okstra 0.209.5 → 0.210.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.209.5",
+  "version": "0.210.0",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.209.5",
-  "builtAt": "2026-10-05T07:34:52.243Z",
+  "package": "0.210.0",
+  "builtAt": "2026-10-05T13:33:31.081Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/wizard/prompts.ko.json

@@ -354,16 +354,17 @@
         "mark_done": "[완료]",
         "mark_active": "[진행중]",
         "mark_ready": "[준비됨]",
-        "mark_blocked": "[대기]"
+        "mark_blocked": "[대기]",
+        "mark_cancelled": "[취소됨]"
       },
       "errors": {
         "none_selected": "stage 를 하나 이상 선택하세요.",
         "whole_task_impl": "전체 task 검증은 final-verification 에서만 선택할 수 있습니다.",
         "all_exclusive": "'전체' 는 단독으로만 선택할 수 있습니다.",
-        "nothing_selectable": "선택 가능한 stage 가 없습니다 (모두 완료/진행중).",
+        "nothing_selectable": "선택 가능한 stage 가 없습니다 (모두 완료/진행중/취소됨).",
         "bad_number": "stage 번호가 올바르지 않습니다: {answer}",
         "unknown_stage": "Stage Map 에 없는 stage 입니다: {bad}",
-        "occupied": "이미 완료/진행중인 stage 는 선택할 수 없습니다: {bad}"
+        "occupied": "이미 완료/진행중이거나 취소된 stage 는 선택할 수 없습니다: {bad}"
       },
       "echo_variants": {
         "plain": "stages: {stages}",

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -535,9 +535,13 @@ def _stage_ledger_block(stage_ledger_json: str) -> list[str]:
         "",
         "`stages` lists every stage the latest plan declares, so every number",
         "in it is taken. Never reuse or renumber one: a new stage takes the",
-        "next number after the highest listed here, and reworking a completed",
-        "stage means cancelling it and adding a new number, never editing it",
-        "in place. The new plan declares every stage listed here as well as the",
+        "next number after the highest listed here. Changing a `done` stage's",
+        "work means keeping it and adding a correction stage with a new number,",
+        "never editing it in place. Only a `ready` or `blocked` stage may be",
+        "cancelled: keep its row and body where they are and set its",
+        "`stageMap[]` row's `status` to `cancelled`. A `done` or `active` stage",
+        "is never cancelled, and no remaining stage may depend on a cancelled",
+        "one. The new plan declares every stage listed here as well as the",
         "ones it adds — its rows run 1..N with no gap — because a plan whose",
         "rows start above 1 is refused by every consumer that parses a Stage",
         "Map. `sourcePlan` is the plan the completed stages were built",

package/runtime/python/okstra_ctl/incremental_scope.py

@@ -102,8 +102,17 @@ def _parse_depends_on(cell: str) -> list[int]:
 
 
 def parse_stage_graph(data: dict) -> list[tuple[int, list[int]]]:
+    """재검증·이월 대상이 될 수 있는 stage 그래프 — 취소 행은 뺀다.
+
+    취소 stage 는 다시 계획되지도 이월되지도 않는다. 세면 컷오프 분모가 부풀어
+    좁혀야 할 재실행이 증분으로 남거나, 지목할 수 없는 번호가 선택지에 오른다.
+    """
     stage_map = data.get("implementationPlanning", {}).get("stageMap", [])
-    return [(int(row["stage"]), _parse_depends_on(row.get("dependsOn", ""))) for row in stage_map]
+    return [
+        (int(row["stage"]), _parse_depends_on(row.get("dependsOn", "")))
+        for row in stage_map
+        if row.get("status") != "cancelled"
+    ]
 
 
 def design_prep_impacted_stages(data: dict, item_ids: set[str]) -> set[int]:
@@ -363,7 +372,7 @@ def decide_scope(
         )
     all_stages = {num for num, _ in stages}
     closure = downstream_stage_closure(stages, set(impacted_stages))
-    if len(closure) * 2 > len(all_stages):
+    if len(closure) > cutoff_ratio * len(all_stages):
         return IncrementalDecision(
             "full", [], [],
             f"the answers reach {len(closure)} of the plan's {len(all_stages)} stages — "

package/runtime/python/okstra_ctl/phases/final_verification/target.py

@@ -24,6 +24,7 @@ from okstra_ctl.locks import worktree_provision_mutex
 from okstra_ctl.plan_run_root import plan_run_root_from_approved_plan
 from okstra_ctl.prepare_error import PrepareError
 from okstra_ctl.stage_integrate import IntegrateResult
+from okstra_ctl.stage_map import active_stage_records
 from okstra_ctl.stage_reconcile import auto_reconcile_best_effort
 from okstra_ctl.stage_targets import (
     FinalVerificationTarget,
@@ -274,6 +275,10 @@ def acquire_final_verification_target(
             slugify(request.task_group),
             slugify(request.task_id),
         ):
+            # 취소된 stage 는 완료를 요구받지 않고 통합·tip 선택에서도 빠진다.
+            request = replace(
+                request, stage_map=tuple(active_stage_records(request.stage_map)),
+            )
             registry_coordinates = _final_verification_registry_coordinates(request)
             done_rows = _read_final_verification_done_rows(
                 request,

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-executor.md

@@ -89,7 +89,7 @@ template's check; that template is gone.
   ```
 
   The file MUST NOT exist before the run starts (overwrite is refused — see `--force-stage` non-goal). **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` fails a run that declares `stageSidecarEvidence` without the file on disk. Transcribing the JSON into the report is not the same as writing it: `consumers` treats the carry file as the source of truth for marking the stage `done`, so a missing file leaves the stage permanently incomplete and blocks every dependent stage with a `PrepareError` — while this run reports success.
-- **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work — whatever it writes (a baseline capture, build logs) goes under `<task_root>/qa/output/`, the one qa directory besides `qa/scripts/` your attempt may write — but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
+- **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work — a baseline capture or `--compare` target goes under `<task_root>/qa/baseline/` and anything else it writes (build logs, measurements) under `<task_root>/qa/output/`, the only qa directories besides `qa/scripts/` your attempt may write — but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
 - **An external Tier 3 non-PASS does NOT withhold the carry evidence.** A Tier 3 entry whose `requires` include `http`, `external`, or `db` is advisory. Its FAIL, MISSING, no result, startup failure, or credential / network / service absence gets recorded honestly — exact command, exit code, output tail, marked `ADVISORY` in `Validation evidence` — and you emit the carry evidence anyway. Only Tier 1 and Tier 2 failures withhold it. Withholding on an external result is what actually blocks the stage: the carry file is the only thing that can mark a stage `done`, the verifier re-runs that same command from the host (where a call your sandbox could not complete often passes), and a stage the verifier then PASSes can never be closed because its evidence was never written.
 - **Reverse link (BLOCKING).** The runtime already appended a `status:"started"` row for this stage before the run began. The terminal row belongs to the lead's post-stage persistence and is verdict-gated — `status:"done"` with `carry_path` on a non-`FAIL` verdict, `status:"failed"` on `FAIL` (`_implementation-deliverable.md` §"Lead post-stage persistence").
 - **No PR / push in this phase.** This run produces local commits, carry sidecar evidence, verifier results, and the implementation final report only. Push and PR creation belong exclusively to the later `release-handoff` phase after `final-verification` returns `accepted`.

package/runtime/python/okstra_ctl/phases/implementation/profile.md

@@ -2,7 +2,7 @@
 
 - Purpose: realise the approved `implementation-planning` deliverable as actual source changes, with cross-model verification, while keeping the run reversible
 - **Run-level fixed cost:** the verifier set, Phase 5.5 convergence, and the Phase 6 report-writer run exactly once per implementation run, over this run's single stage diff — never once per step.
-- **Fix run (profile carries a "Fix-Run Carry" block):** the executor's scope is the carried blocking findings plus the previous routing recommendation — it MUST NOT re-execute plan steps the previous run completed. Verifiers apply the "Fix-run incremental scope" section of `_implementation-verifier.md`; the report writer applies "Fix-run incremental authoring" in `report-writer.md`. The full validation-command re-run is NOT reduced.
+- **Fix run (profile carries a "Fix-Run Carry" block):** the executor's scope is the carried blocking findings plus the previous routing recommendation — it MUST NOT re-execute plan steps the previous run completed. Verifiers apply the "Fix-run incremental scope" section of `_implementation-verifier.md`. The full validation-command re-run is NOT reduced.
 - **Executor binding (resolved at run-prep time, fixed for this run):**
   - Executor display name: `{{EXECUTOR_DISPLAY_NAME}}`
   - Executor worker ID: `{{EXECUTOR_WORKER_ID}}`

package/runtime/python/okstra_ctl/phases/implementation/wizard.py

@@ -9,6 +9,7 @@ _STAGE_MARKER_KEYS = {
     "active": "mark_active",
     "ready": "mark_ready",
     "blocked": "mark_blocked",
+    "cancelled": "mark_cancelled",
 }
 
 

package/runtime/python/okstra_ctl/phases/implementation_planning/authoring.py

@@ -1284,7 +1284,8 @@ def _stage_ledger_snapshot(run_manifest: Path | None) -> dict[str, str] | None:
     """`{스테이지 번호: 상태}`. 원장을 못 읽으면 ``None``.
 
     게이트가 범위를 좁히려면 어느 스테이지가 지금 시작 가능한지 알아야 한다. 그
-    사실은 Stage 원장에 있고, 상태 어휘(`done` / `active` / `ready` / `blocked`)는
+    사실은 Stage 원장에 있고, 상태 어휘(`done` / `cancelled` / `active` / `ready` /
+    `blocked`)는
     `stage_targets.StageLifecycle.status` 의 것을 그대로 쓴다 — 원장이 자기 어휘를
     따로 가지면 같은 stage 가 소비처마다 다르게 읽힌다.
 

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -42,9 +42,9 @@ Plan for the actual worktree layout before approval. Shared documentation direct
   - **directive-first ambiguity resolution** (the same rule, pointed at the user instead of the code): any ambiguity the run's directive, the brief, the carried-in `user-responses/` sidecars, or the user's in-session instruction already answers MUST be resolved that way and recorded with the quoted instruction. Writing a clarification row for something the user already decided is the same defect as writing one for something the code already answers — and it costs more, because the row withholds approval until a whole separate answer cycle closes it. When an instruction points at a document, treat every item in that document as decided, including the ones the document itself flagged as needing a decision (shared rule: `_common-contract.md` "User instruction outranks the material it points at").
   - flag any requirement that is ambiguous, contradictory, or missing success criteria — register each one as a row in the report's `## 1. Clarification Items` table with `Blocks=approval` instead of guessing
   - read `<PROJECT_ROOT>/.okstra/glossary.md` and `<PROJECT_ROOT>/.okstra/decisions/` titles if present. Absent okstra memory files are the normal state — do not error. Treat the brief's `terminology:*` resolutions from `requirements-discovery` (if any) as authoritative; if missing, resolve any remaining fuzzy term as a `Blocks=approval` clarification row.
-  - **Stage Ledger (read before drafting the Stage Map):** when this task already has a plan on disk, the analysis packet carries a `## Stage Ledger` JSON block listing every stage with its `status` (`done` / `active` / `ready` / `blocked`), `dependsOn`, and done commit. It states what exists, not what to plan. Two rules follow from it:
+  - **Stage Ledger (read before drafting the Stage Map):** when this task already has a plan on disk, the analysis packet carries a `## Stage Ledger` JSON block listing every stage with its `status` (`done` / `active` / `cancelled` / `ready` / `blocked`), `dependsOn`, and done commit. It states what exists, not what to plan. Two rules follow from it:
     - A stage whose `status` is `done` is already implemented and will not be executed again. Declare it in this report's `stages[]` and `stageMap[]` with its plan body copied forward as written; do not rewrite its steps, and do not fold its work into a new stage. Its plan items are `observed`, not `in-scope` (`okstra_ctl.plan_items.stage_scope_bucket`), so re-declaring it adds no verification load. A carried body is also not re-judged: the planning conformance gate skips a stage the consumer ledger records as `done`, and report assembly issues no design-prep request for one (`okstra_ctl.design_prep.materialize_design_prep_requests`). A rule that widened since that stage shipped cannot be satisfied by a body you are forbidden to rewrite.
-    - Every stage number in the ledger is taken. This report declares every one of them — rows run `1..N` with no gap — and a new stage takes the next number after the highest one listed; numbers are never reused or reordered. A report that declares only its new stages satisfies neither rule and is refused twice over. **Enforced:** `okstra_ctl.stage_map._validate_stage_numbers` rejects the gap in every published plan it parses, so `okstra prepare` refuses the implementation run (`okstra_ctl.run._parse_stage_map_into_ctx`) and the Stage Ledger of every later run reads as `unreadable`; `validators/validate-implementation-plan-stages.py` check **S2** reports the same defect at authoring time. Cancelling a stage you no longer want is not yet expressible — that lands with the plan-amendment feature — so an unstarted stage you drop still keeps its number and body here.
+    - Every stage number in the ledger is taken. This report declares every one of them — rows run `1..N` with no gap — and a new stage takes the next number after the highest one listed; numbers are never reused or reordered. A report that declares only its new stages satisfies neither rule and is refused twice over. **Enforced:** `okstra_ctl.stage_map._validate_stage_numbers` rejects the gap in every published plan it parses, so `okstra prepare` refuses the implementation run (`okstra_ctl.run._parse_stage_map_into_ctx`) and the Stage Ledger of every later run reads as `unreadable`; `validators/validate-implementation-plan-stages.py` check **S2** reports the same defect at authoring time. To drop a stage that has not started — `ready` or `blocked` in the ledger — keep its row and body in place in both `stageMap[]` and `stages[]` and set that `stageMap[]` row's `status` to `cancelled`; its number stays taken, and stage selection, whole-task final-verification, integration and release-handoff skip it. A `done` or `active` stage is never cancelled: to change finished work, keep that stage and add a correction stage numbered after the highest one. No remaining stage may depend on a cancelled one — point it at the stage that replaces it. **Enforced:** `validators/validate-implementation-plan-stages.py` check **S14** rejects a cancelled stage the ledger records `done` or `active` and a dependency on a cancelled stage.
     - The ledger answers two questions from two sources, and the block names both. `sourcePlan` is the plan the completed stages were actually built against; `latestPlan` is the plan the `stages` list came from and is therefore the numbering authority. When they differ, the completed work followed the former and the highest taken number comes from the latter.
     - A `planDivergence` entry means one of two things: the two plans disagree about a stage that is already `done` — the same number naming different work, or a completed stage the latest plan no longer declares — or the plan the completed stages were built against could not be read at all, so that comparison never ran. Both block the same way: do not pick one of the two plans yourself; register it as a `Blocks=approval` clarification row and assign no new stage number until it is resolved. Completed stages built against an *earlier* plan are not a divergence — that is the normal shape of an amended plan and the ledger folds it silently.
     - The block is absent ONLY on a task's first planning run. Its absence then means there is no prior plan, not that no stage is done. When the ledger could not be read, the packet names the source and reason. Continue planning to repair unambiguous dependency notation in the new report, retaining every stage number and title and every completed stage body. Record the original and corrected values with their source. Do not overwrite the prior report or select an older plan. Assign no new stage number until the corrected Stage Map validates; unresolved dependency meaning remains a blocker. The preparation behavior is covered by `tests/run/test_stage_ledger_prepare.py`; preservation of author intent remains a review guideline.
@@ -160,7 +160,7 @@ Plan for the actual worktree layout before approval. Shared documentation direct
         unavailable environment is a user-owned follow-up, never a plan approval or
         later run blocker. `requires=[]` and `requires=[io]` remain blocking.
         Remote IO should also declare `external`.
-      Layout split (not this phase's writes): executable scripts (conformance + any real-IO test) live under `<task_root>/qa/scripts/`; data sidecars (`conformance-manifest.json`, `result-*.json`) stay at the `qa/` root. A step that runs a script writing its own files (a baseline capture, a `--compare` target, build logs) points those paths at `<task_root>/qa/output/`: it is the only other qa directory the implementer's write audit accepts, and any other qa path discards the attempt (`scripts/okstra_ctl/write_policy.py` `_role_qa_artifact_paths`; observed 2026-09-26, dev-11054 stage 1, `qa/baseline/`). The implementer writes the scripts and the manifest entry. Only the implementation verifier writes `result-*.json`, including the result of an earlier stage's entry whose script this stage rewrites, so a step never assigns a result file to the implementer and never lists one in `plannedPaths`. This declaration is enforced at four layers: `validators/validate-implementation-plan-stages.py` check **S11** forces every stage to carry one of the two lines; at the planning boundary `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_planning_conformance_declared` accepts a well-formed `Conformance tests:` line even when the script file and manifest entry are absent (malformed `requires` still fails); the matching `implementation` stage run that inherited `Conformance tests:` fails closed when the script file is missing (`_validate_conformance`); and the manifest JSON structure — including each entry's `script` living under `qa/scripts/` and a `runCommand` that does not change cwd — is enforced by `validate_conformance_manifest` when the implementer writes the entry.
+      Layout split (not this phase's writes): executable scripts (conformance + any real-IO test) live under `<task_root>/qa/scripts/`; data sidecars (`conformance-manifest.json`, `result-*.json`) stay at the `qa/` root. A step that captures a baseline or a `--compare` target points it at `<task_root>/qa/baseline/`; anything else a script writes on every run (build logs, measurements, captured responses) goes under `<task_root>/qa/output/`. These are the only other qa directories the implementer's write audit accepts, and any other qa path discards the attempt (`scripts/okstra_ctl/write_policy.py` `_role_qa_artifact_paths`). The split matters at final verification: the verifier re-runs every Tier 3 script and may rewrite `qa/output/`, but `qa/baseline/` must stay byte-identical (`_inherited_qa_evidence`), so a baseline written under `qa/output/` is not protected. The implementer writes the scripts and the manifest entry. Only the implementation verifier writes `result-*.json`, including the result of an earlier stage's entry whose script this stage rewrites, so a step never assigns a result file to the implementer and never lists one in `plannedPaths`. This declaration is enforced at four layers: `validators/validate-implementation-plan-stages.py` check **S11** forces every stage to carry one of the two lines; at the planning boundary `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_planning_conformance_declared` accepts a well-formed `Conformance tests:` line even when the script file and manifest entry are absent (malformed `requires` still fails); the matching `implementation` stage run that inherited `Conformance tests:` fails closed when the script file is missing (`_validate_conformance`); and the manifest JSON structure — including each entry's `script` living under `qa/scripts/` and a `runCommand` that does not change cwd — is enforced by `validate_conformance_manifest` when the implementer writes the entry.
     - `### Stage Exit Contract` — predicted added/modified files, newly exposed identifiers/types/endpoints, downstream-usable resources.
     - `### Stage Validation` — pre / mid / post exact commands or observable outcomes for this stage only.
       - **Run-executable only (BLOCKING).** A `validationChecklist` row that carries `stageRefs` gates that stage's carry, so it MUST be executable by the implementation run itself — no deployment, no manual walk-through, no observation "by hand", no credentials the run does not hold. The implementation phase forbids deploys and holds no deploy credentials, so such a row can never pass and blocks a stage with zero code defects (observed: dev-10341 VC-013/VC-014). Manual or deployed-environment verification belongs in the brief's `External Gates` and final-verification's user-owned external QA — record it there without `stageRefs`. **Enforced:** `okstra_ctl.implementation_direction.validate_selected_direction_plan` (`stage_validation_executability_errors`) rejects stage-gating rows whose observation text requires a manual or deployed-environment step.

package/runtime/python/okstra_ctl/phases/implementation_planning/report_assets/implementation-planning-input.template.md

@@ -127,7 +127,7 @@ Enforced: `scripts/okstra_ctl/run.py` `_validate_approved_plan` reads that front
 
 ## Stage Output Shape (reference)
 
-**Enforced:** `validators/validate-implementation-plan-stages.py` fails a plan missing `## 5.5 Stage Map` and checks each `## 5.5.<i> Stage <i>` section against it (S1–S13).
+**Enforced:** `validators/validate-implementation-plan-stages.py` fails a plan missing `## 5.5 Stage Map` and checks each `## 5.5.<i> Stage <i>` section against it (S1–S14).
 
 This run's final report MUST emit `## 5.5 Stage Map` and `## 5.5.<i> Stage <i>` sections per the implementation-planning profile §"Required deliverable shape". Two illustrative Stage Map tables:
 

package/runtime/python/okstra_ctl/phases/release_handoff/operations.py

@@ -58,6 +58,12 @@ def _run_git(args: List[str], cwd, check: bool = True) -> subprocess.CompletedPr
 
 
 def _require_eligible(stage_map, rows, stages) -> Dict[int, Dict[str, Any]]:
+    cancelled = sorted(
+        s["stage_number"] for s in stage_map
+        if s.get("cancelled") and s["stage_number"] in stages)
+    if cancelled:
+        raise HandoffError(
+            f"stages cancelled in the approved plan have no PR: {cancelled}")
     elig = {e["stage"]: e for e in compute_eligibility(stage_map, rows)}
     unknown = [n for n in stages if n not in elig]
     if unknown:

package/runtime/python/okstra_ctl/plan_items.py

@@ -396,6 +396,8 @@ def expected_plan_item_ids(implementation_planning: Mapping[str, Any]) -> list[s
 
 
 _STARTABLE_STATUSES = frozenset({"ready", "active"})
+# 다시 실행되지 않는 stage. 그 항목은 관찰만 하고 착수를 막지 않는다.
+_FROZEN_STATUSES = frozenset({"done", "cancelled"})
 
 # 계획 전체를 판정하는 항목. 스테이지 하나를 고쳐도 요청하지 않은 작업이
 # 들어왔는지 다시 봐야 한다. P-Val / P-Req / P-Rb 는 여기 넣지 않는다 —
@@ -454,7 +456,7 @@ def stage_scope_bucket(
     statuses = {str(ledger.get(str(stage)) or "") for stage in stages}
     if statuses & _STARTABLE_STATUSES:
         return "in-scope"
-    return "observed" if "done" in statuses else "deferred"
+    return "observed" if statuses & _FROZEN_STATUSES else "deferred"
 
 
 def _depends_on(value: object) -> tuple[int, ...]:
@@ -504,15 +506,30 @@ def _planning_stage_rows(planning: Mapping[str, Any]) -> list[tuple[int, tuple[i
     return rows
 
 
+def _cancelled_stage_numbers(planning: Mapping[str, Any]) -> set[int]:
+    stage_map = planning.get("stageMap")
+    if not isinstance(stage_map, list):
+        return set()
+    return {
+        row["stage"] for row in stage_map
+        if isinstance(row, Mapping)
+        and isinstance(row.get("stage"), int)
+        and row.get("status") == "cancelled"
+    }
+
+
 def planning_stage_ledger(
     planning: Mapping[str, Any],
     disk_status: Mapping[str, str] | None = None,
 ) -> dict[str, str]:
-    """지금 계획의 스테이지를 ``done`` / ``active`` / ``ready`` / ``blocked`` 로.
+    """지금 계획의 스테이지를 ``done`` / ``active`` / ``cancelled`` / ``ready`` /
+    ``blocked`` 로.
 
     디스크 원장은 이미 구현된 것만 안다. 첫 계획 run 에는 원장이 없어서
     게이트가 전 항목을 in-scope 로 읽었다. 이 함수는 현재 계획의 depends-on 으로
-    그 빈칸을 채운다. 디스크에 ``done`` / ``active`` 가 있으면 그쪽이 이긴다.
+    그 빈칸을 채운다. 디스크에 ``done`` / ``active`` 가 있으면 그쪽이 이긴다 —
+    그런 stage 를 계획이 취소했다면 그것은 검증기(S14)가 거부할 결함이고, 원장은
+    실제 상태를 그대로 보여야 한다.
     """
     recorded = {
         key: value
@@ -520,6 +537,7 @@ def planning_stage_ledger(
         if value in {"done", "active", "ready", "blocked"}
     }
     done = {key for key, value in recorded.items() if value == "done"}
+    cancelled = _cancelled_stage_numbers(planning)
     ledger: dict[str, str] = {}
     for number, depends in _planning_stage_rows(planning):
         key = str(number)
@@ -527,6 +545,9 @@ def planning_stage_ledger(
         if status in {"done", "active"}:
             ledger[key] = status
             continue
+        if number in cancelled:
+            ledger[key] = "cancelled"
+            continue
         ready = all(str(dep) in done for dep in depends)
         ledger[key] = "ready" if ready else "blocked"
     return ledger

package/runtime/python/okstra_ctl/stage_close.py

@@ -132,6 +132,16 @@ def close_stage(
             f"stage {stage} is not in this task's Stage Map (has {known or 'none'})",
             stage="stage-map",
         )
+    if any(
+        isinstance(row, dict) and row.get("stage_number") == stage
+        and row.get("cancelled")
+        for row in stage_map.stages
+    ):
+        raise StateError(
+            f"stage {stage} is cancelled in this task's latest plan — a cancelled "
+            "stage is never done; close the stage that replaces it instead",
+            stage="stage-map",
+        )
 
     recorded = last_lifecycle_status_by_stage(read_consumers(plan_run_root))
     if recorded.get(stage) in _SETTLED:
@@ -183,8 +193,9 @@ _CLI_EPILOG = r"""Usage:
 Records the `done` row an implementation run would have written, for a stage
 whose work is already committed but which never registered as done (the run
 ended before writing its carry sidecar). Refuses unless the Stage Map has that
-stage, no `done`/`failed` row exists for it, `--from-commit` resolves to a
-commit in the project repo, and the stage's conformance gate permits progress.
+stage and does not mark it cancelled, no `done`/`failed` row exists for it,
+`--from-commit` resolves to a commit in the project repo, and the stage's
+conformance gate permits progress.
 
 Output: JSON { ok, taskKey, taskRoot, stage, headCommit, conformance,
 consumersPath }. Exit 1 on a refusal (the reason names what to do), 2 when

package/runtime/python/okstra_ctl/stage_map.py

@@ -41,6 +41,7 @@ class StageMapStage:
     depends_on: tuple[int, ...]
     step_count: int
     exit_contract_summary: str
+    cancelled: bool = False
 
 
 @dataclass(frozen=True)
@@ -356,9 +357,27 @@ def _parse_data_stage_map_row(
         parse_stage_dependencies(depends_on, row_number, source_plan_path),
         step_count,
         exit_summary,
+        stage_row_is_cancelled(value, row_number, source_plan_path),
     )
 
 
+STAGE_STATUSES = ("active", "cancelled")
+
+
+def stage_row_is_cancelled(
+    value: dict[str, Any], row_number: int, source_plan_path: str = "",
+) -> bool:
+    """구조화 Stage Map 행의 `status`. 없으면 active 다."""
+    status = value.get("status", "active")
+    if status not in STAGE_STATUSES:
+        raise StageMapError(
+            "stage_map",
+            f"structured Stage Map row {row_number} has invalid status {status!r}",
+            source_plan_path,
+        )
+    return status == "cancelled"
+
+
 def _parse_schema_v2_stage_map(
     data: dict[str, Any], source_plan_path: str,
 ) -> list[StageMapStage]:
@@ -493,11 +512,17 @@ def stage_map_records(stages: Iterable[StageMapStage]) -> list[dict[str, Any]]:
             "depends_on": list(stage.depends_on),
             "step_count": stage.step_count,
             "exit_contract_summary": stage.exit_contract_summary,
+            "cancelled": stage.cancelled,
         }
         for stage in stages
     ]
 
 
+def active_stage_records(records: Iterable[dict[str, Any]]) -> list[dict[str, Any]]:
+    """취소되지 않은 stage 기록 — 통합·whole-task 게이트·handoff 가 순회하는 집합."""
+    return [record for record in records if not record.get("cancelled")]
+
+
 def _latest_plan_report(task_root: Path) -> Path | None:
     reports_dir = RunRef.from_task_root(
         task_root, "implementation-planning"

package/runtime/python/okstra_ctl/stage_map_cli.py

@@ -30,8 +30,9 @@ _CLI_EPILOG = r"""Usage:
 
 Output: default and --json emit JSON { ok, taskKey, taskRoot, state, sourcePlanPath,
 stages:[…], doneStages:[int], planning:{…} }; --text emits fixed count/name/value fields.
-Each stage row carries stage_number, title, depends_on, step_count and exit_contract_summary; a
-schema-v2 report adds that stage's sliceValue, acceptance and exitContract.
+Each stage row carries stage_number, title, depends_on, step_count, exit_contract_summary and
+cancelled (true for a row the plan marks `status: cancelled`); a schema-v2 report adds that
+stage's sliceValue, acceptance and exitContract.
 planning carries the report's task-level rows — rollbackStrategy, validationChecklist,
 crossProjectDependencies, dependencyMigrationRisk, recommendedOption — so a consumer renders the
 plan instead of re-summarising the report body. Both are absent for a schema-v1 report.

package/runtime/python/okstra_ctl/stage_targets.py

@@ -53,10 +53,12 @@ class StageLifecycle:
     step_count: int
     deps_satisfied: bool
     blocked_by: list[int]
+    cancelled: bool = False
 
     @property
     def status(self) -> str:
-        """Lifecycle state, in precedence order: done > active > ready > blocked.
+        """Lifecycle state, in precedence order:
+        done > cancelled > active > ready > blocked.
 
         ``started`` and ``reserved`` collapse into ``active`` because every
         caller that distinguishes them already words the two the same way (see
@@ -64,6 +66,8 @@ class StageLifecycle:
         """
         if self.done:
             return "done"
+        if self.cancelled:
+            return "cancelled"
         if self.started or self.reserved:
             return "active"
         return "ready" if self.deps_satisfied else "blocked"
@@ -171,6 +175,11 @@ class StageLifecycleSnapshot:
             raise StageTargetError(
                 f"--stage {n} already completed (consumers.jsonl status:done exists)"
             )
+        if lifecycle.status == "cancelled":
+            raise StageTargetError(
+                f"--stage {n} is cancelled in the approved plan's Stage Map; "
+                "it is never executed — run the stage that replaces it"
+            )
         if lifecycle.status == "active":
             # Wording is load-bearing: okstra-run's unattended chain matches it
             # to terminate normally instead of raising an exception gate.
@@ -183,8 +192,8 @@ class StageLifecycleSnapshot:
         blocked = [lc for lc in self.lifecycles if lc.status == "blocked"]
         if not blocked:
             return (
-                "no stage is ready: every stage is done or occupied by "
-                "another run"
+                "no stage is ready: every stage is done, cancelled, or "
+                "occupied by another run"
             )
         detail = "; ".join(
             f"stage {lc.stage} blocked by "
@@ -203,6 +212,7 @@ class StageLifecycleSnapshot:
         return [
             lifecycle.handoff_eligibility_record()
             for lifecycle in self.lifecycles
+            if lifecycle.status != "cancelled"
         ]
 
 
@@ -242,6 +252,7 @@ def stage_lifecycle_snapshot_from_state(
             pr_covered=stage_number in consumer_state.pr_covered_stages,
             head_commit=str(done_row.get("head_commit") or ""),
             report_path=str(done_row.get("report_path") or ""),
+            cancelled=bool(stage.get("cancelled")),
         ))
     return StageLifecycleSnapshot(
         stage_map=stage_map,
@@ -710,8 +721,11 @@ def _resolve_and_integrate_whole_task_unlocked(
     """Integrate and resolve a whole-task target while the caller owns the lock."""
     from .consumers import latest_done_by_stage
     from .stage_integrate import IntegrateError, integrate_stages
+    from .stage_map import active_stage_records
     from .worktree import _git, is_dirty_excluding_okstra
 
+    stage_map = active_stage_records(stage_map)
+
     # 끝나지 않은 stage 가 있으면 _resolve_whole_task_target 이 어차피 거부한다.
     # 그 전에 끝난 stage 를 머지해 두면 거부된 요청이 task worktree 에 머지를
     # 남긴다(되돌리지 않는다). 머지하기 전에 같은 조건으로 거부한다.

package/runtime/python/okstra_ctl/wizard/sources.py

@@ -231,7 +231,8 @@ def _stage_lifecycle_snapshot(
     return read_stage_lifecycle_snapshot(
         [{"stage_number": s.stage_number,
           "depends_on": list(s.depends_on),
-          "step_count": s.step_count} for s in stages],
+          "step_count": s.step_count,
+          "cancelled": s.cancelled} for s in stages],
         Path(state.approved_plan_path).resolve().parents[1],
         recover_from_carry=False,
         reserved_stages=reserved_stages,

package/runtime/python/okstra_ctl/wizard/steps_plan.py

@@ -249,7 +249,9 @@ def _whole_task_allowed(
     if done is None:
         done = _stage_lifecycle_snapshot(state, stages).done_stages
     return whole_task_verification_allowed(
-        stage_numbers=tuple(stage.stage_number for stage in stages),
+        stage_numbers=tuple(
+            stage.stage_number for stage in stages if not stage.cancelled
+        ),
         done_stages=done,
     )
 
@@ -468,7 +470,7 @@ def _submit_impl_stage_pick(state: WizardState, answer: str) -> Optional[str]:
         state, stages, reserved_stages=_reserved_stage_numbers(state))
     done = snapshot.done_stages
     occupied = {lc.stage for lc in snapshot.lifecycles
-                if lc.status in ("done", "active")}
+                if lc.status in ("done", "active", "cancelled")}
     chosen = _impl_chosen_stages(t, picks, answer, all_nums, occupied)
     ordered = order_stage_closure(
         [(s.stage_number, s.depends_on) for s in stages], chosen, done)

package/runtime/python/okstra_ctl/write_policy.py

@@ -101,8 +101,10 @@ def _role_qa_artifact_paths(role: str, task_root: Path | None) -> tuple[Path, ..
     `qa/scripts/`, plus the manifest entry naming them
     (`_implementation-executor.md` §"Stage conformance script", §"Real-IO test
     isolation"), plus `qa/output/` for whatever those scripts write when the
-    executor runs them against its own work — a baseline capture, build logs
-    (§"Verifier gates are not yours to run" lets it run them). Everything else
+    executor runs them against its own work — build logs, measurements
+    (§"Verifier gates are not yours to run" lets it run them) — and
+    `qa/baseline/` for a captured baseline or `--compare` target, which the
+    final verifier must not rewrite. Everything else
     under `qa/` — the self-mock sidecar and its diff, the conformance run's
     `result-*.json` — is written while the verifier runs its own gates.
     Keeping the executor's grant to those three entries is
@@ -124,6 +126,7 @@ def _role_qa_artifact_paths(role: str, task_root: Path | None) -> tuple[Path, ..
         return (
             task_qa_dir(task_root) / "scripts",
             task_qa_dir(task_root) / "output",
+            task_qa_dir(task_root) / "baseline",
             task_conformance_manifest_file(task_root),
         )
     if role == "verifier":
@@ -154,7 +157,9 @@ def _inherited_qa_evidence(
     baseline overwrote the implementation's RED evidence and still passed the
     audit (observed 2026-09-26, dev-11054 `qa/baseline/base.json`). New files and
     the conformance results it re-runs (`qa/result-<stageKey>.json`, the only qa
-    write `final_verification/boundary.json` names) stay writable.
+    write `final_verification/boundary.json` names) stay writable, and so does
+    `qa/output/`: the Tier 3 scripts it must re-run rewrite their own outputs
+    there (dev-11127 final-verification); baselines live in `qa/baseline/`.
     """
     if role != "verifier" or task_type != "final-verification" or task_root is None:
         return ()
@@ -165,9 +170,11 @@ def _inherited_qa_evidence(
         conformance_result_file(qa_dir, key)
         for key in _conformance_stage_keys(task_root)
     }
+    regenerated = qa_dir / "output"
     return tuple(sorted(
         path for path in qa_dir.rglob("*")
         if path.is_file() and not path.is_symlink() and path not in rerun
+        and not path.is_relative_to(regenerated)
     ))
 
 

package/runtime/schemas/final-report-v3.0.schema.json

@@ -8158,6 +8158,13 @@
         "exitContractSummary": {
           "type": "string",
           "minLength": 1
+        },
+        "status": {
+          "enum": [
+            "active",
+            "cancelled"
+          ],
+          "description": "Absent means active. A cancelled stage keeps its row and number so the Stage Map still runs 1..N; execution, gates and handoff skip it. Only a stage that has not started may be cancelled."
         }
       }
     },

package/runtime/validators/validate-implementation-plan-stages.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""S1–S13 checks for the Stage Map structure of an approved
+"""S1–S14 checks for the Stage Map structure of an approved
 implementation-planning final-report.md. Run from prepare_task_bundle
 of `implementation` task or standalone."""
 
@@ -35,6 +35,7 @@ from okstra_ctl.stage_map import (  # noqa: E402
     parse_stage_map_text,
     schema_v2_report,
     stage_number_gap_message,
+    stage_row_is_cancelled,
 )
 
 HARD_STEP_CAP = 8
@@ -68,9 +69,14 @@ BARE_GIT_STATUS = re.compile(r"\bgit\b[^&|;]*?\bstatus\b[^&|;]*?--(?:porcelain|s
 CLEAN_GATE_COMMAND = "okstra worktree-status --check-clean"
 
 
+# S14 — 취소 stage 가 될 수 없는 상태. 이미 착수했거나 끝난 stage 는 통합 기준선의
+# 일부라 취소하면 그 위에 쌓인 브랜치와 갈라진다(ADR-0015); 고치려면 max+1 보정 stage.
+_UNCANCELLABLE_STATUSES = ("done", "active")
+
+
 @dataclass
 class ValidationError:
-    code: str   # S1..S13
+    code: str   # S1..S14
     stage: int  # 0 = global
     message: str
 
@@ -380,13 +386,19 @@ def _check_conformance_declaration(
     return errs
 
 
-def _check_depends_on(stages: List[StageMapStage]) -> List[ValidationError]:
+def _check_depends_on(
+    stages: List[StageMapStage], cancelled: frozenset[int] = frozenset(),
+) -> List[ValidationError]:
     errs: List[ValidationError] = []
     valid = {s.stage_number for s in stages}
     for s in stages:
         for d in s.depends_on:
             if d == s.stage_number:
                 errs.append(ValidationError("S8", s.stage_number, "self depends-on"))
+            elif d in cancelled:
+                errs.append(ValidationError("S14", s.stage_number,
+                    f"depends-on {d}, which this plan cancels — a cancelled stage "
+                    "is never executed; depend on the stage that replaces it"))
             elif d not in valid:
                 errs.append(ValidationError("S6", s.stage_number,
                     f"depends-on {d} does not exist"))
@@ -495,6 +507,7 @@ def _data_stage_metas(
             depends = parse_stage_dependencies(
                 str(row.get("dependsOn") or ""), row_number, ""
             )
+            cancelled = stage_row_is_cancelled(row, row_number)
         except StageMapError as exc:
             errors.append(ValidationError("S2", row["stage"], exc.reason))
             continue
@@ -504,6 +517,7 @@ def _data_stage_metas(
             depends,
             row.get("stepCount") if isinstance(row.get("stepCount"), int) else -1,
             str(row.get("exitContractSummary") or ""),
+            cancelled,
         ))
     return rows, errors or _stage_numbers_monotonic(rows)
 
@@ -670,6 +684,28 @@ def _check_data_stage_identities(
     return errs
 
 
+def _check_cancelled_stage_ledger(
+    stage_map: List[StageMapStage], planning: dict,
+) -> List[ValidationError]:
+    """S14: 원장이 이미 착수했거나 끝났다고 기록한 stage 는 취소할 수 없다."""
+    verification = planning.get("planBodyVerification")
+    ledger = (
+        verification.get("stageLedger") if isinstance(verification, dict) else None
+    )
+    if not isinstance(ledger, dict):
+        return []
+    return [
+        ValidationError("S14", meta.stage_number,
+            f"stage {meta.stage_number} is cancelled but the Stage Ledger records "
+            f"it {ledger[str(meta.stage_number)]!r}; only a ready or blocked stage "
+            "may be cancelled — keep it and add a correction stage numbered after "
+            "the highest stage instead")
+        for meta in stage_map
+        if meta.cancelled
+        and ledger.get(str(meta.stage_number)) in _UNCANCELLABLE_STATUSES
+    ]
+
+
 def collect_data_validation_errors(
     planning: dict, user_bypassed: frozenset[int] = frozenset(),
 ) -> List[ValidationError]:
@@ -703,14 +739,19 @@ def collect_data_validation_errors(
     if identity_errors:
         return errors
     errors.extend(_check_data_step_counts(stage_map, stages))
-    errors.extend(_check_depends_on(stage_map))
+    # 번호(S2)·대응(S3)·스텝 수는 모든 행에, 의존(S6/S8)·병렬 안전(S9)은 실행될
+    # 행에만 건다 — 취소 stage 와 그 대체 stage 는 같은 파일을 예측하기 마련이다.
+    active = [meta for meta in stage_map if not meta.cancelled]
+    cancelled = frozenset(meta.stage_number for meta in stage_map if meta.cancelled)
+    errors.extend(_check_depends_on(active, cancelled))
+    errors.extend(_check_cancelled_stage_ledger(stage_map, planning))
     errors.extend(_report_shared_parallel_files({
         meta.stage_number: set(PATH_TOKEN.findall(
             str((next(
                 (s for s in stages if s.get("stage") == meta.stage_number), {}
             )).get("exitContract") or "")
         ))
-        for meta in stage_map
+        for meta in active
         if not meta.depends_on
     }))
     for stage in stages: