dict,
+    context: dict,
+    data: dict,
+) -> list[str]:
+    """이 C 행이 가리키는 계획 항목.
+
+    계약 3.0 `approvalContext` 는 `planItemIds` 를 갖지 않는다. 활동
+    `evidenceRefs` / `clarificationRefs` 와 `planItems[].clarificationRefs` 가
+    역추적이다. 이 C 만 인용한 활동을 묶음 활동보다 앞세운다.
+    """
+    linked = [
+        item_id
+        for item_id in (context.get("planItemIds") or [])
+        if isinstance(item_id, str) and item_id
+    ]
+    if linked:
+        return linked
+    row_id = str(row.get("id") or "")
+    if not row_id:
+        return []
+    singleton: list[str] = []
+    bulk: list[str] = []
+    for activity in data.get("agentActivity") or []:
+        if not isinstance(activity, dict):
+            continue
+        refs = _clarification_ids_on_activity(activity)
+        if row_id not in refs:
+            continue
+        ids = [
+            item_id
+            for item_id in (activity.get("planItemIds") or [])
+            if isinstance(item_id, str) and item_id
+        ]
+        if refs == {row_id}:
+            singleton.extend(ids)
+        else:
+            bulk.extend(ids)
+    if singleton or bulk:
+        return singleton or bulk
+    items = (
+        (data.get("implementationPlanning") or {}).get("planBodyVerification") or {}
+    ).get("planItems") or []
+    return [
+        str(item.get("id") or "")
+        for item in items
+        if isinstance(item, dict)
+        and row_id
+        in {
+            ref for ref in (item.get("clarificationRefs") or []) if isinstance(ref, str)
+        }
+        and item.get("id")
+    ]
+
+
+def _user_accepted_plan_item_ids(data: dict) -> set[str]:
+    """사용자가 진행 처분을 고른 승인 행이 가리키는 계획 항목.
+
+    DISAGREE 표는 그대로 남는다. 게이트만 `has-dissent` 로 내린다.
+    """
+    accepted: set[str] = set()
+    for row in data.get("clarificationItems") or []:
+        if not isinstance(row, dict) or row.get("blocks") != "approval":
+            continue
+        if row_blocks_progress(
+            str(row.get("status") or ""), clarification_disposition(row)
+        ):
+            continue
+        context = row.get("approvalContext")
+        if not isinstance(context, dict):
+            context = {}
+        accepted.update(_plan_item_ids_for_clarification(row, context, data))
+    return accepted
+
+
+def _resolved_noncritical_dissent_ids(data: dict) -> set[str]:
+    """호환 별칭. 새 코드는 `_user_accepted_plan_item_ids` 를 쓴다."""
+    return _user_accepted_plan_item_ids(data)
+
+
+def _plan_item_decision_authority(item: dict, pbv: dict) -> str | None:
+    """자동 수정 이후의 설계 판단만 리드가 결정하며 사실·사용자 권한은 남긴다."""
+    classification = _classify_plan_item_gate(item)
+    votes = [row for row in item.get("verdicts", []) if isinstance(row, dict)]
+    non_result = any(
+        row.get("verdict") not in {"AGREE", "SUPPLEMENT", "DISAGREE"} for row in votes
+    )
+    if (
+        classification not in {"majority-disagree", "needs-reverify", "all-non-result"}
+        and not non_result
+    ):
+        return None
+    if _stage_scope_bucket(item, pbv) != "in-scope" or item.get("block") == "record":
+        return None
+    disagrees = [row for row in votes if row.get("verdict") == "DISAGREE"]
+    verified = item.get("contentHash")
+    if (
+        not self_fix_rounds(pbv)
+        or pbv.get("gating") is False
+        or not verified
+        or item.get("verifiedContentHash") != verified
+        or _is_correctness_critical(item)
+        or not disagrees
+        or len(voting_analyser_keys([item])) < 2
+        or non_result
+        or any(
+            row.get("claimKind") not in {None, "judgement"}
+            or row.get("fixability") != "planner-fixable"
+            or row.get("breakageKind") not in {"b", "c", "e"}
+            for row in disagrees
+        )
+    ):
+        return "user"
+    return "lead"
+
+
+def _lead_decision_applies(item: dict, pbv: dict) -> bool:
+    decision = item.get("leadDecision")
+    return (
+        isinstance(decision, dict)
+        and bool(str(decision.get("decision") or "").strip())
+        and decision.get("basisHash") == lead_decision_basis(item)
+        and _plan_item_decision_authority(item, pbv) == "lead"
+    )
+
+
+def _is_dissent_downgraded(
+    item: dict,
+    pbv: dict,
+    accepted_item_ids: set[str],
+) -> bool:
+    """유효한 리드 결정 또는 사용자 진행 처분은 반대 표를 보존하며 차단을 해소한다."""
+    return _lead_decision_applies(item, pbv) or (
+        _classify_plan_item_gate(item) == "majority-disagree"
+        and str(item.get("id") or "") in accepted_item_ids
+    )
+
+
+def _stage_scope_bucket(item: dict, pbv: dict) -> str:
+    """Whether this item has standing to block the stage about to start.
+
+    The plan covers every stage; implementation runs one at a time. Judging all
+    of them at once means a defect in a stage nobody has reached, or in one
+    already frozen, stops the next stage from starting — and a frozen stage's
+    item cannot be fixed at all, because the Stage Ledger forbids editing its
+    commands. Measured on one run, 9 of 13 blockers were that shape, 6 of them
+    frozen.
+
+    Returns `in-scope` (may block), `observed` (only frozen stages), or
+    `deferred` (only stages not yet startable). Anything unresolvable is
+    `in-scope`: an absent ledger is no basis to narrow. Plan-wide items
+    (`P-Opt-*`, `P-Var-*`, `P-Dep-*`, `P-Dir-1`) with no `stageScope` stay
+    in-scope. An unscoped `P-Val-*` / `P-Req-*` / `P-Rb-*` stays in-scope only
+    until a stage is `done`; after that it is `deferred` so a re-plan does not
+    re-score the whole checklist.
+
+    디스패치 큐와 같은 함수를 쓴다. 검증기가 다른 통을 내면 워커가 안 본
+    항목이 승인을 막거나, 본 항목이 게이트에서 빠진다.
+    """
+    ledger = pbv.get("stageLedger")
+    return _item_stage_scope_bucket(
+        item,
+        ledger if isinstance(ledger, dict) else None,
+    )
+
+
+def _set_aside_reason(item: dict, pbv: dict, accepted_item_ids: set[str]) -> str | None:
+    """Why this item stopped blocking, or ``None`` if it never did.
+
+    A gate that passes while defects were set aside has to say which ones and on
+    what grounds. Without that the two halves of the acceptance condition — the
+    next stage can start, and the known risks are written down — collapse into
+    the first, and a defect deferred for a good reason is indistinguishable in
+    the record from one nobody found.
+    """
+    raw = (
+        "has-dissent"
+        if _is_dissent_downgraded(item, pbv, accepted_item_ids)
+        else _classify_plan_item_gate(item)
+    )
+    if raw != "majority-disagree":
+        return None
+    bucket = _stage_scope_bucket(item, pbv)
+    if bucket != "in-scope":
+        return bucket
+    return "record" if str(item.get("block") or "") == "record" else None
+
+
+def _set_aside_register(pbv: dict, accepted_item_ids: set[str]) -> list[dict]:
+    """Every set-aside item, in id order, as the gate records them."""
+    register = [
+        {"id": str(item.get("id") or ""), "reason": reason}
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+        for reason in [_set_aside_reason(item, pbv, accepted_item_ids)]
+        if reason is not None
+    ]
+    return sorted(register, key=lambda row: row["id"])
+
+
+def _plan_item_gate_class(
+    item: dict,
+    pbv: dict,
+    accepted_item_ids: set[str],
+) -> str:
+    """The gate class for one item, after stage scope is applied.
+
+    An out-of-scope blocker is not dropped — it lands on `has-dissent`, so the
+    gate still reads `passed-with-dissent` rather than `passed` and the record
+    says something is outstanding. Silently scoring it `passed` would hide the
+    defect instead of deferring it.
+    """
+    classification = (
+        "has-dissent"
+        if _is_dissent_downgraded(item, pbv, accepted_item_ids)
+        else _classify_plan_item_gate(item)
+    )
+    if classification != "majority-disagree":
+        return classification
+    if _stage_scope_bucket(item, pbv) != "in-scope":
+        return "has-dissent"
+    if str(item.get("block") or "") == "record":
+        # 자기 기록의 부정확은 기록되고 다음 run 의 입력이 되지, 구현 착수를 막지
+        # 않는다. 요구사항이 실제로 안 만들어지는 경우는 이 경로가 아니라
+        # `_independent_coverage_blockers` 의 `coverage-gap` 이 계속 막는다.
+        return "has-dissent"
+    return classification
+
+
+def _recompute_plan_body_gate(
+    pbv: dict,
+    accepted_item_ids: set[str] | None = None,
+) -> str | None:
+    """Recompute the whole §5.5.9 gate value from ``planItems[].verdicts``.
+    Returns a value in ``PLAN_VERIFY_GATE_VALUES`` or ``None`` when there are
+    no plan items to judge (disabled / empty round)."""
+    accepted = accepted_item_ids or set()
+    classes = [
+        _plan_item_gate_class(it, pbv, accepted)
+        for it in (pbv.get("planItems") or [])
+        if isinstance(it, dict)
+        and (_stage_scope_bucket(it, pbv) == "in-scope" or it.get("verdicts"))
+    ]
+    if not classes:
+        return None
+    if all(c == "all-non-result" for c in classes):
+        return "aborted-non-result"
+    if pbv.get("gating") is False and not requires_plan_repair(pbv):
+        if any(
+            c
+            in ("majority-disagree", "has-dissent", "needs-reverify", "all-non-result")
+            for c in classes
+        ):
+            return "passed-with-dissent"
+        return "passed"
+    if any(c == "majority-disagree" for c in classes):
+        return "blocked-by-disagreement"
+    if any(c in ("has-dissent", "needs-reverify", "all-non-result") for c in classes):
+        # `all-non-result` belongs here for the same reason `needs-reverify`
+        # does — it IS that shape with zero participating votes instead of one
+        # (`_state_classification` maps it there, and the contract's step 5
+        # lists `needs-reverify` under `passed-with-dissent`). Left out, an
+        # item no verifier could judge scored `passed`: the all-error case
+        # already reads `needs-reverify` in the state file while the gate it
+        # feeds says every item reached consensus.
+        return "passed-with-dissent"
+    return "passed"
+
+
+def _validate_plan_body_gate_recompute(
+    data: dict,
+    failures: list[str],
+    accepted_item_ids: set[str] | None = None,
+) -> None:
+    """H1 — the declared `Gate result` must not claim a healthier outcome than
+    the recorded per-worker verdicts support. Closes the forgery hole where a
+    lead writes `gateResult: passed` while workers actually voted DISAGREE:
+    the verdicts live in `planItems[].verdicts`, so the gate is recomputable
+    and no longer depends on the lead's honesty alone.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    declared = str(pbv.get("gateResult") or "").strip().lower()
+    accepted = (
+        _resolved_noncritical_dissent_ids(data)
+        if accepted_item_ids is None
+        else accepted_item_ids
+    )
+    recomputed = _recompute_plan_body_gate(pbv, accepted)
+    if recomputed is None or declared not in _PLAN_GATE_RANK:
+        return
+    if _PLAN_GATE_RANK[declared] > _PLAN_GATE_RANK[recomputed]:
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            f"`gateResult` is `{declared}` but the recorded planItems[].verdicts "
+            f"only support `{recomputed}` (a majority DISAGREE, a DISAGREE(f) on "
+            "a P-Req item, or all-non-result dispatches were recorded). The gate "
+            "value must honestly aggregate the worker votes — do not upgrade it "
+            "to unblock the run (plan-body-verification.md Round protocol)."
+        )
+
+
+def _cited_clarification_id(row: dict) -> str | None:
+    """The `C-NNN` a coverage row's `status` / `approvalDisposition` cites."""
+    for field in ("status", "approvalDisposition"):
+        value = str(row.get(field) or "").strip()
+        if value.startswith("blocked "):
+            return value.split(" ", 1)[1].strip()
+    return None
+
+
+def _blocks_approval(row: dict) -> bool:
+    """Whether one Requirement Coverage row blocks approval on its face, per
+    `prompts/profiles/implementation-planning.md` §"Requirement Coverage": a
+    `gap`, a plain `blocked C-NNN`, or a deviation whose approval disposition
+    is blocked.
+    """
+    status = str(row.get("status") or "").strip()
+    if status == "gap" or status.startswith("blocked C-"):
+        return True
+    disposition = str(row.get("approvalDisposition") or "").strip()
+    return status == "documented-deviation" and disposition.startswith("blocked C-")
+
+
+def _plan_item_clarification_ids(item: object) -> set[str]:
+    """이 plan item 이 가리키는 `C-NNN` 들.
+
+    계약 v3 에서 리포트 정본의 이 링크는 복수형 `clarificationRefs[]` 다 —
+    `report_assembly` 가 활동 원장의 `clarificationRefs[]` + `planItemIds[]` 에서
+    유도해 쓰고, v3.0 스키마의 `planItems[]` 는 `additionalProperties: false` 아래
+    그 이름만 허용한다. 단수형 `clarificationId` 는 lead 가 쓰는 plan-body 상태
+    파일과 v2 리포트에 남아 있으므로 읽을 때는 둘 다 받는다
+    (`incremental_scope` 가 이미 그렇게 한다).
+    """
+    if not isinstance(item, dict):
+        return set()
+    ids = {
+        str(ref).strip()
+        for ref in (item.get("clarificationRefs") or [])
+        if str(ref).strip()
+    }
+    single = item.get("clarificationId")
+    if isinstance(single, str) and single.strip():
+        ids.add(single.strip())
+    return ids
+
+
+def _plan_body_promoted_clarification_ids(pbv: dict) -> set[str]:
+    """`C-NNN` ids this run's own plan-body round created by promoting a
+    majority-disagree item (step 8). Used to break the Requirement Coverage
+    ↔ Clarification cycle: a coverage row citing one of these echoes a blocker
+    the gate already counted, rather than contributing an independent one.
+    """
+    return {
+        clarification_id
+        for item in (pbv.get("planItems") or [])
+        for clarification_id in _plan_item_clarification_ids(item)
+    }
+
+
+def _independent_coverage_blockers(ip: dict, pbv: dict) -> list[str]:
+    """Coverage rows that block the gate on their own — excluding rows whose
+    blocker is a `C-NNN` this same run's plan-body round promoted."""
+    promoted = _plan_body_promoted_clarification_ids(pbv)
+    return [
+        str(row.get("id") or "<unknown>")
+        for row in (ip.get("requirementCoverage") or [])
+        if isinstance(row, dict)
+        and _blocks_approval(row)
+        and _cited_clarification_id(row) not in promoted
+    ]
+
+
+def _gate_blocking_causes(
+    pbv: dict,
+    coverage_blockers: list[str],
+    accepted_item_ids: set[str] | None = None,
+) -> set[str]:
+    """Which inputs actually block approval, as `gateBlockedBy` enum values."""
+    causes = set()
+    recomputed = _recompute_plan_body_gate(pbv, accepted_item_ids)
+    if pbv.get("gating") is False and not requires_plan_repair(pbv):
+        if recomputed == "aborted-non-result":
+            causes.add("non-result")
+        return causes
+    if recomputed == "blocked-by-disagreement":
+        causes.add("majority-disagree")
+    elif recomputed == "aborted-non-result":
+        causes.add("non-result")
+    if coverage_blockers:
+        causes.add("coverage-gap")
+    return causes
+
+
+_APPROVAL_CLARIFICATION_ID_RE = re.compile(r"^C-\d{3,}$")
+
+
+_SELF_FIX_NOTE_ROUND_RE = re.compile(r"self-fixed in round\s*(\d+)", re.IGNORECASE)
+
+
+def _items_resolved_in_round(plan_items: object, round_number: int) -> set[str]:
+    resolved: set[str] = set()
+    for item in plan_items if isinstance(plan_items, list) else []:
+        if not isinstance(item, dict):
+            continue
+        match = _SELF_FIX_NOTE_ROUND_RE.search(str(item.get("selfFixNote") or ""))
+        if match and int(match.group(1)) == round_number:
+            resolved.add(str(item.get("id")))
+    return resolved
+
+
+def _detect_self_fix_recurrence(pbv: dict) -> list[str]:
+    """Rounds that re-target ground the previous round already worked, unresolved.
+
+    `no-progress` is judged at the round's end from what it resolved. Repeating
+    the previous round's *unresolved* remainder is the same conclusion reached
+    one dispatch earlier — the observed shape was two rounds spent on one
+    identical seven-item set. This names that shape so the loop can exit on it
+    rather than paying for the round that proves it.
+
+    Advisory only. Narrowing onto what the last round genuinely left open is
+    legitimate progress, and the rule separating that from re-digging the same
+    hole is not settled (design D-1), so this reports rather than fails.
+    """
+    groups = pbv.get("selfFixGroups") if isinstance(pbv, dict) else None
+    if not isinstance(groups, list):
+        return []
+    by_round: dict[int, set[str]] = {}
+    for group in groups:
+        if not isinstance(group, dict) or not isinstance(group.get("round"), int):
+            continue
+        ids = {str(i) for i in group.get("itemIds") or []}
+        by_round.setdefault(group["round"], set()).update(ids)
+
+    warnings: list[str] = []
+    plan_items = pbv.get("planItems")
+    for round_number in sorted(by_round)[1:]:
+        previous = by_round.get(round_number - 1)
+        if not previous:
+            continue
+        unresolved = previous - _items_resolved_in_round(plan_items, round_number - 1)
+        current = by_round[round_number]
+        if current and current <= unresolved:
+            warnings.append(
+                f"self-fix round {round_number} re-targets only items round "
+                f"{round_number - 1} left unresolved ({', '.join(sorted(current))}) "
+                "— the previous round's correction did not move this cause. "
+                "Consider exiting with `no-progress` instead of spending the "
+                "remaining budget on the same ground."
+            )
+    return warnings
+
+
+def _validate_participating_analysers(data: dict, failures: list[str]) -> None:
+    """The gate's own arithmetic base, checked against the votes it ran on.
+
+    A majority over two votes and a majority over three are different claims,
+    and a shrunken roster loosens the gate silently: with two analysers,
+    1-AGREE/1-DISAGREE is a tie, so it never reaches `majority-disagree`. The
+    field only reports; the arithmetic is unchanged. It is recomputable from
+    the recorded verdicts, so a figure the table denies is a defect.
+
+    재계산은 `okstra_ctl.plan_items.voting_analyser_keys` 하나뿐이고, 기록하는
+    쪽(`okstra plan-items complete-round`)도 같은 함수를 부른다. 두 곳이 각자
+    세던 동안 생산자는 이번 라운드 큐만, 이쪽은 전 항목·전 라운드를 세서
+    critic 이 동수만 가른 라운드에서 값이 갈렸다.
+    """
+    pbv = (data.get("implementationPlanning") or {}).get("planBodyVerification") or {}
+    declared = pbv.get("participatingAnalysers")
+    if not isinstance(declared, dict):
+        return
+
+    rostered = declared.get("rostered")
+    voting = declared.get("voting")
+    if not isinstance(rostered, int) or not isinstance(voting, int):
+        failures.append(
+            "final-report data.json: planBodyVerification.participatingAnalysers "
+            "needs integer `rostered` and `voting`."
+        )
+        return
+    if voting > rostered:
+        failures.append(
+            "final-report data.json: planBodyVerification.participatingAnalysers "
+            f"claims {voting} voting of {rostered} rostered — more workers voted "
+            "than were on the roster."
+        )
+        return
+
+    observed = voting_analyser_keys(pbv.get("planItems") or [])
+    if observed and voting != len(observed):
+        failures.append(
+            "final-report data.json: planBodyVerification.participatingAnalysers "
+            f"declares {voting} voting analyser(s) but the recorded verdicts carry "
+            f"{len(observed)} ({', '.join(sorted(observed))}). A worker whose "
+            "dispatch returned no result is excluded from the gate arithmetic and "
+            "must not be counted here either."
+        )
+
+
+def _validate_gate_blocked_by(
+    data: dict,
+    failures: list[str],
+    accepted_item_ids: set[str] | None = None,
+) -> None:
+    """선언된 `gateResult` 가 실제로 남아 있는 차단 원인과 맞는지 본다.
+
+    승인을 막는 입력은 둘이다 — `majority-disagree` 플랜 항목, 그리고
+    Requirement Coverage 의 `gap` / `blocked C-NNN` 행. 두 갈래를 남긴다:
+    (a) 막는 원인이 있는데 `passed` 계열을 선언한 경우, (b) 막는 원인이 하나도
+    없는데 차단 값을 그대로 둔 경우. 둘 다 실측 사고에서 나왔다 — (b) 는 gate
+    토큰이 1라운드 값에 멈춰 프로젝트 전체에서 run 을 못 열게 만들었다.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+
+    declared_gate = str(pbv.get("gateResult") or "").strip().lower()
+    coverage_blockers = _independent_coverage_blockers(ip, pbv)
+    accepted = (
+        _resolved_noncritical_dissent_ids(data)
+        if accepted_item_ids is None
+        else accepted_item_ids
+    )
+    actual_causes = _gate_blocking_causes(pbv, coverage_blockers, accepted)
+
+    if actual_causes and declared_gate in ("passed", "passed-with-dissent"):
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            f"`gateResult` is `{declared_gate}` but "
+            f"{sorted(actual_causes)} blocks approval "
+            f"(coverage rows: {coverage_blockers or 'none'}). A Requirement "
+            "Coverage `gap` / `blocked C-NNN` row blocks the gate independently "
+            "of the worker verdicts (implementation-planning.md "
+            '§"Requirement Coverage").'
+        )
+        return
+
+    if not actual_causes and _PLAN_GATE_RANK.get(declared_gate) == 0:
+        # A blocking value with nothing left blocking it. The two checks around
+        # this one both walk from a recorded cause outward, so a gate that
+        # simply stopped being updated fell between them: a self-fix loop
+        # resolved every majority-disagree item, `gateBlockedBy` emptied
+        # correctly, and the gate token stayed at its round-1 value. The plan
+        # was approvable and nothing said so — run-prep refused the approval,
+        # and the refusal propagated far enough to take the run wizard down
+        # with it, so no run could be started in that project at all. Rescoring
+        # with `okstra plan-verify` and recording what it returns is the fix;
+        # the round is not complete until that call agrees with the report.
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            f"`gateResult` is `{declared_gate}` but nothing blocks approval — "
+            "no plan item is `majority-disagree`, no dispatch was a non-result, "
+            "and no Requirement Coverage row blocks independently. A gate that "
+            "withholds approval with no recorded cause is almost always a value "
+            "left behind by an earlier round: rescore with `okstra plan-verify` "
+            "and record its `gate.recomputed` "
+            '(plan-body-verification.md §"Round protocol" step 5).'
+        )
+
+    # 선언 `gateBlockedBy` 집합과 재계산 집합을 대조하던 갈래는 삭제했다.
+    # 생산자(`okstra plan-items complete-round`)가 이 검증기의 계산 함수를
+    # 그대로 import 해 필드를 쓰므로 값이 갈릴 자리가 없고, 그 필드를 읽어
+    # 실행을 구동하는 소비자도 없다.
+
+
+def _has_clarification_backtrace(
+    row_id: str, plan_items: object, coverage: object
+) -> bool:
+    """Whether the plan records anything this clarification blocks.
+
+    Two link shapes, both authored by the same run: the `P-*` plan item that
+    carries the `clarificationId`, and the requirement-coverage row blocked on
+    the id. `incremental-scope` resolves impacted stages from exactly these
+    two, and the coverage side goes through its predicate so the gate and the
+    resolver cannot disagree about what counts as a link.
+    """
+    if isinstance(plan_items, list) and any(
+        row_id in _plan_item_clarification_ids(item) for item in plan_items
+    ):
+        return True
+    return isinstance(coverage, list) and any(
+        coverage_row_blocked_on(row, row_id) for row in coverage
+    )
+
+
+def _validate_approval_clarification_backtrace(data: dict, failures: list[str]) -> None:
+    """An approval blocker must record what it blocks.
+
+    `_validate_plan_body_clarification_matching` already walks the other
+    direction — a majority-disagree plan item must cite a `blocks: approval`
+    row. Nothing walked this way, so a row could withhold approval while
+    recording no blast radius at all. The cost lands on the re-run:
+    `incremental-scope` resolves impacted stages from these links and will not
+    silently narrow past an id that traces to no stage, so this report fails
+    rather than forcing a full re-run.
+
+    The link must also *resolve to a stage*, which is the thing the re-run
+    actually reads. Checking only that a link exists let a row satisfy this
+    gate while the next re-run still could not place the answer: `P-Req-*`
+    and `P-Val-*` ids are numbered by position in their own array, so they
+    carry no stage, and a blocked coverage row whose `coveredBy` is prose
+    cites none either.
+    """
+    if (data.get("header") or {}).get("taskType") != "implementation-planning":
+        return
+    planning = data.get("implementationPlanning")
+    if not isinstance(planning, dict):
+        return
+    coverage = planning.get("requirementCoverage")
+    verification = planning.get("planBodyVerification")
+    plan_items = (
+        verification.get("planItems") if isinstance(verification, dict) else None
+    )
+    for row in data.get("clarificationItems") or []:
+        if not isinstance(row, dict) or row.get("blocks") != "approval":
+            continue
+        if str(row.get("status") or "") in {"answered", "resolved"}:
+            continue
+        row_id = str(row.get("id") or "<unknown>")
+        if not _has_clarification_backtrace(row_id, plan_items, coverage):
+            failures.append(
+                f"final-report data.json: clarification `{row_id}` blocks approval "
+                "but has no back-trace into the plan — no plan item carries it as "
+                "`clarificationId`, and no requirement-coverage row is `blocked "
+                f"{row_id}` in its `status` or `approvalDisposition`. An item that "
+                "withholds approval without recording what it affects cannot "
+                "place the next re-run's scope; this report fails rather than "
+                "forcing a full re-run."
+            )
+            continue
+        if stages_for_clarification(data, row_id):
+            continue
+        failures.append(
+            f"final-report data.json: clarification `{row_id}` blocks approval "
+            "and is linked, but the link resolves to no stage. `incremental-"
+            "scope` reads the stage from a `P-Step-<stage>.<step>` / `P-Prep-"
+            "S<stage>-<kind>` plan-item id, from `stageScope` / `stageRefs` on "
+            "the linked plan item or coverage row, or from a `Stage N` citation "
+            f"in the blocked coverage row's `coveredBy`. A `P-Req-*` / `P-Val-*` "
+            "id carries no stage number, so a row linked only that way must "
+            "carry `stageRefs` or cite the stage in `coveredBy`. A blocker "
+            "whose blast radius resolves to no stage cannot auto-narrow the "
+            "next re-run; this report fails rather than forcing a full re-run."
+        )
+
+
+def _validate_self_fix_grouping(data: dict, failures: list[str]) -> None:
+    """A self-fix round must be instructed by cause, not as a flat item list.
+
+    Blocked items are usually several derivatives of one defect. Instructed
+    item-by-item, each patch corrects its own section and leaves the sibling
+    sections still asserting the old value, so the next round re-finds the same
+    family and the budget drains without converging. Recording the grouping
+    makes the lead commit to a diagnosis and makes a one-group-per-item
+    non-diagnosis visible in the artifact rather than invisible in a prompt.
+
+    Recording rounds here also ties `selfFixRoundsApplied` to work that exists
+    in the data: it was a free-floating self-reported integer, yet
+    `_validate_self_fix_before_clarification` gates promotion on its value.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    rounds_applied = pbv.get("selfFixRoundsApplied")
+    if not isinstance(rounds_applied, int) or rounds_applied < 1:
+        return
+
+    groups = [g for g in (pbv.get("selfFixGroups") or []) if isinstance(g, dict)]
+    if not groups:
+        failures.append(
+            "final-report data.json: planBodyVerification declares "
+            f"`selfFixRoundsApplied`={rounds_applied} but records no "
+            "`selfFixGroups`. Each round's targets MUST be grouped by common "
+            "cause before being handed to report-writer — a flat item list "
+            "makes every patch leave its siblings' contradictions standing "
+            '(plan-body-verification.md §"Round protocol" step 7).'
+        )
+        return
+
+    rounds = [g.get("round") for g in groups if isinstance(g.get("round"), int)]
+    if len(set(rounds)) > 1:
+        failures.append(
+            "final-report data.json: automatic self-fix is limited to one rewrite; "
+            "resolve remaining items through lead decisions or user confirmation."
+        )
+    if rounds and max(rounds) != rounds_applied:
+        failures.append(
+            "final-report data.json: planBodyVerification "
+            f"`selfFixRoundsApplied`={rounds_applied} does not match the highest "
+            f"round recorded in `selfFixGroups` ({max(rounds)}). The round count "
+            "must be derivable from recorded work, not asserted independently of "
+            "it — promotion eligibility is gated on this number."
+        )
+
+    known_ids = {
+        str(item.get("id")).strip()
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict) and str(item.get("id") or "").strip()
+    }
+    grouped_ids = [
+        str(item_id).strip()
+        for group in groups
+        for item_id in (group.get("itemIds") or [])
+        if str(item_id or "").strip()
+    ]
+    unknown = sorted({i for i in grouped_ids if i not in known_ids})
+    if unknown:
+        failures.append(
+            "final-report data.json: planBodyVerification.selfFixGroups targets "
+            f"plan item(s) {unknown} that do not exist in `planItems`."
+        )
+
+    fixed_ids = {
+        str(item.get("id")).strip()
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+        and str(item.get("selfFixNote") or "").strip()
+        and str(item.get("id") or "").strip()
+    }
+    ungrouped = sorted(fixed_ids - set(grouped_ids))
+    if ungrouped:
+        failures.append(
+            "final-report data.json: plan item(s) "
+            f"{ungrouped} carry a `selfFixNote` but appear in no "
+            "`selfFixGroups` entry. Every item a round corrected must be "
+            "attributable to the cause group it was instructed under."
+        )
+
+
+_ANSWERED_CLARIFICATION_STATUSES = frozenset({"answered", "resolved"})
+
+
+def _answered_clarification_ids(data: dict) -> list[str]:
+    """Clarifications this run incorporated an answer for — the rows whose
+    answers can invalidate statements the previous run wrote."""
+    return [
+        str(row.get("id")).strip()
+        for row in (data.get("clarificationItems") or [])
+        if isinstance(row, dict)
+        and str(row.get("status") or "").strip() in _ANSWERED_CLARIFICATION_STATUSES
+        and str(row.get("userInput") or "").strip()
+        and str(row.get("id") or "").strip()
+    ]
+
+
+def _validate_supersession_ledger(
+    data: dict,
+    failures: list[str],
+    *,
+    carried: dict | None = None,
+    new_plan: bool = False,
+) -> None:
+    """Incorporating an answer means retiring what it invalidates, not only
+    adding what it decides.
+
+    `new_plan` marks a plan built from a selected direction. Prepare seeds
+    that run's ledger with every answer the option-selection record carried
+    (2026-09-05), and a first plan has no earlier statement those answers
+    could retire — an entry per carried row would be `no-dependent-statement`
+    by construction. Those ids are exempt; answers the plan itself raised and
+    settled still need their entry.
+
+    A re-run reconciles each `C-*` row's `Status` and writes the new decision
+    into the plan, but nothing required it to remove the sentences the answer
+    made false. The result is one plan carrying two opposite instructions for
+    the same symbol — the implementer then has to guess which one is live, and
+    the §5.5.9 round correctly blocks on it. This check makes the writer state,
+    per answered clarification, what it retired or why nothing was contingent
+    on that answer. The claim's *truth* is what the §5.5.9 adversarial round
+    tests; this only forces the claim to exist and be attributable.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    answered = set(_answered_clarification_ids(data))
+    if new_plan:
+        answered.difference_update((carried or {}).keys())
+    else:
+        answered.update((carried or {}).keys())
+    if not answered:
+        return
+    ledger = [e for e in (ip.get("supersessionLedger") or []) if isinstance(e, dict)]
+    covered = {
+        str(entry.get("clarificationId") or "").strip()
+        for entry in ledger
+        if str(entry.get("clarificationId") or "").strip()
+    }
+    missing = [cid for cid in answered if cid not in covered]
+    if missing:
+        failures.append(
+            "final-report data.json: implementationPlanning.supersessionLedger has "
+            f"no entry for answered clarification(s) {sorted(missing)}. Every "
+            "answer this run incorporated MUST record what it superseded "
+            "(`disposition: superseded` with the retired statement and the "
+            "sections revised) or state that no plan statement was contingent "
+            "on it (`disposition: no-dependent-statement` with a rationale). "
+            "Adding the new decision while leaving the contradicting sentence "
+            "in place is what puts two opposite instructions in one plan "
+            '(_common-contract.md §"clarification response carry-in").'
+        )
+    stale = covered - answered
+    carry_in = data.get("clarificationCarryIn")
+    # 이월 원장은 이전 런에서 받은 답을 이번 런이 반영한 기록이다.
+    # 이번 런 clarificationItems 에 userInput 이 없다고 stale 로 보면
+    # C-024 같은 이월 행이 "this run did not answer" 가 된다.
+    if (
+        stale
+        and isinstance(carry_in, dict)
+        and str(carry_in.get("sourceFile") or "").strip()
+    ):
+        stale = set()
+    if stale:
+        failures.append(
+            "final-report data.json: implementationPlanning.supersessionLedger "
+            f"cites {sorted(stale)}, which this run did not answer. A ledger "
+            "entry must correspond 1:1 to a clarification whose answer this "
+            "run incorporated."
+        )
+
+
+def _validate_round_recorded_verdicts(data: dict, failures: list[str]) -> None:
+    """A round that ran must leave the votes it ran on — item by item.
+
+    The gate is re-derived from `planItems[].verdicts[]`, so an empty table
+    removes the very evidence the recompute judges. A *healthier* declared gate
+    is already caught — empty verdicts recompute to `aborted-non-result`, which
+    every passing value outranks. What slipped through was the conservative
+    declaration: a lead writing `aborted-non-result` over an empty table
+    produces a gate nothing can audit, indistinguishable from a round that was
+    dispatched and whose results were never transcribed.
+
+    The per-item form is what survives a self-fix loop. Round 2+ queues are
+    targeted, so an item the planner adds mid-loop and never puts in one keeps
+    an empty `verdicts[]` while every neighbour carries votes — and nothing
+    downstream reads that as a gap. An empty table classifies `all-non-result`
+    (`_classify_plan_item_gate`), which states as `needs-reverify`, which
+    `_recompute_plan_body_gate` folds into `passed-with-dissent`: a plan item
+    no verifier ever judged leaves the gate in a passing value. The whole-table
+    check could not see it, since it stands down the moment any one item has a
+    vote.
+
+    An unjudged item is distinguishable from a legitimately unresolved one, and
+    the difference is what is recorded rather than what is missing. A peer that
+    returned nothing is a `verification-error` VOTE (§"Round protocol" step 3),
+    so an all-error item still carries rows and still folds to `needs-reverify`
+    on purpose. An empty table means no dispatch was accounted for at all.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    items = [
+        it
+        for it in (pbv.get("planItems") or [])
+        if isinstance(it, dict) and _stage_scope_bucket(it, pbv) == "in-scope"
+    ]
+    if not items:
+        return
+    empty = [str(it.get("id") or "<unnamed>") for it in items if not it.get("verdicts")]
+    if not empty:
+        return
+    if len(empty) == len(items):
+        failures.append(
+            "final-report data.json: planBodyVerification declares "
+            f"`roundCount`={round_count} but every one of the {len(items)} "
+            "`planItems[]` carries an empty `verdicts[]`. A round that ran MUST "
+            "record the votes it produced — the gate is re-derived from this "
+            "table, so an empty one leaves the declared `gateResult` unauditable. "
+            "A dispatch that returned nothing is recorded as `verification-error`, "
+            'not omitted (plan-body-verification.md §"Round protocol" step 4).'
+        )
+        return
+    shown = ", ".join(f"`{item_id}`" for item_id in empty[:5])
+    more = f" and {len(empty) - 5} more" if len(empty) > 5 else ""
+    failures.append(
+        "final-report data.json: planBodyVerification declares "
+        f"`roundCount`={round_count} but {len(empty)} of {len(items)} "
+        f"`planItems[]` carry an empty `verdicts[]`: {shown}{more}. Every "
+        "extracted plan item MUST be judged by the round — an item with no "
+        "vote at all is not a dissent the gate can weigh, it is a plan item "
+        "nobody verified, and it currently folds into `passed-with-dissent` "
+        "alongside items that were properly cross-checked. Either dispatch it "
+        "in this round's queue, or record the non-result as a "
+        "`verification-error` verdict per plan-body-verification.md "
+        '§"Round protocol" step 3 — an item is never left with no row.'
+    )
+
+
+def _plan_items_routed_to_a_user_decision(data: dict) -> set[str]:
+    """`blocks: approval` C 행과 이어진 계획 항목 id.
+
+    처분 여부는 보지 않는다. 행이 존재한다는 것 자체가 그 항목이 사용자 결정
+    채널로 나갔다는 뜻이고, 아직 답이 없는 행은 `row_blocks_progress` 가
+    승인을 막는다 — `_validate_v3_approval_context` 가 그 상태의 `approved:
+    true` 를 거부한다. 링크는 양방향으로 읽는다: 항목 쪽 `clarificationRefs`
+    와, 행 → 활동 원장 역추적(`_plan_item_ids_for_clarification`). 계약 3.0
+    리포트는 후자로만 이어지는 경우가 있다.
+    """
+    rows = [r for r in (data.get("clarificationItems") or []) if isinstance(r, dict)]
+    approval_rows = [
+        row for row in rows if row.get("blocks") == "approval" and row.get("id")
+    ]
+    approval_ids = {str(row["id"]) for row in approval_rows}
+    linked: set[str] = set()
+    items = (
+        (data.get("implementationPlanning") or {}).get("planBodyVerification") or {}
+    ).get("planItems") or []
+    for item in items:
+        if isinstance(item, dict) and _plan_item_clarification_ids(item) & approval_ids:
+            linked.add(str(item.get("id") or "").strip())
+    for row in approval_rows:
+        context = row.get("approvalContext")
+        linked.update(
+            str(item_id).strip()
+            for item_id in _plan_item_ids_for_clarification(
+                row, context if isinstance(context, dict) else {}, data
+            )
+        )
+    linked.discard("")
+    return linked
+
+
+def _validate_unresolved_tie_was_reverified(
+    data: dict,
+    failures: list[str],
+) -> None:
+    """A split panel is settled by critic-worker or by the user, not by silence.
+
+    The gate needs a strict majority to block, so a panel splitting evenly on a
+    blocking kind reaches neither consensus nor `majority-disagree`. That state
+    is classified `needs-reverify`, which `_recompute_plan_body_gate` folds into
+    `passed-with-dissent` — so without a settlement the split passes with nobody
+    deciding it.
+
+    두 가지 해소가 있고 로스터가 어느 쪽인지 정한다. critic 이 배정된 run 은
+    `critic-worker` 표가 가른다. critic 이 없는 로스터(`invocationAssignments`
+    에 `critic/*` 없음, `okstra_ctl.plan_items.critic_is_rostered`)는 라운드
+    안에 가를 표가 아예 없으므로 `next_dispatch` 가 `user-decision` 을 내고
+    리드가 항목마다 승인 결정을 연다. 그 결정 행이 이 항목의 해소다. 검증기는
+    로스터를 볼 수 없으므로(이 검사의 입력은 리포트 정본뿐) 둘 중 하나가
+    기록되어 있으면 해소로 읽고, 둘 다 없을 때만 발화한다.
+
+    같은 조건을 다른 술어로 한 번 더 세던 두 번째 동수 검사를 여기로 합쳤다.
+    그쪽 술어는 판정 행의 `round` 를 1 로 눌러 놓고 `_is_unsettled_tie` 를
+    불렀는데, `_is_even_analyser_split` 는 `round` 를 보지 않으므로 두 술어의
+    값이 언제나 같았다 — 같은 항목이 두 번 실패로 올라왔다. 여기 남은 조건이
+    두 집합의 합집합이다.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    # 사용자 결정 채널로 나간 항목은 제외한다. 진행 처분이 이미 붙은 항목
+    # (accept-risk 등)도 여기 포함된다 — 리드 계약이 accept-risk 를 "게이트를
+    # 끝내고 재검증 AGREE 를 요구하지 않는" 처분으로 정의하므로, 계속 실패를
+    # 올리면 승인 처분으로 빠져나갈 수 없는 규칙이 된다.
+    decided = _plan_items_routed_to_a_user_decision(data)
+    unsettled = sorted(
+        {
+            str(item.get("id") or "").strip()
+            for item in pbv.get("planItems") or []
+            if isinstance(item, dict)
+            and not item.get("carriedForwardFromSeq")
+            and str(item.get("id") or "").strip() not in decided
+            and not _lead_decision_applies(item, pbv)
+            and _stage_scope_bucket(item, pbv) == "in-scope"
+            and _is_unsettled_tie(item)
+        }
+    )
+    if not unsettled:
+        return
+    failures.append(
+        "final-report data.json: plan item(s) "
+        f"{unsettled} carry an even split on a blocking breakage kind and "
+        f"have no `{CRITIC_WORKER_ID}` vote and no `blocks: approval` "
+        "clarification row. A tie is not consensus. With a critic on the "
+        f"roster, dispatch `{CRITIC_WORKER_ID}` on those items only (`okstra "
+        "plan-items prepare --tie-vote`), read its answer with `okstra "
+        "plan-items collect-verdicts --items <the --tie-vote plan-items "
+        f"artifact> --result {CRITIC_WORKER_ID}=<path> --output <envelope>`, "
+        "then record it with `okstra plan-items apply-verdicts --append "
+        "--round 2`. Skipping collect-verdicts and pointing apply-verdicts at "
+        "the raw result is refused: this round's queue is the tie items, not "
+        "the round's full dispatch queue. Critic AGREE settles the split; "
+        "critic DISAGREE blocks. With no critic on the roster `okstra "
+        "plan-items next-dispatch` answers `user-decision` instead: open one "
+        "`okstra approval-decision open` per item (classification "
+        "`noncritical-dissent`) and write the matching `## 1. Clarification "
+        "Items` row, and that row settles the tie here while it gates approval."
+    )
+
+
+def _validate_advisory_plan_body_gating(data: dict, failures: list[str]) -> None:
+    """gating=false 는 검출 표면 0 + 스테이지 1 일 때만 받는다."""
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict) or pbv.get("gating") is not False:
+        return
+    facts = (
+        ip.get("designPreparation") is not None
+        or ip.get("stageMap")
+        or ip.get("stages")
+    )
+    if requires_plan_repair(pbv):
+        failures.append(
+            "plan-body-verification: objective verification defects require gating=true; repair the affected items"
+        )
+    if facts and not advisory_plan_body_gating(ip):
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            "`gating` is false, but that is only legal when "
+            "designPreparation.mode is `no-design-inputs` (empty items) and the "
+            "Stage Map has exactly one row. Two-or-more stages, a PREP item, or "
+            "non-empty designPreparation items keep the gating contract."
+        )
+    applied = pbv.get("selfFixRoundsApplied")
+    if isinstance(applied, int) and applied > 0:
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            "`gating` is false, so the self-fix loop must not run "
+            f"(`selfFixRoundsApplied`={applied}). Keep extraction and one "
+            "verification round."
+        )
+
+
+def _validate_verdict_rounds_outlive_self_fix(
+    data: dict,
+    failures: list[str],
+) -> None:
+    """A verdict must judge the plan the gate is about to pass.
+
+    Rounds interleave with rewrites: round 1, self-fix 1, round 2, self-fix 2 …
+    so a verdict cast in round R judged the text as it stood after self-fix
+    R-1. If any self-fix ran afterwards — `selfFixRoundsApplied >= R` — that
+    text has changed and the verdict is stale by construction. No semantic
+    analysis is needed to know that; the arithmetic settles it.
+
+    The sibling `_validate_verdicts_match_current_subjects` cannot see this. It
+    compares each row's own recorded `subject`, which catches a positional shift
+    but not the case that matters here: an item whose own wording never changed
+    while the stage it points at was rewritten under it. Observed on a real run
+    — the gate read `passed-with-dissent` with zero blockers, and re-running one
+    round flipped 3 of 27 items to `majority-disagree`, all correctness-critical,
+    because their surviving verdicts predated two self-fix rounds.
+
+    Scoped to items this run verified: a `carriedForwardFromSeq` row belongs to
+    the prior run's record and is judged by that run's seq, not this one's
+    rounds.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    applied = pbv.get("selfFixRoundsApplied")
+    if not isinstance(applied, int) or applied < 1:
+        # With no rewrite after any round there is nothing a verdict can be
+        # stale against, and an unstamped row is then simply unremarkable.
+        return
+
+    stale: list[str] = []
+    unstamped: list[str] = []
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict) or item.get("carriedForwardFromSeq"):
+            continue
+        if _stage_scope_bucket(item, pbv) != "in-scope":
+            continue
+        item_id = str(item.get("id") or "").strip()
+        verified = item.get("verifiedContentHash")
+        current = item.get("contentHash")
+        if (
+            isinstance(verified, str)
+            and isinstance(current, str)
+            and verified == current
+        ):
+            # 본문이 같으면 라운드 번호가 self-fix 이전이어도 같은 텍스트다.
+            continue
+        for verdict in item.get("verdicts") or []:
+            if not isinstance(verdict, dict):
+                continue
+            round_number = verdict.get("round")
+            if not isinstance(round_number, int) or isinstance(round_number, bool):
+                unstamped.append(item_id)
+            elif round_number <= applied:
+                stale.append(item_id)
+    if unstamped:
+        failures.append(
+            f"final-report data.json: plan item(s) {sorted(set(unstamped))} carry "
+            f"a verdict with no `round`, and {applied} self-fix round(s) rewrote "
+            "the plan. Without the round there is no way to tell whether the "
+            "verdict judged the current text or a version two rewrites old. "
+            "Re-record the round's votes with `okstra plan-items apply-verdicts "
+            "--round <N>`."
+        )
+    if stale:
+        failures.append(
+            f"final-report data.json: plan item(s) {sorted(set(stale))} carry a "
+            f"verdict from a round at or before self-fix round {applied}, so the "
+            "text they judged has since been rewritten. The gate is computed "
+            "from these votes, so passing on them declares a plan verified that "
+            "nobody verified. Re-verify those items in a round after the last "
+            'self-fix (plan-body-verification.md §"Round protocol" step 7).'
+        )
+
+
+def _validate_verdicts_match_current_subjects(
+    data: dict,
+    failures: list[str],
+) -> None:
+    """A verdict must still be attached to the element it was cast on.
+
+    `P-*` ids are positional (`plan_items.py` numbers rows by array index), so
+    when a self-fix round deletes a plan element every later row shifts up one.
+    A dangling id at the tail is already caught by
+    `_validate_plan_item_extraction_completeness`, but the shift itself is not:
+    the id set still matches while each surviving verdict now points at its
+    neighbour. The recorded `subject` is what makes the shift visible — it is a
+    snapshot of the row the worker actually judged.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    try:
+        current = {
+            str(item["id"]): str(item.get("subject") or "")
+            for item in extract_plan_items(ip)
+        }
+    except Exception:  # noqa: BLE001
+        # Extraction failure is already reported by the completeness check;
+        # do not double-report it here as a spurious subject mismatch.
+        return
+
+    drifted = []
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        item_id = str(item.get("id") or "").strip()
+        recorded = str(item.get("subject") or "").strip()
+        expected = current.get(item_id)
+        if expected is None or not recorded:
+            continue
+        if recorded != expected.strip():
+            drifted.append(item_id)
+    if drifted:
+        failures.append(
+            f"final-report data.json: plan item(s) {sorted(drifted)} carry a "
+            "`subject` that no longer matches the plan element at that "
+            "position. `P-*` ids are positional, so deleting an element during "
+            "self-fix shifts every later row and silently re-points its "
+            "verdicts at a different element — a recorded blocker then refers "
+            "to something the reader cannot find. Re-extract the plan items "
+            "and re-verify the shifted ones instead of carrying the old votes "
+            'forward (plan-body-verification.md §"Round protocol" step 7).'
+        )
+
+
+def _validate_aborted_gate_has_clarification(data: dict, failures: list[str]) -> None:
+    """A gate nobody can act on is a stalled task.
+
+    `aborted-non-result` correctly refuses approval and run-prep fail-closes
+    the `implementation` entry, but the clarification matcher only walks
+    `majority-disagree` items — and an aborted round has none. So the report
+    stated no blocker, `okstra-user-response` had nothing to present, and the
+    run stalled with no remedy until someone read the gate value by hand.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    if str(pbv.get("gateResult") or "").strip() != "aborted-non-result":
+        return
+    has_open_blocker = any(
+        isinstance(row, dict)
+        and row.get("blocks") == "approval"
+        and str(row.get("status") or "").strip() == "open"
+        for row in (data.get("clarificationItems") or [])
+    )
+    if not has_open_blocker:
+        failures.append(
+            "final-report data.json: planBodyVerification `gateResult` is "
+            "`aborted-non-result` but no open `Blocks=approval` clarification "
+            "row explains it. An aborted round blocks approval without "
+            "producing any majority-disagree item, so without this row the "
+            "report names no blocker, `okstra-user-response` has nothing to "
+            "present, and the task stalls with no stated remedy. Add a row "
+            "naming which dispatches returned no result and what re-running "
+            'them requires (plan-body-verification.md §"Round protocol").'
+        )
+
+
+def _plan_verify_result_workers(report_path: Path, task_type: str) -> set[str] | None:
+    """Worker roles that actually returned a plan-body reverify result.
+
+    Result files are named
+    ``<role-slug>-plan-verify-r<N>-<task-type>-<seq>.md`` per
+    `plan-body-verification.md` §"Round protocol" step 3, and the role slug is
+    ``<role>-plan-verify-r<N>``. Returns ``None`` when the directory is absent
+    so the caller can distinguish "no artifacts to check against" from "nobody
+    voted".
+    """
+    worker_results_dir = report_path.parent.parent / "worker-results"
+    if not worker_results_dir.is_dir():
+        return None
+    # Scoped to this run's seq for the same reason the audit check is: the
+    # directory accumulates every run, so an unscoped glob would let a prior
+    # run's result file vouch for a vote this run never collected.
+    seqs = _plan_verify_seq_aliases(report_path)
+    workers = set()
+    for seq in seqs or {_report_run_seq(report_path) or "*"}:
+        for path in worker_results_dir.glob(f"*-plan-verify-r*-{task_type}-{seq}.md"):
+            role = path.name.split("-plan-verify-r", 1)[0]
+            if role:
+                workers.add(role)
+    return workers
+
+
+def _manifest_seq_for_report(report_path: Path, category: str) -> set[str]:
+    """이 리포트 seq 를 낸 매니페스트가 그 카테고리에 기록한 seq 들.
+
+    `paths.compute_run_paths` 는 7개 카테고리 seq 를 디렉터리별로 따로 스캔해
+    배정한다(`paths.next_run_seq`). 같은 run dir 로 재실행하면 카테고리마다
+    다른 속도로 올라가 reports 017 / state 025 같은 분기가 실제로 생긴다.
+    매니페스트의 `runSequencesByCategory` 만이 그 분기를 한 런으로 묶는 기록이다.
+    """
+    seq = _report_run_seq(report_path)
+    manifests_dir = report_path.parent.parent / "manifests"
+    if not seq or not manifests_dir.is_dir():
+        return set()
+    found: set[str] = set()
+    for path in manifests_dir.glob("run-manifest-*.json"):
+        try:
+            payload = load_owned_object(path, artifact="run manifest")
+        except JsonBoundaryError:
+            continue
+        categories = payload.get("runSequencesByCategory")
+        if not isinstance(categories, dict):
+            continue
+        if str(categories.get("reports") or "") != seq:
+            continue
+        value = str(categories.get(category) or "").strip()
+        if value:
+            found.add(value)
+    return found
+
+
+def _plan_verify_seq_aliases(report_path: Path) -> set[str]:
+    """이 리포트 seq 와, 같은 리포트를 가리키는 런의 workerResults seq.
+
+    reports 와 workerResults 가 갈라지면 워커는 018 로 쓰고 검사는 014 만
+    본다. 같은 리포트를 연 매니페스트의 두 seq 를 모두 인정한다.
+    """
+    seq = _report_run_seq(report_path)
+    aliases: set[str] = {seq} if seq else set()
+    return aliases | _manifest_seq_for_report(report_path, "workerResults")
+
+
+def _plan_verify_dispatched_results(
+    report_path: Path, task_type: str
+) -> dict[str, set[str]] | None:
+    """이 런이 실제로 디스패치한 plan-body 재검증 결과 파일명(역할별).
+
+    파일명을 seq 로 되짚는 대신 **기록된 디스패치**에서 읽는다. `okstra team`
+    은 워커를 띄울 때마다 team-state 에 `workerDispatches[]` 행을 남기고
+    (`dispatch_core._dispatch_record` — `kind`, `workerResultPath` 포함), 그
+    `workerResultPath` 는 리드가 디스패치 요청에 실어 보낸 경로 그대로다
+    (`dispatch_state.py` 의 `require_string(item, "workerResultPath")`). 결과
+    파일이 어느 seq 로 쓰였든 그 기록이 정답을 들고 있다.
+
+    plan-body 상태 파일(`plan-body-verification-<task-type>-<seq>.json`)의
+    라운드/판정 행에는 파일명이 없어서 이 용도로 못 쓴다.
+
+    team-state 를 못 찾으면 ``None`` — 호출자가 seq 글롭으로 내려간다.
+    빈 dict 은 "기록은 있는데 재검증 디스패치가 한 건도 없다" 로, 라운드가
+    아예 안 돈 경우다.
+    """
+    state_dir = report_path.parent.parent / "state"
+    if not state_dir.is_dir():
+        return None
+    seqs = {_report_run_seq(report_path) or ""} | _manifest_seq_for_report(
+        report_path, "state"
+    )
+    dispatched: dict[str, set[str]] = {}
+    seen_state = False
+    for seq in sorted(s for s in seqs if s):
+        path = state_dir / f"team-state-{task_type}-{seq}.json"
+        if not path.is_file():
+            continue
+        try:
+            payload = load_owned_object(path, artifact="team state")
+        except JsonBoundaryError:
+            continue
+        seen_state = True
+        for row in payload.get("workerDispatches") or []:
+            if not isinstance(row, dict):
+                continue
+            # critic 동수 라운드는 `kind: "critic"` 으로 나간다 — 결과 파일명은
+            # 같은 `-plan-verify-r<N>-` 꼴이다. reverify 계열만 세면 동수가 있던
+            # run 마다 critic 표가 "디스패치 기록 없음" 으로 오탐된다(2026-09-09,
+            # fontsninja-v3-site dev-10627 planning 002). 계획 본문 라운드 자신의
+            # kind 인 `plan-verify-r<N>` 도 같은 이유로 센다.
+            kind = str(row.get("kind") or "")
+            if not (
+                kind.startswith("reverify-r")
+                or kind.startswith("plan-verify-r")
+                or kind == "critic"
+            ):
+                continue
+            name = Path(str(row.get("workerResultPath") or "")).name
+            if "-plan-verify-r" not in name:
+                continue
+            role = name.split("-plan-verify-r", 1)[0]
+            if role:
+                dispatched.setdefault(role, set()).add(name)
+    return dispatched if seen_state else None
+
+
+def _plan_verify_seq_near_misses(report_path: Path, task_type: str) -> list[str]:
+    """이 런의 것으로 인정되지 않은, 같은 디렉터리의 plan-verify 결과 파일.
+
+    "파일이 없다" 와 "파일은 있는데 이 런의 seq 가 아니다" 는 해소책이 다르다.
+    앞의 것은 디스패치를 다시 돌려야 하고, 뒤의 것은 이미 나온 결과로 게이트를
+    다시 계산해야 한다. 다만 재실행이 누적된 디렉터리에서는 이 목록이 수백 건이
+    되므로, 호출부가 표본만 싣는다(`_unbacked_remedy_clause`).
+    """
+    seq = _report_run_seq(report_path)
+    if not seq:
+        return []
+    directory = report_path.parent.parent / "worker-results"
+    accepted: set[Path] = set()
+    for alias in _plan_verify_seq_aliases(report_path):
+        accepted.update(directory.glob(f"*-plan-verify-r*-{task_type}-{alias}.md"))
+    for names in (
+        _plan_verify_dispatched_results(report_path, task_type) or {}
+    ).values():
+        accepted.update(directory / name for name in names)
+    return sorted(
+        path.name
+        for path in directory.glob(f"*-plan-verify-r*-{task_type}-*.md")
+        if path not in accepted
+    )
+
+
+def _validate_plan_body_verdict_provenance(
+    data: dict,
+    report_path: Path,
+    failures: list[str],
+) -> None:
+    """A recorded verdict must trace back to a worker that was actually asked.
+
+    Every §5.5.9 gate computation reads `planItems[].verdicts[]` out of the
+    data.json the lead authored, and nothing tied a vote to a dispatch. A lead
+    that skipped the round entirely and wrote `AGREE` for two workers produced
+    `gateResult: passed`, a flippable `approved:`, and a clean validator run —
+    the same self-report weakness `selfFixRoundsApplied` had, but on the votes
+    the whole gate is computed from.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+
+    voters = {
+        str(v.get("worker") or "").strip()
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+        for v in (item.get("verdicts") or [])
+        if isinstance(v, dict) and str(v.get("worker") or "").strip()
+    }
+    if not voters:
+        return
+
+    task_type = str(
+        (data.get("header") or {}).get("taskType") or ""
+    ) or _report_task_type(report_path)
+    if not task_type:
+        # Neither source names it, so the glob below would be built from an
+        # empty segment and match nothing — reporting every verdict as unbacked
+        # on the strength of a path this check could not construct.
+        return
+    results_dir = report_path.parent.parent / "worker-results"
+    recorded = _plan_verify_dispatched_results(report_path, task_type)
+    if recorded is None:
+        # 기록된 디스패치가 없다 — seq 글롭으로 내려간다.
+        dispatched = _plan_verify_result_workers(report_path, task_type)
+        if dispatched is None:
+            return
+        source = (
+            f"no team-state for this run was readable under `runs/{task_type}/"
+            f"state/`, so this fell back to globbing `*-plan-verify-r*-"
+            f"{task_type}-<seq>.md` under `runs/{task_type}/worker-results/` "
+            f"for seq(s) {sorted(_plan_verify_seq_aliases(report_path))}"
+        )
+        returned = {_analyser_key(name) for name in dispatched}
+        never_dispatched: set[str] = set()
+    else:
+        # 기록된 디스패치가 정답이다. 투표가 뒷받침되려면 (1) 그 역할로 나간
+        # 재검증 디스패치 기록이 있고 (2) 그 기록이 적어 둔 결과 파일이 디스크에
+        # 실제로 있어야 한다. seq 는 어디에도 안 쓴다 — 갈라진 seq 로 나간
+        # 디스패치도 기록에는 자기 파일명 그대로 남아 있다.
+        source = (
+            f"resolved from the `workerDispatches[]` rows this run's team-state "
+            f"recorded under `runs/{task_type}/state/` (each row's own "
+            f"`workerResultPath`, not a seq glob)"
+        )
+        recorded_keys = {_analyser_key(role) for role in recorded}
+        returned = {
+            _analyser_key(role)
+            for role, names in recorded.items()
+            if any((results_dir / name).is_file() for name in names)
+        }
+        never_dispatched = {
+            _analyser_key(voter)
+            for voter in voters
+            if _analyser_key(voter) not in recorded_keys
+        }
+    # 파일명 슬러그와 투표 키를 같은 축으로 놓는다. 결과 파일명은 cmux 어댑터가
+    # `-worker-` 토큰을 요구하는데(`workerResultPath`) 투표 키는 워커 id 그대로다.
+    # 워커 id 가 `-worker` 로 끝나던 기본 로스터에서는 두 규칙이 우연히 같은
+    # 이름을 냈지만, `grok-planner` 처럼 역할 접미사가 붙은 id 에서는 두 규칙을
+    # 동시에 만족하는 이름이 존재하지 않는다.
+    unbacked = sorted(voter for voter in voters if _analyser_key(voter) not in returned)
+    if unbacked:
+        no_dispatch = sorted(
+            voter for voter in unbacked if _analyser_key(voter) in never_dispatched
+        )
+        failures.append(
+            "final-report data.json: planBodyVerification records verdicts from "
+            f"{unbacked} but no plan-body reverify result file backs them — "
+            f"{source}."
+            + _unbacked_remedy_clause(report_path, task_type, no_dispatch)
+            + " A vote the gate is computed from MUST trace back to a dispatch "
+            "that actually returned — otherwise the round can be skipped and "
+            'the gate still read `passed` (plan-body-verification.md §"Round '
+            'protocol" step 3).'
+        )
+
+
+_NEAR_MISS_SAMPLE = 6
+
+
+def _unbacked_remedy_clause(
+    report_path: Path, task_type: str, no_dispatch: list[str]
+) -> str:
+    """뒷받침 없는 투표에 남길 실제 갈래와 정당한 해소책.
+
+    파일 이름을 바꾸라는 안내를 여기서 걷어냈다. 그 안내는 실행됐고(디렉터리에
+    개명 사본이 남았다), 개명은 어느 디스패치가 그 결과를 냈는지를 지워 검사가
+    막으려던 바로 그 상태 — 대조할 기록이 없는 투표 — 를 만든다.
+    """
+    parts: list[str] = []
+    if no_dispatch:
+        parts.append(
+            f" No reverify dispatch was recorded at all for {no_dispatch}, so "
+            "those verdicts are unbacked: either the round genuinely never ran "
+            "(re-dispatch it, or record `verification-error` for the workers "
+            "that produced no result) or it ran outside `okstra team dispatch` "
+            "and left no `workerDispatches[]` row, which is itself the "
+            "violation."
+        )
+    near = _plan_verify_seq_near_misses(report_path, task_type)
+    if near:
+        sample = near[:_NEAR_MISS_SAMPLE]
+        more = (
+            f" (+{len(near) - len(sample)} more; the directory accumulates "
+            "every rerun of this task-type)"
+            if len(near) > len(sample)
+            else ""
+        )
+        parts.append(
+            f" The directory does hold plan-verify results under other "
+            f"sequences — {sample}{more}. If one of those is this round's "
+            "output, the round was dispatched under a sequence this report does "
+            "not carry: recompute the gate from the files that exist (re-run "
+            "`okstra plan-items apply-verdicts --result <worker>=<file>` "
+            "against them and re-record the round) so the verdicts and their "
+            "evidence agree. Do NOT rename a result file to this report's seq — "
+            "renaming destroys the link between a vote and the dispatch that "
+            "produced it, which is exactly what this check reads."
+        )
+    return "".join(parts)
+
+
+_UNIFORM_VERIFIER_MIN_ITEMS = 5
+
+
+def _detect_uniform_verifier(pbv: dict) -> list[str]:
+    """Verifiers whose every vote in the round was the same verdict.
+
+    `participatingAnalysers` counts whether a worker voted, not whether the
+    votes carried information. A verifier that answers AGREE to every item is
+    counted as a third opinion while contributing no refutation signal, so the
+    report reads as a three-way cross-check backed by two. (fontsninja-nlpvibe
+    `nlpvibe-vs-fontradar-baseline` seq 001: 63/63 AGREE off six inspected
+    evidence paths, on a round where the two other analysers jointly refuted a
+    real defect.)
+
+    Advisory only. A unanimous round is a legitimate outcome, and any ratio
+    strict enough to catch a rubber stamp also fails honest agreement, so this
+    reports the counts and leaves the judgement to the reader.
+    """
+    items = pbv.get("planItems") if isinstance(pbv, dict) else None
+    if not isinstance(items, list):
+        return []
+    verdicts_by_worker: dict[str, set[str]] = {}
+    counts: dict[str, int] = {}
+    for item in items:
+        if not isinstance(item, dict):
+            continue
+        for verdict in item.get("verdicts") or []:
+            if not isinstance(verdict, dict):
+                continue
+            worker = str(verdict.get("worker") or "").strip()
+            value = str(verdict.get("verdict") or "").strip()
+            if not worker or not value or value == "verification-error":
+                continue
+            verdicts_by_worker.setdefault(worker, set()).add(value)
+            counts[worker] = counts.get(worker, 0) + 1
+    warnings = []
+    for worker in sorted(verdicts_by_worker):
+        distinct = verdicts_by_worker[worker]
+        total = counts[worker]
+        if len(distinct) != 1 or total < _UNIFORM_VERIFIER_MIN_ITEMS:
+            continue
+        warnings.append(
+            f"plan-body verification: {worker} returned `{next(iter(distinct))}` "
+            f"for all {total} items it voted on, so this round's refutation "
+            "signal came from its peers alone. Confirm the worker actually "
+            "opened the cited evidence (its `-audit-` sidecar lists what it "
+            "read) before reading the gate as a full cross-check."
+        )
+    return warnings
+
+
+def _validate_plan_item_extraction_completeness(
+    data: dict,
+    failures: list[str],
+) -> None:
+    """Require the exact deterministic P-* extraction when a round ran."""
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    try:
+        expected_sequence = expected_plan_item_ids(ip)
+    except Exception as exc:  # noqa: BLE001
+        failures.append(
+            f"final-report data.json: deterministic plan-item extraction failed: {exc}"
+        )
+        return
+
+    actual_sequence = [
+        str(item.get("id") or "").strip()
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+    ]
+    expected_ids = set(expected_sequence)
+    actual_ids = set(actual_sequence)
+    missing = expected_ids - actual_ids
+    unexpected = actual_ids - expected_ids
+    duplicate_ids = {
+        item_id for item_id in actual_ids if actual_sequence.count(item_id) > 1
+    }
+
+    if missing:
+        failures.append(
+            "final-report data.json: planBodyVerification.planItems is missing "
+            "deterministically extracted verdict item ID(s): "
+            + ", ".join(sorted(missing))
+        )
+    if unexpected:
+        failures.append(
+            "final-report data.json: planBodyVerification.planItems contains "
+            "unexpected verdict item ID(s): " + ", ".join(sorted(unexpected))
+        )
+    if duplicate_ids:
+        failures.append(
+            "final-report data.json: planBodyVerification.planItems contains "
+            "duplicate verdict item ID(s): " + ", ".join(sorted(duplicate_ids))
+        )
+
+
+def _validate_variation_point_analysis(
+    vpa: object,
+    architecture_style: str,
+    failures: list[str],
+) -> None:
+    """Conditional rules + architecture-style overlay for variation points.
+
+    The schema enforces shape only. Two layers of meaning sit on top:
+
+    Layer 1 is style-agnostic. Declaring "no variation exists" is a claim that
+    needs a written reason, and it must not be paired with declared points —
+    `plan_items._extract_variation_point_items` emits a lone `P-Var-0` in that
+    branch and drops them, so the contradiction would silently exempt every
+    declared point from per-point verification. `extract: true` is a claim in
+    the same way: it names the interface the next implementation plugs into and
+    the Stage Map stage that builds it, so both fields have to be filled. The
+    schema cannot carry this as a `minLength` — the empty string is the natural
+    shape of an `extract: false` decision.
+
+    Layer 2 fires only for a project that declares `architecture.style`
+    `hexagonal`: extracting a variation point there means introducing a port,
+    not a helper. An unconfigured project resolves to `none` and keeps layer-1
+    behaviour only.
+    """
+    if not isinstance(vpa, dict):
+        failures.append("variationPointAnalysis is missing or not an object")
+        return
+    # Schema violations are reported, not raised, so this check still runs on a
+    # malformed block. A type guard here keeps a bad field from aborting the
+    # whole validation and discarding every failure collected so far.
+    raw_points = vpa.get("points")
+    if raw_points is not None and not isinstance(raw_points, list):
+        failures.append("variationPointAnalysis: points must be an array")
+        return
+    points = raw_points or []
+    if not bool(vpa.get("hasMultipleImplementations")):
+        rationale = vpa.get("noVariationRationale")
+        if not isinstance(rationale, str) or not rationale.strip():
+            failures.append(
+                "variationPointAnalysis: hasMultipleImplementations=false "
+                "requires a non-empty noVariationRationale"
+            )
+        if points:
+            failures.append(
+                "variationPointAnalysis: hasMultipleImplementations=false but "
+                "points is non-empty — declared variation points would be "
+                "silently dropped"
+            )
+        return
+    if not points:
+        failures.append(
+            "variationPointAnalysis: hasMultipleImplementations=true requires "
+            "at least one point"
+        )
+        return
+    for index, point in enumerate(points, start=1):
+        if not isinstance(point, dict):
+            failures.append(f"variationPointAnalysis point {index}: must be an object")
+            continue
+        decision = point.get("extractionDecision")
+        if not isinstance(decision, dict):
+            continue  # shape is the schema's job; don't double-report it.
+        if not decision.get("extract"):
+            continue
+        for field in ("interfaceKind", "coveredBy"):
+            value = decision.get(field)
+            if not isinstance(value, str) or not value.strip():
+                failures.append(
+                    f"variationPointAnalysis point {index}: extract=true "
+                    f"requires a non-empty {field}, got {value!r}"
+                )
+        if (
+            architecture_style == "hexagonal"
+            and decision.get("interfaceKind") != "port"
+        ):
+            failures.append(
+                f"variationPointAnalysis point {index}: architecture style "
+                f"'hexagonal' requires interfaceKind 'port', got "
+                f"{decision.get('interfaceKind')!r}"
+            )
+
+
+_DESIGN_PREP_CONTRACT = "implementation-design-prep-v1"
+
+
+_DESIGN_PREP_REQUEST_STATUSES = {"provisional", "blocked"}
+
+
+_DESIGN_PREP_TERMINAL_STATUSES = {"ready", "not-applicable"}
+
+
+def _design_prep_rows(
+    planning: dict,
+    failures: list[str],
+) -> tuple[list[dict], dict[str, dict]] | None:
+    preparation = planning.get("designPreparation")
+    if not isinstance(preparation, dict):
+        failures.append(
+            "final-report data.json: implementationPlanning.designPreparation "
+            "is malformed; expected an object"
+        )
+        return None
+    raw_items = preparation.get("items")
+    if not isinstance(raw_items, list) or any(
+        not isinstance(item, dict) for item in raw_items
+    ):
+        failures.append(
+            "final-report data.json: implementationPlanning.designPreparation.items "
+            "is malformed; expected an array of objects"
+        )
+        return None
+    items = list(raw_items)
+    items_by_id: dict[str, dict] = {}
+    for item in items:
+        item_id = item.get("id")
+        if not isinstance(item_id, str) or not item_id:
+            failures.append(
+                "final-report data.json: designPreparation item has malformed id"
+            )
+            continue
+        if item_id in items_by_id:
+            failures.append(
+                f"final-report data.json: duplicate designPreparation item {item_id}"
+            )
+        items_by_id[item_id] = item
+    return items, items_by_id
+
+
+def _validate_design_prep_states(items: list[dict], failures: list[str]) -> None:
+    for item in items:
+        item_id = str(item.get("id") or "<missing>")
+        stage_refs = item.get("stageRefs") or []
+        review_at = item.get("reviewAt")
+        if isinstance(review_at, dict) and "stage" in review_at:
+            if review_at.get("stage") not in stage_refs:
+                failures.append(
+                    f"final-report data.json: {item_id}.reviewAt.stage must belong "
+                    "to stageRefs"
+                )
+        status = item.get("status")
+        if status == "blocked" and (
+            not isinstance(item.get("humanConfirmation"), dict)
+            or item["humanConfirmation"].get("required") is not True
+        ):
+            failures.append(
+                f"final-report data.json: blocked {item_id} requires "
+                "humanConfirmation.required=true"
+            )
+        if status in _DESIGN_PREP_REQUEST_STATUSES and not isinstance(
+            item.get("requestPath"), str
+        ):
+            failures.append(
+                f"final-report data.json: {status} {item_id} requires requestPath"
+            )
+        if status in _DESIGN_PREP_TERMINAL_STATUSES and "requestPath" in item:
+            failures.append(
+                f"final-report data.json: terminal {item_id} must not carry requestPath"
+            )
+
+
+def _validate_design_prep_requests(
+    data: dict,
+    report_path: Path,
+    items: list[dict],
+    failures: list[str],
+) -> None:
+    data_path = _data_path_for(report_path)
+    planning_seq = _design_prep_planning_seq(data_path)
+    report_language = _design_prep_report_language(data)
+    for item in items:
+        if item.get("status") not in _DESIGN_PREP_REQUEST_STATUSES:
+            continue
+        item_id = str(item.get("id") or "<missing>")
+        target, expected = _render_design_prep_request(
+            data_path=data_path,
+            planning_seq=planning_seq,
+            report_language=report_language,
+            item=item,
+        )
+        if not target.is_file():
+            failures.append(
+                f"final-report data.json: design-prep request is missing for {item_id}: "
+                f"{target}"
+            )
+            continue
+        try:
+            actual = target.read_bytes()
+        except OSError as exc:
+            failures.append(
+                f"final-report data.json: cannot read design-prep request for "
+                f"{item_id}: {exc}"
+            )
+            continue
+        # 동일성 판정은 조립(`design_prep._request_conflicts`)과 같은 신원을 쓴다.
+        # 두 곳이 다른 기준을 걸면 조립이 통과시킨 파일을 검증이 stale 로 떨어뜨려,
+        # run 이 고칠 수 없는 실패에 갇힌다 — 이월된 요청은 발행 리포트 줄만
+        # 다르고, 그 줄을 현행화하려면 이전 run 의 기록을 덮어써야 한다.
+        if _design_prep_request_identity(actual) != _design_prep_request_identity(
+            expected
+        ):
+            failures.append(
+                f"final-report data.json: design-prep request content or "
+                f"fingerprint is stale for {item_id}: {target}"
+            )
+
+
+def _validate_design_prep_contract(
+    data: dict,
+    report_path: Path | None,
+    report_contracts: set[str],
+    failures: list[str],
+) -> list[str]:
+    warnings: list[str] = []
+    planning = data.get("implementationPlanning")
+    if not isinstance(planning, dict):
+        if _DESIGN_PREP_CONTRACT in report_contracts:
+            failures.append(
+                "final-report data.json: implementationPlanning is malformed"
+            )
+        return warnings
+    preparation = planning.get("designPreparation")
+    if not isinstance(preparation, dict):
+        if _DESIGN_PREP_CONTRACT in report_contracts:
+            failures.append(
+                "final-report data.json: marker implementation-design-prep-v1 "
+                "requires implementationPlanning.designPreparation"
+            )
+        else:
+            warnings.append("legacy-unassessed")
+        return warnings
+    if _DESIGN_PREP_CONTRACT not in report_contracts:
+        return warnings
+    try:
+        # 탐지기 재실행 대조와 prep 항목 ↔ coverage 양방향 참조 대조는
+        # 삭제했다. 둘 다 `design_snapshot.build` 가 한 번에 만든 값을 같은
+        # 입력으로 되계산해 자기 자신과 맞춰 보는 항등식이었다.
+        parsed = _design_prep_rows(planning, failures)
+        if parsed is None:
+            return warnings
+        items, _ = parsed
+        _validate_design_prep_states(items, failures)
+        if report_path is not None:
+            _validate_design_prep_requests(data, report_path, items, failures)
+    except (
+        DesignSurfaceError,
+        DesignPrepError,
+        KeyError,
+        TypeError,
+        ValueError,
+    ) as exc:
+        failures.append(
+            f"final-report data.json: design-preparation contract is malformed: {exc}"
+        )
+    except Exception as exc:  # noqa: BLE001
+        failures.append(
+            "final-report data.json: design-preparation validation failed closed "
+            f"on malformed input: {exc}"
+        )
+    return warnings
+
+
+# A `subject` this short or shaped like a bare `P-Opt-1` id is a placeholder,
+# not the plain-language "what this item is" label §5.5.9 renders as a heading.
+_MIN_SUBJECT_LEN = 3
+
+
+_BARE_PLAN_ITEM_ID_RE = re.compile(
+    r"^P-(?:Opt|Step|Dep|Val|Rb|Req)-\d+$", re.IGNORECASE
+)
+
+
+def _validate_plan_item_subject_substance(data: dict, failures: list[str]) -> None:
+    """H2 follow-up — `planItems[].subject` must be a real label, not a
+    placeholder. The schema only enforces non-empty, so `"x"` or a copied
+    `P-Opt-1` id would otherwise slip through and defeat the whole point of the
+    subject (letting a reader see *what* each AGREE/DISAGREE is about).
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        item_id = str(item.get("id") or "").strip()
+        subject = str(item.get("subject") or "").strip()
+        if (
+            len(subject) < _MIN_SUBJECT_LEN
+            or subject == item_id
+            or _BARE_PLAN_ITEM_ID_RE.match(subject)
+        ):
+            failures.append(
+                f"final-report data.json: plan item `{item_id or '<unknown>'}` has a "
+                f"placeholder subject `{subject}`. Give a plain-language label of "
+                "what the item is (e.g. 'Option A: upload v2 를 신규 모듈로 분리') so "
+                "the §5.5.9 reader knows what each verdict is about "
+                "(plan-body-verification.md Plan-item extraction)."
+            )
+
+
+def _validate_plan_body_clarification_matching(
+    data: dict,
+    failures: list[str],
+    accepted_item_ids: set[str] | None = None,
+) -> None:
+    """H5 — every plan item whose *gate class after stage scope* is
+    `majority-disagree` must point at an existing `blocks: approval`
+    clarification row. Observed / deferred / record items stay in `setAside`
+    and must not become a new C row — that is what grew the clarification
+    list while the next stage was already executable.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    # `gating=false` 는 이 라운드를 자문으로 돌린다 — plan-body-verification.md
+    # "If `false`, the round is advisory-only and never blocks approval".
+    # 게이트 계산은 이미 그것을 존중한다(`_recompute_plan_body_gate`,
+    # `_gate_blocking_causes`). 이 검사만 그 상태를 안 보면 자문 라운드가
+    # 승인 차단 행을 강제하게 되어, 막지 않기로 한 판정이 다시 막는다.
+    if pbv.get("gating") is False and not requires_plan_repair(pbv):
+        return
+    accepted = (
+        _resolved_noncritical_dissent_ids(data)
+        if accepted_item_ids is None
+        else accepted_item_ids
+    )
+    clar_rows = [
+        r for r in (data.get("clarificationItems") or []) if isinstance(r, dict)
+    ]
+    all_ids = {r.get("id") for r in clar_rows if r.get("id")}
+    approval_ids = {
+        r.get("id") for r in clar_rows if r.get("blocks") == "approval" and r.get("id")
+    }
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        if _plan_item_gate_class(item, pbv, accepted) != "majority-disagree":
+            continue
+        item_id = item.get("id") or "<unknown>"
+        cids = _plan_item_clarification_ids(item)
+        if not cids:
+            failures.append(
+                f"final-report data.json: plan item `{item_id}` is majority-disagree "
+                "but carries no `clarificationRefs`. A blocking disagreement MUST "
+                "surface as a `## 1. Clarification Items` row (blocks=approval) so "
+                "the user sees the blocker (implementation-planning.md self-review "
+                "step 12). Report assembly derives this link from the activity "
+                "ledger's `clarificationRefs[]` + `planItemIds[]`, so record the "
+                "decision through `okstra approval-decision` rather than editing "
+                "the report."
+            )
+            continue
+        for cid in sorted(cids - approval_ids):
+            reason = (
+                "references a non-existent §1 row"
+                if cid not in all_ids
+                else "references a §1 row whose `blocks` is not `approval`"
+            )
+            failures.append(
+                f"final-report data.json: plan item `{item_id}` (majority-disagree) "
+                f"has clarificationRefs entry `{cid}` which {reason}. Every "
+                "majority-disagree item MUST reach a `blocks: approval` "
+                "Clarification row."
+            )
+
+
+def _validate_self_fix_before_clarification(data: dict, failures: list[str]) -> None:
+    """A planner-fixable defect MUST exhaust the self-fix budget before it is
+    promoted to a `## 1. Clarification Items` row. Closes the hole where the
+    lead dumps a fixable plan defect (abbreviated path, prose command,
+    placeholder, coverage remap) onto the user instead of having report-writer
+    correct it (plan-body-verification.md "Self-fix round").
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    # `gating=false` 는 이 라운드를 자문으로 돌린다 — plan-body-verification.md
+    # "If `false`, the round is advisory-only and never blocks approval" 이고
+    # 같은 행이 "does not run the self-fix loop" 라고 못박는다.
+    #
+    # 이 검사가 그 상태를 안 보면 `_validate_advisory_plan_body_gating` 과 정면
+    # 충돌한다: 그쪽은 `gating=false` 에서 `selfFixRoundsApplied > 0` 을 실패로
+    # 잡는데 이 검사는 `>= 1` 을 요구한다. 한 필드에 반대 방향 요구가 걸리므로
+    # 자문 라운드에 planner-fixable 과반 반대가 하나라도 나오면 통과 가능한
+    # 값이 없다. `okstra plan-items complete-round` 도 자문 라운드의 self-fix
+    # 기록을 거부하므로(plan_items_cli.py) 우회로도 없다.
+    if pbv.get("gating") is False and not requires_plan_repair(pbv):
+        return
+    if _self_fix_budget_exhausted(pbv):
+        return
+    rounds_applied = pbv.get("selfFixRoundsApplied")
+    stop_reason = pbv.get("selfFixStopReason")
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        if _plan_item_gate_class(item, pbv, set()) != "majority-disagree":
+            continue
+        if _has_planner_fixable_majority(item):
+            allowed = " / ".join(sorted(_SELF_FIX_EXHAUSTED_REASONS))
+            failures.append(
+                "final-report data.json: plan item "
+                f"`{item.get('id') or '<unknown>'}` is majority-disagree with a "
+                f"planner-fixable majority but the self-fix budget is not "
+                f"exhausted (`selfFixRoundsApplied`={rounds_applied!r}, "
+                f"`selfFixStopReason`={stop_reason!r}; need >=1 rounds and a stop "
+                f"reason of {allowed}). A planner-fixable defect MUST be corrected "
+                "by report-writer self-fix rounds until the budget runs out or a "
+                "round makes no progress, before it becomes a clarification row "
+                "(plan-body-verification.md Self-fix round)."
+            )
+
+
+# Allowed `fixability` values, mirroring the schema enum
+# (schemas/final-report-v2.0.schema.json planItems[].verdicts[].fixability).
+_FIXABILITY_VALUES = frozenset({"planner-fixable", "needs-user-input"})
+
+
+def _validate_disagree_has_fixability(data: dict, failures: list[str]) -> None:
+    """Every `DISAGREE` verdict MUST carry a valid `fixability`
+    (`planner-fixable` / `needs-user-input`). The schema enum only constrains a
+    *present* value; it does not require the field, so a DISAGREE with a missing
+    or mislabelled fixability is schema-valid. That silently degrades
+    `_validate_self_fix_before_clarification`, which counts a non-`planner-fixable`
+    DISAGREE as non-fixable and thus lets a genuinely planner-fixable defect
+    skip the self-fix round and land on the user. This is the enforcement point
+    for the "fixability is DISAGREE-only 필수" MUST in plan-body-verification.md.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        item_id = item.get("id") or "<unknown>"
+        for verdict in item.get("verdicts") or []:
+            if not isinstance(verdict, dict):
+                continue
+            if str(verdict.get("verdict") or "").upper() != "DISAGREE":
+                continue
+            fixability = verdict.get("fixability")
+            if fixability not in _FIXABILITY_VALUES:
+                worker = verdict.get("worker") or "<worker>"
+                allowed = " / ".join(sorted(_FIXABILITY_VALUES))
+                failures.append(
+                    f"final-report data.json: plan item `{item_id}` has a "
+                    f"`DISAGREE` verdict from `{worker}` with "
+                    f"fixability `{fixability}` — a DISAGREE MUST declare a "
+                    f"fixability of {allowed}. A missing/invalid value is "
+                    "counted as non-fixable and lets a planner-fixable defect "
+                    "skip the self-fix round (plan-body-verification.md "
+                    '"fixability (DISAGREE 전용, 필수)").'
+                )
+
+
+def validate_plan_body_section(
+    data: dict,
+    report_path: Path,
+    failures: list[str],
+) -> list[str]:
+    """Run every §5.5.9 plan-body check and return the advisory warnings.
+
+    Grouped into one callable so the round protocol can run the same checks at
+    each round boundary that the full run validation runs at the end. Before
+    this seam existed the only way to reach them was a finished report plus all
+    four manifests, so a lead computing the gate by hand mid-loop had nothing to
+    check itself against until Phase 7 — and a whole self-fix budget could be
+    spent against a mis-scored gate.
+    """
+    pbv = (data.get("implementationPlanning") or {}).get("planBodyVerification") or {}
+    accepted_item_ids = _resolved_noncritical_dissent_ids(data)
+    _validate_plan_body_gate_recompute(data, failures, accepted_item_ids)
+    _validate_gate_blocked_by(data, failures, accepted_item_ids)
+    _validate_participating_analysers(data, failures)
+    _validate_self_fix_grouping(data, failures)
+    _validate_plan_body_verdict_provenance(data, report_path, failures)
+    _validate_aborted_gate_has_clarification(data, failures)
+    _validate_round_recorded_verdicts(data, failures)
+    _validate_verdicts_match_current_subjects(data, failures)
+    _validate_verdict_rounds_outlive_self_fix(data, failures)
+    _validate_unresolved_tie_was_reverified(data, failures)
+    _validate_advisory_plan_body_gating(data, failures)
+    _validate_plan_item_extraction_completeness(data, failures)
+    _validate_plan_item_subject_substance(data, failures)
+    _validate_plan_body_clarification_matching(data, failures, accepted_item_ids)
+    _validate_disagree_has_fixability(data, failures)
+    _validate_self_fix_before_clarification(data, failures)
+    return [*_detect_self_fix_recurrence(pbv), *_detect_uniform_verifier(pbv)]
+
+
+def _gate_summary_item(
+    item: dict,
+    pbv: dict,
+    accepted_item_ids: set[str],
+) -> dict:
+    """One `gate.items[]` row: the gate class plus its state-file counterpart."""
+    classification = _plan_item_gate_class(item, pbv, accepted_item_ids)
+    return {
+        "id": item.get("id"),
+        "classification": classification,
+        "stateClassification": _state_classification(item, classification),
+        "correctnessCritical": _is_correctness_critical(item),
+        "decisionAuthority": _plan_item_decision_authority(item, pbv),
+        "leadDecisionApplied": _lead_decision_applies(item, pbv),
+        # 왜 안 막는지가 기록에 남아야 한다. 이 값이 없으면 범위 밖 강등과
+        # 실제 합의가 산출물에서 같은 모양으로 읽힌다.
+        "stageScope": _stage_scope_bucket(item, pbv),
+        "block": str(item.get("block") or "execution"),
+    }
+
+
+def plan_body_gate_summary(data: dict) -> dict | None:
+    """The §5.5.9 gate as the round protocol's step 5 needs it — per-item
+    classification, the whole-gate value, and the `gateBlockedBy` causes, all
+    recomputed from `planItems[].verdicts`. Returns ``None`` when the report
+    carries no plan items to judge.
+
+    This is what a lead records instead of tallying the verdicts by hand: the
+    single-vote-blocking kinds, the advisory-only kinds and the P-Var / P-Rb
+    exemptions are one implementation here, not a rule to be re-derived per
+    round from the prompt's prose.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return None
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return None
+    accepted_item_ids = _resolved_noncritical_dissent_ids(data)
+    recomputed = _recompute_plan_body_gate(pbv, accepted_item_ids)
+    if recomputed is None:
+        return None
+    items = [
+        _gate_summary_item(item, pbv, accepted_item_ids)
+        for item in (pbv.get("planItems") or [])
+        if isinstance(item, dict)
+    ]
+    coverage_blockers = _independent_coverage_blockers(ip, pbv)
+    return {
+        "declared": pbv.get("gateResult"),
+        "recomputed": recomputed,
+        "declaredBlockedBy": sorted(
+            str(c) for c in (pbv.get("gateBlockedBy") or []) if isinstance(c, str)
+        ),
+        "blockedBy": sorted(
+            _gate_blocking_causes(pbv, coverage_blockers, accepted_item_ids)
+        ),
+        "coverageBlockers": coverage_blockers,
+        "setAside": _set_aside_register(pbv, accepted_item_ids),
+        "blockingItems": [
+            item["id"]
+            for item in items
+            if item["classification"] == "majority-disagree"
+        ],
+        "items": items,
+    }
+
+
+_COVERED_BY_ANCHOR_RE = re.compile(r"option|stage|step", re.IGNORECASE)
+
+
+_COVERED_BY_STAGE_REF_RE = re.compile(r"stage\s*(\d+)", re.IGNORECASE)
+
+
+_COVERED_BY_VAGUE = {"recommended option", "the recommended option", "recommended"}
+
+
+_DEVIATION_DECISION_REF_RE = re.compile(r"^(C-\d{3,}|D-\d{4,})$")
+
+
+_DEVIATION_BLOCKED_DISPOSITION_RE = re.compile(r"^blocked (C-\d{3,})$")
+
+
+def _deviation_target(
+    ref: str,
+    clarifications: dict,
+    decisions: dict,
+    carried: dict,
+) -> dict | None:
+    if ref.startswith("C-"):
+        row = clarifications.get(ref) or carried.get(ref)
+        return row if isinstance(row, dict) else None
+    row = decisions.get(ref)
+    return row if isinstance(row, dict) else None
+
+
+def _deviation_is_user_confirmed(
+    ref: str,
+    clarifications: dict,
+    carried: dict,
+) -> bool:
+    row = clarifications.get(ref)
+    if (
+        isinstance(row, dict)
+        and row.get("status") in {"answered", "resolved"}
+        and str(row.get("userInput") or "").strip()
+    ):
+        return True
+    carried_row = carried.get(ref)
+    if not isinstance(carried_row, dict):
+        return False
+    resolution = carried_row.get("resolutionInput")
+    if isinstance(resolution, dict) and str(resolution.get("userText") or "").strip():
+        return True
+    return bool(str(carried_row.get("userConfirmation") or "").strip())
+
+
+def _resolved_deviation_refs(
+    row_id: str,
+    refs: object,
+    clarifications: dict,
+    decisions: dict,
+    failures: list[str],
+    carried: dict | None = None,
+    ledger_ids: set[str] | None = None,
+) -> list[str]:
+    valid_refs: list[str] = []
+    carried_rows = carried or {}
+    known_ledger = ledger_ids or set()
+    for ref in refs if isinstance(refs, list) else []:
+        if not isinstance(ref, str) or not _DEVIATION_DECISION_REF_RE.fullmatch(ref):
+            failures.append(
+                f"final-report data.json: requirementCoverage `{row_id}` has "
+                f"unsupported decisionRef `{ref}`; expected C-NNN or D-NNNN."
+            )
+            continue
+        if (
+            _deviation_target(ref, clarifications, decisions, carried_rows) is None
+            and ref not in known_ledger
+        ):
+            failures.append(
+                f"final-report data.json: requirementCoverage `{row_id}` "
+                f"decisionRef `{ref}` does not exist in this report."
+            )
+            continue
+        valid_refs.append(ref)
+    return valid_refs
+
+
+def _validate_deviation_disposition(
+    row_id: str,
+    disposition: object,
+    refs: list[str],
+    clarifications: dict,
+    failures: list[str],
+    carried: dict | None = None,
+    ledger_ids: set[str] | None = None,
+) -> None:
+    carried_rows = carried or {}
+    known_ledger = ledger_ids or set()
+    if disposition == "accepted":
+        confirmed = any(
+            ref.startswith("C-")
+            and (
+                ref in known_ledger
+                or _deviation_is_user_confirmed(ref, clarifications, carried_rows)
+            )
+            for ref in refs
+        )
+        if not confirmed:
+            failures.append(
+                f"final-report data.json: requirementCoverage `{row_id}` is "
+                "documented-deviation with approvalDisposition `accepted`, but "
+                "none of its decisionRefs is a user-confirmed clarification "
+                "(`status` answered/resolved with non-empty `userInput`)."
+            )
+        return
+    blocked = (
+        _DEVIATION_BLOCKED_DISPOSITION_RE.fullmatch(disposition)
+        if isinstance(disposition, str)
+        else None
+    )
+    if blocked is None:
+        return
+    clarification_id = blocked.group(1)
+    clarification = clarifications.get(clarification_id) or carried_rows.get(
+        clarification_id
+    )
+    if clarification is None:
+        failures.append(
+            f"final-report data.json: requirementCoverage `{row_id}` "
+            f"approvalDisposition references `{clarification_id}`, which does "
+            "not exist in this report."
+        )
+    elif (
+        clarification.get("status") != "open"
+        or clarification.get("blocks") != "approval"
+    ):
+        failures.append(
+            f"final-report data.json: requirementCoverage `{row_id}` "
+            f"approvalDisposition `{disposition}` must point to an open "
+            "clarification with `blocks: approval`."
+        )
+
+
+def _validate_requirement_deviations(
+    data: dict,
+    failures: list[str],
+    *,
+    carried: dict | None = None,
+) -> None:
+    """Require documented deviations to reference real decisions and approval."""
+    planning = data.get("implementationPlanning")
+    if not isinstance(planning, dict):
+        return
+    clarifications = {
+        row.get("id"): row
+        for row in (data.get("clarificationItems") or [])
+        if isinstance(row, dict) and row.get("id")
+    }
+    decisions = {
+        f"D-{row.get('number')}": row
+        for row in (planning.get("decisionDrafts") or [])
+        if isinstance(row, dict) and row.get("number")
+    }
+    carried_rows = carried or {}
+    ledger_ids = {
+        str(entry.get("clarificationId") or "").strip()
+        for entry in (planning.get("supersessionLedger") or [])
+        if isinstance(entry, dict) and str(entry.get("clarificationId") or "").strip()
+    }
+    for row in planning.get("requirementCoverage") or []:
+        if not isinstance(row, dict) or row.get("status") != "documented-deviation":
+            continue
+        row_id = row.get("id") or "<row>"
+        refs = _resolved_deviation_refs(
+            row_id,
+            row.get("decisionRefs"),
+            clarifications,
+            decisions,
+            failures,
+            carried_rows,
+            ledger_ids,
+        )
+        _validate_deviation_disposition(
+            row_id,
+            row.get("approvalDisposition"),
+            refs,
+            clarifications,
+            failures,
+            carried_rows,
+            ledger_ids,
+        )
+
+
+def _validate_requirement_coverage_covered_by(data: dict, failures: list[str]) -> None:
+    """H3 (partial) — a `covered` requirement row's `coveredBy` must name a
+    concrete plan element that actually exists, not the spec-forbidden bare
+    "recommended option" nor a phantom stage. Whether the cited step truly
+    *satisfies* the requirement stays a worker DISAGREE(f) judgment; this closes
+    the coarser hole where `coveredBy` points at nothing real.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    rows = [r for r in (ip.get("requirementCoverage") or []) if isinstance(r, dict)]
+    if not rows:
+        return
+    stage_numbers = {
+        s.get("stage") for s in (ip.get("stages") or []) if isinstance(s, dict)
+    }
+    for row in rows:
+        if row.get("status") != "covered":
+            continue
+        rid = row.get("id") or "<row>"
+        covered = str(row.get("coveredBy") or "").strip()
+        if covered.lower() in _COVERED_BY_VAGUE:
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` is `covered` "
+                f"but coveredBy is just `{covered}`. Name the specific Option "
+                "Candidate and Stage/Step that satisfies it, not 'recommended "
+                "option' (profile Requirement Coverage)."
+            )
+            continue
+        if not _COVERED_BY_ANCHOR_RE.search(covered):
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` coveredBy "
+                f"`{covered}` names no Option / Stage / Step. A `covered` row must "
+                "cite the concrete plan element that satisfies the requirement."
+            )
+            continue
+        phantom = [
+            n
+            for m in _COVERED_BY_STAGE_REF_RE.finditer(covered)
+            if stage_numbers and (n := int(m.group(1))) not in stage_numbers
+        ]
+        if phantom:
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` coveredBy "
+                f"cites Stage {phantom[0]} which does not exist in the Stage Map. "
+                "A coverage row must point at a real stage."
+            )
+
+
+def _planning_conformance_declarations(
+    stages: object,
+    failures: list[str],
+) -> list[dict]:
+    declarations: list[dict] = []
+    for stage in stages if isinstance(stages, list) else []:
+        if (
+            not isinstance(stage, dict)
+            or not str(stage.get("conformanceTests") or "").strip()
+        ):
+            continue
+        parsed = _parse_conformance_tests(stage.get("conformanceTests"))
+        if parsed is None:
+            failures.append(
+                "final-report data.json: stage "
+                f"{stage.get('stage')} has malformed conformanceTests "
+                f"declaration: got {str(stage.get('conformanceTests'))!r}; "
+                "expected `<task_root>/qa/scripts/stage-<N>.<ext> "
+                "(requires=[db|io|http|external,...])`."
+            )
+            continue
+        script, requires = parsed
+        declarations.append(
+            {
+                "stageKey": f"approved-plan-stage-{stage.get('stage')}",
+                "script": script,
+                "requires": sorted(requires),
+            }
+        )
+    return declarations
+
+
+def _implemented_stages(data_path: Path) -> frozenset[int]:
+    """이 태스크에서 구현이 끝난 stage. 원장을 못 읽으면 빈 집합이다."""
+    from okstra_ctl.consumers import read_stage_consumer_state
+
+    try:
+        state = read_stage_consumer_state(data_path.parent.parent)
+    except (OSError, UnicodeError, ValueError):
+        return frozenset()
+    return frozenset(state.done_stages)
+
+
+def _is_implemented_stage(stage: object, implemented: frozenset[int]) -> bool:
+    number = stage.get("stage") if isinstance(stage, dict) else None
+    return (
+        isinstance(number, int)
+        and not isinstance(number, bool)
+        and (number in implemented)
+    )
+
+
+def _validate_planning_conformance_declared(
+    report_path: Path,
+    failures: list[str],
+    surface_patterns: object = None,
+) -> None:
+    """계획 단계는 `Conformance tests:` / `Conformance exemption:` 선언 형식을 본다.
+
+    스크립트 파일과 `runCommand` 는 매칭 implementation stage 가 만든다.
+    선언만 있고 파일이 없는 것은 계획 게이트 실패가 아니다. 형식이 깨진
+    `conformanceTests` 는 여전히 실패한다.
+
+    면제 stage 의 `plannedPaths` 가 db/io/http/external 표면을 건드리면 여기서
+    막는다 — 구현 게이트의 diff-surface 대조(`_validate_conformance_surfaces`)와
+    같은 패턴이다. 종전에는 그 대조가 구현이 끝난 뒤에만 돌아, 승인된 계획을
+    고칠 수 없는 자리에서 run 전체가 막혔다(2026-09-09 dev-10784 Stage 2).
+    """
+    data_path = _data_path_for(report_path)
+    if not data_path.is_file():
+        return
+    try:
+        data = load_owned_object(data_path, artifact="planning report")
+    except JsonBoundaryError:
+        return
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    # 구현이 끝난 stage 는 이 게이트의 대상이 아니다. 그 본문은 다음 계획 run 에
+    # 그대로 이월되고(ADR-0015), 이월된 본문은 고칠 수 없다 — 규칙이 그 사이에
+    # 넓어졌다면 통과 가능한 값이 없는 요구가 된다(2026-09-24, dev-10860: 이월된
+    # stage 2·3·5 가 오늘의 표면 패턴으로 `requires` 누락 판정).
+    implemented = _implemented_stages(data_path)
+    stages = [
+        stage
+        for stage in ip.get("stages") or ()
+        if not _is_implemented_stage(stage, implemented)
+    ]
+    _planning_conformance_declarations(stages, failures)
+    if ip.get("planningContract") != "selected-direction":
+        from okstra_ctl.implementation_direction import (
+            stage_validation_executability_errors,
+        )
+
+        failures.extend(stage_validation_executability_errors(ip))
+    for conflict in exempt_stage_surface_conflicts(data, surface_patterns):
+        if conflict["stage"] in implemented:
+            continue
+        failures.append(
+            "conformance gate BLOCKING: stage "
+            f"{conflict['stage']} declares `Conformance exemption:` but its "
+            f"planned paths touch surface(s) {conflict['surfaces']}: "
+            f"{', '.join(conflict['paths'])} — an exemption cannot hide a "
+            "db/io/http/external change (prompts/profiles/implementation-planning.md "
+            '"Per-stage conformance declaration"); declare `Conformance tests:` '
+            f"with requires={conflict['surfaces']} for that stage, or move those "
+            "paths out of it. The implementation run's diff-surface check "
+            "blocks the same stage after the work is done, where the approved "
+            "plan can no longer be corrected."
+        )
+    for gap in declared_stage_surface_gaps(data, surface_patterns):
+        if gap["stage"] in implemented:
+            continue
+        failures.append(
+            "conformance gate BLOCKING: stage "
+            f"{gap['stage']} declares `Conformance tests:` with "
+            f"requires={gap['requires']} but its planned paths touch surface(s) "
+            f"{gap['surfaces']}: {', '.join(gap['paths'])} — add "
+            f"{gap['surfaces']} to that stage's `requires`, or move those paths "
+            "out of it. The implementation run's diff-surface check demands "
+            "the wider set after the work is done, where the approved plan can "
+            "no longer be corrected."
+        )
+
+
+def _is_activity_contract_v1_planning(run_manifest: dict) -> bool:
+    return (
+        run_manifest.get("activityContractVersion") == 1
+        and run_manifest.get("taskType") == "implementation-planning"
+    )
+
+
+def _validate_approval_context(
+    data: dict,
+    run_manifest: dict,
+    failures: list[str],
+) -> None:
+    """활동 계약 v1 계획 run 의 승인 검사를 v3 경로로 넘긴다.
+
+    v2 전용 본문은 삭제했다. 같은 요구를 조립 시점의 `report_assembly.py` /
+    `approval_decisions.py` 가 이미 거부하고, 새 run 은 전부 schemaVersion 3.0
+    이라 v2 갈래에 도달하는 값이 없었다.
+    """
+    if not _is_activity_contract_v1_planning(run_manifest):
+        return
+    if data.get("schemaVersion") == "3.0":
+        _validate_v3_approval_context(data, failures)
+
+
+def _validate_v3_approval_context(data: dict, failures: list[str]) -> None:
+    """승인 플래그가 아직 진행을 막는 행과 공존하지 못하게 한다.
+
+    backlinks / dispositions / resolution-link 대조 세 갈래는 뺐다. 셋 다
+    조립(`report_assembly.py`, `approval_decisions.py`)이 같은 입력으로 만든
+    값을 같은 식으로 되계산하는 항등식이라 조립을 우회하지 않는 한 걸릴 값이
+    없다.
+    """
+    approved = (data.get("frontmatter") or {}).get("approved") is True
+    incorporated = incorporated_clarification_ids(data)
+    for row in data.get("clarificationItems") or []:
+        if not isinstance(row, dict) or row.get("blocks") != "approval":
+            continue
+        # `approvalContext` 없는 행을 건너뛰는 것은 이전과 같은 범위다. 여기서
+        # 범위를 넓히면 삭제한 세 갈래가 막던 행이 새 차단으로 되살아난다.
+        if not isinstance(row.get("approvalContext"), dict):
+            continue
+        row_id = str(row.get("id") or "")
+        if approved and row_blocks_progress(
+            str(row.get("status") or ""),
+            clarification_disposition(row),
+            incorporated=row_id in incorporated,
+        ):
+            failures.append(
+                f"final-report data.json: approval is true while clarification "
+                f"`{row.get('id')}` remains `{row.get('status')}`."
+            )
+
+
+_CHECKLIST_REF_RE = re.compile(r"VC-\d+")
+
+
+def _detect_missing_dependency_precondition(
+    data: dict, project_root: Path
+) -> list[str]:
+    """A stage that runs the toolchain must point at a declared precondition.
+
+    The planning worktree installs no dependencies, so `yarn … test` cannot run
+    there. A plan that says nothing about it produces steps whose commands die
+    on `exit 127`, and the verification round then spends itself on a defect the
+    planner cannot fix by editing the plan.
+
+    The shape checked is the one an observed self-fix loop arrived at after two
+    rounds: one `phase: pre` checklist item declaring the install, referenced by
+    every stage that needs it. Only the reference is machine-checked — whether
+    the cited item genuinely covers dependencies is a semantic judgement left to
+    the §5.5.9 round, the same boundary the scope-provenance gate draws.
+    """
+    planning = data.get("implementationPlanning")
+    if not isinstance(planning, dict):
+        return []
+    tokens = resolve_build_tool_tokens(project_root)
+    if not tokens:
+        return []
+
+    checklist = {
+        str(row.get("id")): str(row.get("phase") or "")
+        for row in (planning.get("validationChecklist") or [])
+        if isinstance(row, dict) and row.get("id")
+    }
+
+    warnings: list[str] = []
+    for stage in planning.get("stages") or []:
+        if not isinstance(stage, dict):
+            continue
+        commands = [
+            str(step.get("command") or "")
+            for step in (stage.get("stepwiseExecution") or [])
+            if isinstance(step, dict)
+        ]
+        if not any(command_invokes_build_tool(c, tokens=tokens) for c in commands):
+            continue
+        refs = _CHECKLIST_REF_RE.findall(str(stage.get("stageValidation") or ""))
+        if not refs:
+            warnings.append(
+                f"Stage {stage.get('stage')} runs the project toolchain but its "
+                "Stage Validation cites no `VC-NNN` precondition. The planning "
+                "worktree has no dependencies installed, so declare the install "
+                "once as a `phase: pre` Validation Checklist item and reference "
+                "it here."
+            )
+            continue
+        if not any(checklist.get(ref) == "pre" for ref in refs):
+            cited = ", ".join(sorted(set(refs)))
+            warnings.append(
+                f"Stage {stage.get('stage')} runs the project toolchain and cites "
+                f"{cited}, but none of those is a `phase: pre` Validation "
+                "Checklist item — a precondition verified after the fact is not a "
+                "precondition."
+            )
+    return warnings
+
+
+_UNMAPPED_FALLBACK_REASON = "no impacted stages resolved"
+
+
+def _prior_planning_data(report_path: Path) -> dict | None:
+    """The newest implementation-planning data.json preceding *report_path*."""
+    match = re.search(r"-(\d+)\.md$", report_path.name)
+    if not match:
+        return None
+    current_seq = int(match.group(1))
+    candidates = sorted(
+        (
+            path
+            for path in report_path.parent.glob(
+                "final-report-implementation-planning-*.data.json"
+            )
+            if (m := re.search(r"-(\d+)\.data\.json$", path.name))
+            and int(m.group(1)) < current_seq
+        ),
+        key=lambda p: p.name,
+    )
+    for path in reversed(candidates):
+        try:
+            payload = load_owned_object(path, artifact="prior planning report")
+        except JsonBoundaryError:
+            continue
+        return payload
+    return None
+
+
+def _detect_unmapped_incremental_fallback(data: dict, report_path: Path) -> list[str]:
+    """A re-run that fell back to full while the prior report could have mapped it.
+
+    Both "the answer restructures the plan" and "no stage could be resolved"
+    return `mode: full`, and only the second is a missed narrowing. The lead
+    declares the first through `--full-reason`, so the reason prefix separates
+    them; this reports the second only when the trace would have succeeded.
+
+    Advisory: a lead that never passed `--full-reason` produces the fallback
+    reason for both cases, so failing here would punish runs written before the
+    flag existed.
+    """
+    planning = data.get("implementationPlanning")
+    if not isinstance(planning, dict):
+        return []
+    decision = planning.get("incrementalDecision")
+    if not isinstance(decision, dict) or decision.get("mode") != "full":
+        return []
+    if _UNMAPPED_FALLBACK_REASON not in str(decision.get("reason") or ""):
+        return []
+
+    answered = _answered_clarification_ids(data)
+    if not answered:
+        return []
+    prior = _prior_planning_data(report_path)
+    if prior is None:
+        return []
+
+    try:
+        from okstra_ctl.incremental_scope import clarification_impacted_stages
+
+        stages = clarification_impacted_stages(prior, set(answered))
+    except (ImportError, ValueError):
+        return []
+    if not stages:
+        return []
+    return [
+        "incrementalDecision fell back to full for lack of a resolved stage, but "
+        f"the prior report maps {', '.join(sorted(answered))} to stage(s) "
+        f"{', '.join(str(s) for s in sorted(stages))}. Pass the answered ids "
+        "through `--answered-clarifications` so the re-run narrows, or declare "
+        "the structural change with `--full-reason` when full is the judgement."
+    ]
+
+
+_PLAN_BODY_STATE_KEYS = ("schemaVersion", "planItems", "roundHistory")
+
+
+def _validate_plan_body_state_file(
+    data: dict,
+    report_path: Path,
+    failures: list[str],
+    state_path: Path | None = None,
+) -> None:
+    """The per-round state file must exist once a round has run.
+
+    Nothing read this file, so its documented schema was dead contract — yet
+    it is the only record of *superseded* rounds. `planItems[].verdicts` in
+    data.json is overwritten by each self-fix re-verification, so after the
+    loop the report shows the final votes and no trace of what the earlier
+    rounds found. Both defect investigations of this phase depended on the
+    sidecar to recover that history.
+
+    Deliberately does NOT cross-check any gate against data.json: the two are
+    different views by design (per-round history vs. final state), and
+    demanding equality would fail every run whose self-fix loop worked.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    state_dir = report_path.parent.parent / "state"
+    if state_path is not None:
+        # 호출자가 경로를 넘겼으면 그걸 본다. 리드는 launch 프롬프트의
+        # `Run Paths` 에서 정본 경로를 받으므로, 여기서 이름을 다시 만들면
+        # 그 정본과 어긋날 수 있다 — 실제로 그랬다.
+        written = [state_path] if state_path.is_file() else []
+    else:
+        # 이름을 유도할 근거가 없다. run 은 seq 계열을 둘 갖고(`state` /
+        # `reports`) 리포트 정본은 자기 run 의 state seq 를 담지 않으므로,
+        # 리포트 seq 로 만든 이름은 추측이다. 이 검사가 묻는 것은 "덮어써진
+        # 라운드의 기록이 남았는가" 이지 파일 이름이 아니므로, 이 run 의 상태
+        # 디렉터리에 사이드카가 있는지만 본다. 이름의 정본은 `paths.py` 다.
+        written = sorted(
+            state_dir.glob("plan-body-verification-implementation-planning-*.json")
+        )
+    if not written:
+        failures.append(
+            f"plan-body verification ran ({round_count} round(s)) but no "
+            f"`state/plan-body-verification-*.json` was written. It is the only "
+            "record of superseded rounds — data.json keeps just the final "
+            "verdicts, so without it a self-fixed run leaves no trace of what "
+            'the earlier rounds found (plan-body-verification.md §"schema"). '
+            "The path is rendered into the launch prompt's `Run Paths` block; "
+            "write it there rather than deriving a name."
+        )
+        return
+    # 여럿이면 가장 최신(seq 가 큰) 것이 이 run 의 것이다.
+    expected = written[-1]
+    try:
+        state = load_owned_object(expected, artifact="plan-body verification state")
+    except JsonBoundaryError as exc:
+        failures.append(f"plan-body verification state file is unreadable: {exc}")
+        return
+    missing = [key for key in _PLAN_BODY_STATE_KEYS if key not in state]
+    for key in missing:
+        failures.append(
+            f"plan-body verification state file `{expected.name}` is "
+            f"missing required key `{key}`."
+        )
+    if not missing:
+        _validate_plan_body_state_rounds(
+            state, pbv, expected.name, round_count, failures
+        )
+
+
+def _validate_plan_body_state_rounds(
+    state: dict,
+    pbv: dict,
+    name: str,
+    round_count: int,
+    failures: list[str],
+) -> None:
+    """Every round that ran must survive in the sidecar, its votes included.
+
+    The round protocol used to write this file once, before the self-fix loop,
+    and never asked for it again — so a run with three re-verifications kept
+    round 1 only, and the superseded rounds this file exists to preserve were
+    exactly the ones it dropped (jobs dev-10269 seq 001: `roundCount` 4 in
+    data.json against `round` 1 here).
+    """
+    history = [e for e in (state.get("roundHistory") or []) if isinstance(e, dict)]
+    # A non-int `round` names no round, so it cannot cover one — and reading it
+    # into a set would abort the whole validation on unhashable lead-authored JSON.
+    recorded = {e["round"] for e in history if isinstance(e.get("round"), int)}
+    if recorded != set(range(1, round_count + 1)):
+        seen = sorted(recorded)
+        failures.append(
+            f"plan-body verification state file `{name}` records `roundHistory[]` "
+            f"rounds {seen} but the report declares `roundCount`={round_count}. "
+            f"One entry per round 1..{round_count} is required: data.json keeps "
+            "only the final verdicts, so a sidecar frozen at an earlier round "
+            "loses every round it superseded (plan-body-verification.md "
+            '§"Round protocol" step 7 "Round completion").'
+        )
+    gateless = [str(e.get("round")) for e in history if not e.get("gateResult")]
+    if gateless:
+        failures.append(
+            f"plan-body verification state file `{name}`: `roundHistory[]` "
+            f"round(s) {', '.join(gateless)} carry no `gateResult`. The per-round "
+            "gate is what tells the reader which round blocked and on what, and "
+            "the sidecar is the only place it survives."
+        )
+    declared = pbv.get("selfFixRoundsApplied")
+    if isinstance(declared, int) and state.get("selfFixRoundsApplied") != declared:
+        failures.append(
+            f"plan-body verification state file `{name}` records "
+            f"`selfFixRoundsApplied`={state.get('selfFixRoundsApplied')!r} but the "
+            f"report declares {declared}. The sidecar is rewritten at each round's "
+            "end, so a stale count means the later rounds were never written to it."
+        )
+    voted = {
+        vote["round"]
+        for item in (state.get("planItems") or [])
+        if isinstance(item, dict)
+        for vote in (item.get("rounds") or [])
+        if isinstance(vote, dict) and isinstance(vote.get("round"), int)
+    }
+    uncited = [
+        n for n in sorted(recorded & set(range(1, round_count + 1))) if n not in voted
+    ]
+    if uncited:
+        failures.append(
+            f"plan-body verification state file `{name}`: round(s) {uncited} "
+            "appear in `roundHistory[]` but no `planItems[].rounds[]` entry "
+            "records a vote cast in them. A re-verification round whose verdicts "
+            "were never written down is precisely the history this file holds."
+        )