okstra 0.209.6 → 0.211.0

package/docs/cli.md

@@ -868,8 +868,8 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra migrate [--apply] [--cwd <dir>] [--quiet]` | One-time migration of the project artifact root from `.project-docs/okstra/` to `.okstra/`. It is a dry run by default; `--apply` performs the move with `git mv` in a Git worktree, removes an empty `.project-docs/`, and synchronizes the `<PROJECT>/CLAUDE.md` import line, `.gitignore`, the project's rows in `~/.okstra/{recent,active}.jsonl`, and `~/.okstra/worktrees/registry.json`. It exits 1 if `.okstra/` already exists or the legacy directory is absent. Scheduled for removal by the end of v0.x |
 | `okstra task-list [--project-root <path>]` | Combine `list_project_tasks` and `read_latest_task` into JSON containing the task catalog and latest task |
 | `okstra task-show <task-key> [--project-root <path>]` | Summarize workflow, phase, status, and artifacts from the Task Read-Side Snapshot |
-| `okstra stage-map <task-key> [--cwd <dir>\|--project <dir>]` | Dump the task's implementation-planning Stage Map as JSON: `{ ok, taskKey, taskRoot, state, sourcePlanPath, stages:[{stage_number,title,depends_on,step_count}], doneStages:[int] }`. `sourcePlanPath` is the task's latest implementation-planning report — the authority on which stages exist, so a plan amendment's added stages are selectable as soon as the amended plan lands. `state` is `ready` for a resolved source and `missing` when no Stage Map exists; a corrupt source returns a structured non-zero error instead of silently selecting another report. `doneStages` is read from the implementation-planning stage consumer state (with carry recovery). This is the read-side source `/okstra-schedule-gen [task-group]` uses to derive selectable unfinished stages and their completed dependency closure |
-| `okstra stage-close <task-key> --stage <N> --from-commit <sha> [--cwd <dir>\|--project <dir>]` | Record the `done` stage-consumer row an implementation run would have written, for a stage whose work is already committed but which never registered as done — the run ended before writing its carry sidecar, and `backfill_done_from_carry` recovers only from that file. Without it `stage-map` reports `doneStages: []` while the branch carries the commit, the next plan re-describes the stage, and every RED expectation it produces is unreachable. Refuses unless the Stage Map has that stage, no `done`/`failed` row exists for it, `--from-commit` resolves to a commit in the project repo, and the stage's conformance gate permits progress — the same `decide_conformance_gate` the run validator uses, so a stage closed here is not one the validator would have blocked. Closing also moves the `stage-<N>-exit` tag and releases the stage reservation, exactly as a normal stage completion does. Emits `{ ok, taskKey, taskRoot, stage, headCommit, conformance, consumersPath }` |
+| `okstra stage-map <task-key> [--cwd <dir>\|--project <dir>]` | Dump the task's implementation-planning Stage Map as JSON: `{ ok, taskKey, taskRoot, state, sourcePlanPath, stages:[{stage_number,title,depends_on,step_count,cancelled}], doneStages:[int] }`. Each stage row carries `cancelled: true` when the plan marks that Stage Map row `status: cancelled`; such a stage is never selected, cannot be closed, and is left out of whole-task final verification and release handoff. `sourcePlanPath` is the task's latest implementation-planning report — the authority on which stages exist, so a plan amendment's added stages are selectable as soon as the amended plan lands. `state` is `ready` for a resolved source and `missing` when no Stage Map exists; a corrupt source returns a structured non-zero error instead of silently selecting another report. `doneStages` is read from the implementation-planning stage consumer state (with carry recovery). This is the read-side source `/okstra-schedule-gen [task-group]` uses to derive selectable unfinished stages and their completed dependency closure |
+| `okstra stage-close <task-key> --stage <N> --from-commit <sha> [--cwd <dir>\|--project <dir>]` | Record the `done` stage-consumer row an implementation run would have written, for a stage whose work is already committed but which never registered as done — the run ended before writing its carry sidecar, and `backfill_done_from_carry` recovers only from that file. Without it `stage-map` reports `doneStages: []` while the branch carries the commit, the next plan re-describes the stage, and every RED expectation it produces is unreachable. Refuses unless the Stage Map has that stage and does not mark it cancelled, no `done`/`failed` row exists for it, `--from-commit` resolves to a commit in the project repo, and the stage's conformance gate permits progress — the same `decide_conformance_gate` the run validator uses, so a stage closed here is not one the validator would have blocked. Closing also moves the `stage-<N>-exit` tag and releases the stage reservation, exactly as a normal stage completion does. Emits `{ ok, taskKey, taskRoot, stage, headCommit, conformance, consumersPath }` |
 | `okstra incremental-scope <args…>` | Decide re-verify vs carry-forward scope for an `implementation-planning` clarification re-run. Thin shim into `scripts/okstra_ctl/incremental_scope.py` (deterministic): it reads the dependency graph from the prior run `data.json`'s `implementationPlanning.stageMap` and returns `mode:"incremental"` only when the base-ref SHA is unchanged and the affected stages' `downstream_stage_closure` covers at most half of all stages; `--full-reason` (selected option / Stage Map / approach) still forces `mode:"full"`. An answered `C-NNN` that traces to no stage returns `mode:"unresolved"` rather than full — pass `--impacted` with the stage numbers or `--full-reason`. `--run-manifest <path>` is required for a decision (not for `--preview`): the same decision is written to the record that manifest names in `incrementalDecisionPath`, so the report writer's authoring contract and `okstra incremental-carry` read it instead of CSVs the lead re-typed. `mode: "unresolved"` is a question back to the lead and is deliberately not recorded. `--preview --prev-data <path> --answered-clarifications <csv>` runs the link half alone — no base SHA, no side effects — and prints `{wouldForceFull, unlinkedIds, reason}`; unlinked ids set `wouldForceFull: false` and fill `unlinkedIds` |
 | `okstra incremental-carry <args…>` | Merge carried-forward plan-item verdicts into an incremental re-run. Contract v3 takes `--prev-data`, `--cur-narrative`, and the convergence-owned `--state`; it verifies carried stage rows and writes only `--out-state`, tagging copied verdicts with `carriedForwardFromSeq`. Pass `--decision <incrementalDecisionPath>` for the two stage sets — the same record the report writer's authoring contract was built from — instead of `--carry-stages` / `--reverify-stages`, which the lead re-typed off stdout; the two forms cannot be combined, and a record whose `mode` is not `incremental` is refused. Unchanged `P-Val-*` / `P-Req-*` / `P-Rb-*` rows whose extract hash still matches are carried the same way, and the sibling `plan-items-*.json` `dispatchQueue` is rewritten to match. The historical v2 `--cur-data --out` form remains readable. Ownership, scope, item, or schema drift raises `CarryError` and forces a full fallback. |
 | `okstra code-review target --task-key <k> --stage <N> [--project-root <dir>] [--cwd <dir>] [--json]` / `okstra code-review target --branch <name> [--base <ref>] [--date <YYYY-MM-DD>] [--project-root <dir>] [--cwd <dir>] [--json]` | Resolve what a code review reads and where its result file goes. Output is always JSON, so `--json` only makes that explicit. `--project-root` and `--cwd` are shared pre-dispatch arguments and apply to both modes; `--cwd` is only consulted when `--project-root` is absent. Both modes return `{ ok, projectRoot, mode, worktreePath, branch, baseCommit, headCommit, reviewPath, round }`; stage mode additionally returns `taskKey`, `taskRoot`, and `stage`. Stage mode takes the diff base from the `base_ref` recorded on that stage's worktree-registry row when it was provisioned — not from a rule re-applied at review time — and names the result `.okstra/tasks/<task-group>/<task-id>/code-reviews/stage-<NN>.md`, where a re-review of the same stage becomes `-r2`, `-r3`, … (the `round` field). Only a legacy row provisioned before `base_ref` was recorded falls back to re-deriving the base through `stage_targets`, and a failure there is reported as `stage_base_unresolved`. `worktreePath` comes back empty whenever the stage worktree is not usable as a live checkout — the registry row is no longer `active` (whole-task final-verification released it), the row never carried a path, or the recorded directory is gone — and the review then reads the `branch` ref instead. Branch mode uses `--base` when given, otherwise the merge-base with the default branch (`refs/remotes/origin/HEAD`, else `main`/`master`), and names the result `.project-docs/code-reviews/<branch>/<YYYY-MM-DD>-<NN>.md`, where `<NN>` (the `round` field) is the next sequence number for that date — the highest already on disk plus one. Read-only: it resolves paths and creates no directory and no file, so the review directory does not exist until the caller writes the report. Backend for the okstra-code-review skill |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.209.6",
+  "version": "0.211.0",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.209.6",
-  "builtAt": "2026-10-05T11:18:29.866Z",
+  "package": "0.211.0",
+  "builtAt": "2026-10-06T01:25:20.915Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/wizard/prompts.ko.json

@@ -354,16 +354,17 @@
         "mark_done": "[완료]",
         "mark_active": "[진행중]",
         "mark_ready": "[준비됨]",
-        "mark_blocked": "[대기]"
+        "mark_blocked": "[대기]",
+        "mark_cancelled": "[취소됨]"
       },
       "errors": {
         "none_selected": "stage 를 하나 이상 선택하세요.",
         "whole_task_impl": "전체 task 검증은 final-verification 에서만 선택할 수 있습니다.",
         "all_exclusive": "'전체' 는 단독으로만 선택할 수 있습니다.",
-        "nothing_selectable": "선택 가능한 stage 가 없습니다 (모두 완료/진행중).",
+        "nothing_selectable": "선택 가능한 stage 가 없습니다 (모두 완료/진행중/취소됨).",
         "bad_number": "stage 번호가 올바르지 않습니다: {answer}",
         "unknown_stage": "Stage Map 에 없는 stage 입니다: {bad}",
-        "occupied": "이미 완료/진행중인 stage 는 선택할 수 없습니다: {bad}"
+        "occupied": "이미 완료/진행중이거나 취소된 stage 는 선택할 수 없습니다: {bad}"
       },
       "echo_variants": {
         "plain": "stages: {stages}",
@@ -371,14 +372,14 @@
       }
     },
     "directive_pick": {
-      "label": "추가 directive 가 있나요?",
+      "label": "이번 run 에 덧붙일 추가 지시(directive)를 고르세요. directive 는 instruction-set/directive.txt 로 저장되어 리드와 워커가 읽습니다. 브리프와 이전 리포트에 없는 새 결정(직전 run 이후 정한 사항 등)은 여기에 넣어야 계획에 반영됩니다.",
       "echo_template": "directive(pick): {value}",
       "options": {
         "__skip__": "없음 (건너뛰기)",
         "__free_input__": "직접 입력"
       },
       "labels": {
-        "reuse_last": "이전 run 의 directive 재사용: {snippet}"
+        "reuse_last": "이전 run 의 directive 재사용: {snippet}", "context_file": " — 이 directive 는 파일 {path} 을 읽으라는 지시이고, 그 파일은 {date} 에 마지막으로 바뀌었습니다. 이후 정한 결정은 들어 있지 않습니다", "context_missing": " — 이 directive 가 가리키는 파일 {path} 이 없습니다"
       },
       "echo_suffixes": {
         "reuse": "directive: {value} (재사용)",
@@ -476,7 +477,7 @@
       }
     },
     "reuse_previous": {
-      "label": "이 task·phase 의 직전 run 설정이 남아 있습니다. 그대로 재사용할까요?\n· 예 — 직전 run 의 워커 구성·역할별 모델·directive·관련 task 를 그대로 가져오고, 가장 최근 final-report 를 clarification 입력으로 자동 선택해 바로 확인 단계로 넘어갑니다.\n· 아니오 — 모델/워커/directive 등을 단계별로 다시 입력합니다.",
+      "label": "이 task·phase 의 직전 run 설정이 남아 있습니다. 그대로 재사용할까요?\n· 예 — 직전 run 의 워커 구성·역할별 모델·directive·관련 task 를 가져오고, 가장 최근 final-report 를 clarification 입력으로 자동 선택합니다. 가져온 항목은 다시 묻지 않고, 재사용 대상이 아닌 단계(기준 브랜치·재검증 범위 등)는 이어서 묻습니다.\n· 아니오 — 모델/워커/directive 등을 단계별로 다시 입력합니다.\n재사용할 directive: {directive}\n직전 run 이후 새로 정한 결정이 있으면 이 directive 에 없습니다. 확인 단계의 수정에서 directive_pick 을 고르면 directive 부터 다시 고를 수 있습니다(역할별 모델은 유지).",
       "echo_template": "reuse-previous: {value}",
       "options": {
         "yes": "예 — 직전 설정 그대로 진행",

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -535,9 +535,13 @@ def _stage_ledger_block(stage_ledger_json: str) -> list[str]:
         "",
         "`stages` lists every stage the latest plan declares, so every number",
         "in it is taken. Never reuse or renumber one: a new stage takes the",
-        "next number after the highest listed here, and reworking a completed",
-        "stage means cancelling it and adding a new number, never editing it",
-        "in place. The new plan declares every stage listed here as well as the",
+        "next number after the highest listed here. Changing a `done` stage's",
+        "work means keeping it and adding a correction stage with a new number,",
+        "never editing it in place. Only a `ready` or `blocked` stage may be",
+        "cancelled: keep its row and body where they are and set its",
+        "`stageMap[]` row's `status` to `cancelled`. A `done` or `active` stage",
+        "is never cancelled, and no remaining stage may depend on a cancelled",
+        "one. The new plan declares every stage listed here as well as the",
         "ones it adds — its rows run 1..N with no gap — because a plan whose",
         "rows start above 1 is refused by every consumer that parses a Stage",
         "Map. `sourcePlan` is the plan the completed stages were built",

package/runtime/python/okstra_ctl/incremental_scope.py

@@ -102,8 +102,17 @@ def _parse_depends_on(cell: str) -> list[int]:
 
 
 def parse_stage_graph(data: dict) -> list[tuple[int, list[int]]]:
+    """재검증·이월 대상이 될 수 있는 stage 그래프 — 취소 행은 뺀다.
+
+    취소 stage 는 다시 계획되지도 이월되지도 않는다. 세면 컷오프 분모가 부풀어
+    좁혀야 할 재실행이 증분으로 남거나, 지목할 수 없는 번호가 선택지에 오른다.
+    """
     stage_map = data.get("implementationPlanning", {}).get("stageMap", [])
-    return [(int(row["stage"]), _parse_depends_on(row.get("dependsOn", ""))) for row in stage_map]
+    return [
+        (int(row["stage"]), _parse_depends_on(row.get("dependsOn", "")))
+        for row in stage_map
+        if row.get("status") != "cancelled"
+    ]
 
 
 def design_prep_impacted_stages(data: dict, item_ids: set[str]) -> set[int]:
@@ -363,7 +372,7 @@ def decide_scope(
         )
     all_stages = {num for num, _ in stages}
     closure = downstream_stage_closure(stages, set(impacted_stages))
-    if len(closure) * 2 > len(all_stages):
+    if len(closure) > cutoff_ratio * len(all_stages):
         return IncrementalDecision(
             "full", [], [],
             f"the answers reach {len(closure)} of the plan's {len(all_stages)} stages — "

package/runtime/python/okstra_ctl/manager_launch.py

@@ -7,6 +7,7 @@ from pathlib import Path
 from okstra_ctl.jsonl import append_jsonl, read_jsonl
 
 from .manager_paths import (
+    MANAGER_CONTEXT_DIRECTIVE_PREFIX,
     child_context_path,
     children_json_path,
     directives_jsonl_path,
@@ -244,7 +245,7 @@ def build_launch_packet(
         run_args.extend(["--task-brief", str(child["briefPath"])])
     run_args += [
         "--directive",
-        f"Read manager child context: {context_path}",
+        f"{MANAGER_CONTEXT_DIRECTIVE_PREFIX}{context_path}",
     ]
     packet = {
         "managerId": manager_id,

package/runtime/python/okstra_ctl/manager_paths.py

@@ -118,3 +118,7 @@ def child_context_path(
 
 def view_html_path(home: Path, manager_id: str) -> Path:
     return manager_root(home, manager_id) / "view" / "index.html"
+
+
+# manager 가 자식 run 에 넘기는 directive 의 앞부분. 위저드는 이 접두로 컨텍스트 파일을 찾는다.
+MANAGER_CONTEXT_DIRECTIVE_PREFIX = "Read manager child context: "

package/runtime/python/okstra_ctl/phases/final_verification/target.py

@@ -24,6 +24,7 @@ from okstra_ctl.locks import worktree_provision_mutex
 from okstra_ctl.plan_run_root import plan_run_root_from_approved_plan
 from okstra_ctl.prepare_error import PrepareError
 from okstra_ctl.stage_integrate import IntegrateResult
+from okstra_ctl.stage_map import active_stage_records
 from okstra_ctl.stage_reconcile import auto_reconcile_best_effort
 from okstra_ctl.stage_targets import (
     FinalVerificationTarget,
@@ -274,6 +275,10 @@ def acquire_final_verification_target(
             slugify(request.task_group),
             slugify(request.task_id),
         ):
+            # 취소된 stage 는 완료를 요구받지 않고 통합·tip 선택에서도 빠진다.
+            request = replace(
+                request, stage_map=tuple(active_stage_records(request.stage_map)),
+            )
             registry_coordinates = _final_verification_registry_coordinates(request)
             done_rows = _read_final_verification_done_rows(
                 request,

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md

@@ -12,11 +12,12 @@ are collected and convergence finished. Phase 1-5 do not need it.
 
 - **Plan link & approval evidence**: path to the approved `final-report.md`, the exact quoted approval marker, AND the executed stage number / title quoted from the Stage Map row. For a selected-direction plan, also quote `selectedDirectionRef.optionId`, `snapshotPath`, and the validated snapshot digest; for a legacy plan, quote the effective `implementation-option` or the Recommended Option fallback.
 - **Commit list**: each commit's SHA (or short SHA), message, and the plan step(s) / TDD cycle it satisfies
-- **Diff summary**: capture `git diff --stat <base>..<captured-head>` and `git diff --numstat <base>..<captured-head>` for the full implementation stage, including after a fix run. Supply both outputs to the report writer; populate each `diffSummary.files[].lines` with its added/deleted counts and a one-line change summary. Do not substitute a fix-run aggregate or carry forward older statistics. If the captured commits are unavailable, identify the missing reference in the evidence instead of inventing counts.
+- **Diff summary**: capture `git diff --stat <base>..<captured-head>` and `git diff --numstat <base>..<captured-head>` for the full implementation stage, including after a fix run. Supply both outputs to the report writer; put each file's added/deleted counts alone in `diffSummary.files[].lines` (`+150/-0`) and one sentence on what the change in that file does in `diffSummary.files[].summary` — the report renders `summary` as the file's "what it does" column and `lines` as a separate number column. Do not substitute a fix-run aggregate or carry forward older statistics. If the captured commits are unavailable, identify the missing reference in the evidence instead of inventing counts.
+- **Change narrative scope**: `userNarrative.changeExplanation` describes the same scope as `diffSummary` — the whole stage from its base, every file the table lists. On a fix run, state what the fix run itself changed (its commits and files) as a separate sentence; never present the fix-run delta as the stage's change.
 - **Out-of-plan edits block**: every file edited that was not in the approved plan's file list, with rationale (empty block is acceptable and preferred)
 - **Clarification answers carried in**: when `instruction-set/clarification-response.md` exists, it holds the user's answers to the approved plan's `## 1. Clarification Items` rows. The report MUST render the `## 0. Clarification Response Carried In From Previous Run` section (set `clarificationCarryIn.sourceFile` to that path) and, for every carried-over `## 1.` row whose answer appears there, record the answer in the `User input` cell and flip `Status` to `resolved`. A row left `open`/`answered` despite a matching user answer is a contract violation; an answer that materially changes scope beyond the approved plan is routed to a new `implementation-planning` run, not silently executed.
-- **Stage sidecar evidence**: the JSON payload of `runs/<impl-task-key>/carry/stage-<N>.json` is embedded verbatim in a fenced ```json``` block, AND the `consumers.jsonl` rows this run appended are quoted line-by-line, so reviewers can audit the carry surface without grepping artifact directories.
-- **Validation evidence**: actual command output (stdout/stderr) for every `pre / mid / post` validation command from the plan. Truncated output is acceptable but the command line and exit code MUST be exact. No paraphrasing of test results.
+- **Stage sidecar evidence**: set `stageSidecarEvidence.carryJson` to the path `runs/<impl-task-key>/carry/stage-<N>.json` followed by a one-line summary of its payload — stage number, step results by status, stage commit range, number of files changed. Do not paste the payload itself: the file on disk is the record (`_validate_stage_carry_sidecar_exists` checks that it exists), and a pasted one-line JSON is unreadable in the report. Quote the `consumers.jsonl` rows this run appended line-by-line in `consumerRows`.
+- **Validation evidence**: actual command output (stdout/stderr) for every `pre / mid / post` validation command from the plan. Truncated output is acceptable but the command line and exit code MUST be exact. No paraphrasing of test results. Set `checkId` to the plan's `validationChecklist` id (`VC-007`) when the row runs a checklist command, and `advisory: true` on a row whose check is advisory (an external Tier 3 conformance entry, for example) so a non-zero exit there is not shown as a failure.
 - **TDD evidence (when applicable)**: for steps that should be TDD-ordered, show the failing-test output captured BEFORE the merged commit and the passing-test output after, citing the single `feat|fix` commit SHA (test and implementation share one commit).
 - **Verifier results**: a section per verifier present in the resolved roster (`Claude verifier`, `Codex verifier`, and `Antigravity verifier` when opted in) containing:
   - their independent verdict (PASS / CONCERNS / FAIL),
@@ -66,4 +67,4 @@ are collected and convergence finished. Phase 1-5 do not need it.
 - On a non-`FAIL` verdict, for this run's single stage: append a `status:"done"` row to `runs/<plan-task-key>/consumers.jsonl` with `completed_at`, `carry_path`, `report_path` (this run's final-report path relative to the run root), and the SHA of HEAD. Append it with `okstra_ctl.consumers.append_consumer` (NOT a raw filesystem write) — that call honours the consumers lock AND releases this stage's worktree-registry occupancy, so later runs stop seeing a finished stage as a concurrent run. `report_path` lets `final-verification` cite each stage's originating report when assembling its Source Implementation Report list.
 - **Reopening a settled stage.** Appending a `status:"failed"` row after a `done` one withdraws that stage: `--stage N` accepts it again, its dependents stop resolving a base from the withdrawn head, and whole-task final-verification blocks until it is settled again. Use the same `okstra_ctl.consumers.append_consumer` call with a `reason`, and re-run the stage rather than repairing the tree outside okstra — a stage reverted outside the ledger leaves the recorded `head_commit` and the carry sidecar naming a tree that no longer exists, and the next stage branches from it.
 - The verifier round, Phase 5.5 convergence, and this Phase 6 report run **once per run** over this stage's diff — NOT per step.
-- Quote this stage's new contents (the sidecar JSON in full and the new consumers row by itself) in the final report's `Stage sidecar evidence` deliverable section.
+- Record this stage's new contents in the final report's `Stage sidecar evidence` deliverable section: the sidecar by path with its one-line summary, and the new consumers row quoted by itself.

package/runtime/python/okstra_ctl/phases/implementation/profile.md

@@ -2,7 +2,7 @@
 
 - Purpose: realise the approved `implementation-planning` deliverable as actual source changes, with cross-model verification, while keeping the run reversible
 - **Run-level fixed cost:** the verifier set, Phase 5.5 convergence, and the Phase 6 report-writer run exactly once per implementation run, over this run's single stage diff — never once per step.
-- **Fix run (profile carries a "Fix-Run Carry" block):** the executor's scope is the carried blocking findings plus the previous routing recommendation — it MUST NOT re-execute plan steps the previous run completed. Verifiers apply the "Fix-run incremental scope" section of `_implementation-verifier.md`; the report writer applies "Fix-run incremental authoring" in `report-writer.md`. The full validation-command re-run is NOT reduced.
+- **Fix run (profile carries a "Fix-Run Carry" block):** the executor's scope is the carried blocking findings plus the previous routing recommendation — it MUST NOT re-execute plan steps the previous run completed. Verifiers apply the "Fix-run incremental scope" section of `_implementation-verifier.md`. The full validation-command re-run is NOT reduced.
 - **Executor binding (resolved at run-prep time, fixed for this run):**
   - Executor display name: `{{EXECUTOR_DISPLAY_NAME}}`
   - Executor worker ID: `{{EXECUTOR_WORKER_ID}}`

package/runtime/python/okstra_ctl/phases/implementation/report.py

@@ -1,9 +1,12 @@
 """Human-first implementation delivery view model."""
 from __future__ import annotations
 
+import json
+import re
+from collections import Counter
+
 from okstra_ctl.report_html.common import evidence_index
-from okstra_ctl.report_html.models import HumanReportView, VisualNode
-from okstra_ctl.report_html.visualizations import change_map_figure
+from okstra_ctl.report_html.models import HumanReportView
 
 # Record fields this template anchors as `id-<row id>` (see
 # `HumanReportView.anchored_fields`); ids elsewhere land in the ledger.
@@ -13,39 +16,83 @@ ANCHORED_FIELDS = (
 )
 
 
-_FILE_ACTIONS = {"created": "Created", "modified": "Modified", "deleted": "Deleted"}
+def _carry_payload(text: str) -> dict | None:
+    start = text.find("{")
+    if start < 0:
+        return None
+    try:
+        payload, _ = json.JSONDecoder().raw_decode(text[start:])
+    except json.JSONDecodeError:
+        # expected-miss: carryJson 은 경로+요약 산문일 수 있다. 그때는 본문에 글 그대로 보인다.
+        return None
+    return payload if isinstance(payload, dict) else None
 
 
-def _change_nodes(implementation: dict) -> tuple[VisualNode, ...]:
-    return tuple(
-        VisualNode(
-            row["file"],
-            row["file"],
-            row["planStep"],
-            row["action"],
-            row["lines"],
-            note=f'{_FILE_ACTIONS.get(row["action"], row["action"])} · plan step {row["planStep"]}',
-        )
-        for row in implementation["diffSummary"]["files"]
+def _carry_view(evidence: dict | None) -> dict | None:
+    if not evidence:
+        return None
+    text = evidence["carryJson"]
+    payload = _carry_payload(text)
+    if payload is None:
+        return {"text": text}
+    commit_range = payload.get("stageCommitRange") or {}
+    base, head = commit_range.get("base"), commit_range.get("head")
+    steps = Counter(
+        str(row.get("status"))
+        for row in payload.get("stepResults") or ()
+        if isinstance(row, dict)
     )
+    files = payload.get("filesChanged")
+    return {
+        "path": f"carry/stage-{evidence['stageNumber']}.json",
+        "commitRange": f"{base[:8]}..{head[:8]}" if base and head else None,
+        "steps": ", ".join(f"{status} {count}" for status, count in steps.items()),
+        "filesChanged": len(files) if isinstance(files, list) else None,
+        "raw": json.dumps(payload, indent=2, ensure_ascii=False),
+    }
+
+
+_LEADING_CHECK_ID = re.compile(r"^(VC-\d{3,})\b")
+_COMMAND_PREVIEW = 60
+
+
+def _validation_card(row: dict) -> dict:
+    # checkId 가 없는 진행 중 task 는 writer 가 outputTail 머리에 붙인 VC id 를 보여 준다(표시 전용).
+    check_id = row.get("checkId")
+    if not check_id:
+        match = _LEADING_CHECK_ID.match(row["outputTail"])
+        check_id = match.group(1) if match else None
+    command = row["command"]
+    preview = command if len(command) <= _COMMAND_PREVIEW else command[: _COMMAND_PREVIEW - 1] + "…"
+    if not row["exitCode"]:
+        tone = "neutral"
+    elif row.get("advisory"):
+        tone = "medium"
+    else:
+        tone = "important"
+    return {**row, "checkId": check_id, "commandPreview": preview, "tone": tone}
 
 
 def build_implementation_view(data: dict) -> HumanReportView:
     implementation = data["implementation"]
-    figure = change_map_figure(
-        nodes=_change_nodes(implementation), title="Delivered change areas"
-    )
     context = {
         "humanSummary": data["humanSummary"],
         "implementation": implementation,
         "narrative": implementation["userNarrative"],
-        "changeFigure": figure,
+        # 진행 중인 task 의 data.json 에는 파일별 summary 가 없다. 빈 열을 그리지 않는다.
+        "diffHasSummary": any(
+            row.get("summary") for row in implementation["diffSummary"]["files"]
+        ),
+        "validationCards": [
+            _validation_card(row) for row in implementation["validationEvidence"]
+        ],
+        "carry": _carry_view(implementation.get("stageSidecarEvidence")),
         "evidenceIndex": evidence_index(data, ANCHORED_FIELDS),
     }
     return HumanReportView(
         "implementation",
         "html/tasks/implementation.template.html",
         context,
-        (figure,),
+        (),
         anchored_fields=ANCHORED_FIELDS,
     )

package/runtime/python/okstra_ctl/phases/implementation/report_assets/implementation.template.html

@@ -1,6 +1,5 @@
 {% extends "html/base.template.html" %}
 {% from "html/macros/layout.html" import narrative as render_narrative, summary_card, row_key, file_paths %}
-{% from "html/macros/visualizations.html" import figure %}
 
 {% block human_content %}
 <section data-report-section="delivered-outcome">
@@ -12,19 +11,19 @@
 <section data-report-section="change-map" data-report-field="implementation.diffSummary">
   <h2>{{ t('tasks.implementation.what-changed') }}</h2>
   {{ render_narrative(narrative.changeExplanation, "implementation.userNarrative.changeExplanation") }}
-  {{ figure(changeFigure) }}
+  <table><thead><tr><th>{{ t('tasks.implementation.file') }}</th><th>{{ t('tasks.implementation.change') }}</th>{% if diffHasSummary %}<th>{{ t('tasks.implementation.what-it-does') }}</th>{% endif %}<th class="figure">{{ t('tasks.implementation.lines') }}</th><th>{{ t('tasks.implementation.plan-step') }}</th></tr></thead><tbody>{% for row in implementation.diffSummary.files %}<tr><td><code>{{ row.file }}</code></td><td>{{ t('tasks.implementation.action-' ~ row.action) }}</td>{% if diffHasSummary %}<td>{{ row.get('summary', '') | inline_code }}</td>{% endif %}<td class="figure">{{ row.lines }}</td><td>{{ row.planStep | inline_code }}</td></tr>{% endfor %}</tbody></table>
 </section>
 
 <section data-report-section="requirement-coverage">
   <h2>{{ t('tasks.implementation.requirement-coverage') }}</h2>
-  <table data-report-field="implementation.requirementCoverage"><thead><tr><th>{{ t('tasks.implementation.requirement') }}</th><th>{{ t('tasks.implementation.body') }}</th><th>{{ t('tasks.implementation.implemented-by') }}</th></tr></thead><tbody>{% for row in implementation.requirementCoverage %}<tr id="id-{{ row.id }}">{{ row_key(pairs=[(t('macros.layout.id'), row.id)], status_name=t('macros.layout.status'), status_raw=row.status, status_text=row.status) }}<td>{{ row.requirement | inline_code }}</td><td>{{ row.coveredBy | inline_code }}</td></tr>{% endfor %}</tbody></table>
+  <table data-report-field="implementation.requirementCoverage"><thead><tr><th>{{ t('tasks.implementation.requirement') }}</th><th>{{ t('tasks.implementation.body') }}</th><th>{{ t('tasks.implementation.implemented-by') }}</th></tr></thead><tbody>{% for row in implementation.requirementCoverage %}<tr id="id-{{ row.id }}">{{ row_key(pairs=[(t('macros.layout.id'), row.id)], status_name=t('macros.layout.status'), status_raw=row.status, status_text=(row.status.split(' ')[0] | enum_label('requirementStatus')) ~ ((' ' ~ row.status.split(' ', 1)[1]) if ' ' in row.status else '')) }}<td>{{ row.requirement | inline_code }}</td><td>{{ row.coveredBy | inline_code }}</td></tr>{% endfor %}</tbody></table>
 </section>
 
 <section data-report-section="validation" data-report-field="implementation.validationEvidence">
   <h2>{{ t('tasks.implementation.verification-result') }}</h2>
   {{ render_narrative(narrative.validationExplanation, "implementation.userNarrative.validationExplanation") }}
-  <div class="summary-grid">{% for row in implementation.validationEvidence %}{{ summary_card(row.phase ~ " · " ~ t('tasks.implementation.exit-code') ~ " " ~ row.exitCode, row.outputTail, "important" if row.exitCode else "neutral") }}{% endfor %}</div>
-  {% for row in implementation.verifierResults %}<article class="summary-card tone-{{ row.verdict | lower }}"><p class="eyebrow">{{ row.verifier | inline_code }} · <span class="status status-{{ row.verdict | lower }}">{{ row.verdict }}</span></p>{% if row.get("independentValidationRerun") %}<p><strong>{{ t('tasks.implementation.independent-rerun') }}</strong> {{ row.independentValidationRerun | inline_code }}</p>{% endif %}{% if row.get("readOnlyCommandLog") %}<p><strong>{{ t('tasks.implementation.command-log') }}</strong> {{ row.readOnlyCommandLog | inline_code }}</p>{% endif %}{% if row.get("discrepancy") %}<p class="evidence-refs">{{ t('tasks.implementation.discrepancy') }} {{ row.discrepancy | inline_code }}</p>{% endif %}{% if row.get("declinedFixRecommendations") %}<p>{{ row.declinedFixRecommendations | inline_code }}</p>{% endif %}</article>{% endfor %}
+  <div class="summary-grid">{% for row in validationCards %}<article class="summary-card tone-{{ row.tone }}"><h3>{% if row.checkId %}{{ row.checkId }} · {% endif %}{{ row.phase }} · {{ t('tasks.implementation.exit-code') }} {{ row.exitCode }}{% if row.get("advisory") %} · {{ t('tasks.implementation.advisory') }}{% endif %}</h3><p><code title="{{ row.command }}">{{ row.commandPreview }}</code></p><p>{{ row.outputTail | inline_code }}</p></article>{% endfor %}</div>
+  {% for row in implementation.verifierResults %}<article class="summary-card tone-{{ row.verdict | lower }}"><p class="eyebrow">{{ row.verifier | inline_code }} · <span class="status status-{{ row.verdict | lower }}">{{ row.verdict }}</span></p>{% for label, text in ((t('tasks.implementation.independent-rerun'), row.get("independentValidationRerun")), (t('tasks.implementation.command-log'), row.get("readOnlyCommandLog"))) if text %}<details><summary><strong>{{ label }}</strong> {{ t('tasks.implementation.entry-count') | replace('{count}', text.strip().splitlines() | select | list | length | string) }}</summary><pre>{{ text }}</pre></details>{% endfor %}{% if row.get("discrepancy") %}<p class="evidence-refs">{{ t('tasks.implementation.discrepancy') }} {{ row.discrepancy | inline_code }}</p>{% endif %}{% if row.get("declinedFixRecommendations") %}<p>{{ row.declinedFixRecommendations | inline_code }}</p>{% endif %}</article>{% endfor %}
 </section>
 
 <section data-report-section="remaining-issues">
@@ -42,8 +41,10 @@
 
 <section data-report-section="rollback" data-report-field="implementation.rollbackVerification">
   <h2>{{ t('tasks.implementation.can-this-be-rolled-back') }}</h2>
-  <table><thead><tr><th>{{ t('tasks.implementation.subject') }}</th><th>{{ t('tasks.implementation.rollback-command') }}</th><th>{{ t('tasks.implementation.how-to-verify') }}</th><th>{{ t('tasks.implementation.result') }}</th></tr></thead><tbody>{% for row in implementation.rollbackVerification %}<tr><td>{{ row.category | inline_code }}</td><td><code>{{ row.rollbackCommand }}</code></td><td>{{ row.verification | inline_code }}</td><td>{{ row.result | inline_code }}</td></tr>{% else %}<tr><td colspan="4">{{ t('tasks.implementation.no-rollback-check-was-recorded') }}</td></tr>{% endfor %}</tbody></table>
-  {% if implementation.stageSidecarEvidence %}<p data-report-field="implementation.stageSidecarEvidence"><strong>{{ t('tasks.implementation.stage-carry-over') }}</strong> — Stage {{ implementation.stageSidecarEvidence.stageNumber }} {{ implementation.stageSidecarEvidence.stageTitle | inline_code }} · <code>{{ implementation.stageSidecarEvidence.carryJson }}</code></p>{% endif %}
+  <table><thead><tr><th>{{ t('tasks.implementation.subject') }}</th><th>{{ t('tasks.implementation.rollback-command') }}</th><th>{{ t('tasks.implementation.how-to-verify') }}</th><th>{{ t('tasks.implementation.result') }}</th></tr></thead><tbody>{% for row in implementation.rollbackVerification %}<tr><td>{{ row.category | enum_label('rollbackCategory') }}</td><td><code>{{ row.rollbackCommand }}</code></td><td>{{ row.verification | inline_code }}</td><td>{{ row.result | enum_label('rollbackResult') }}</td></tr>{% else %}<tr><td colspan="4">{{ t('tasks.implementation.no-rollback-check-was-recorded') }}</td></tr>{% endfor %}</tbody></table>
+  {% if implementation.stageSidecarEvidence %}<div data-report-field="implementation.stageSidecarEvidence"><p><strong>{{ t('tasks.implementation.stage-carry-over') }}</strong> — Stage {{ implementation.stageSidecarEvidence.stageNumber }} {{ implementation.stageSidecarEvidence.stageTitle | inline_code }}</p>
+  {% if carry.get("text") %}<p>{{ carry.text | inline_code }}</p>{% else %}<table><tbody><tr><th>{{ t('tasks.implementation.carry-sidecar') }}</th><td><code>{{ carry.path }}</code></td></tr>{% if carry.commitRange %}<tr><th>{{ t('tasks.implementation.carry-commit-range') }}</th><td><code>{{ carry.commitRange }}</code></td></tr>{% endif %}{% if carry.steps %}<tr><th>{{ t('tasks.implementation.carry-steps') }}</th><td>{{ carry.steps }}</td></tr>{% endif %}{% if carry.filesChanged is not none %}<tr><th>{{ t('tasks.implementation.carry-files-changed') }}</th><td>{{ carry.filesChanged }}</td></tr>{% endif %}</tbody></table>
+  <details><summary>{{ t('tasks.implementation.carry-raw') }}</summary><pre>{{ carry.raw }}</pre></details>{% endif %}</div>{% endif %}
 </section>
 
 <section data-report-section="manual-test" data-report-field="implementation.manualUserTest">

package/runtime/python/okstra_ctl/phases/implementation/wizard.py

@@ -9,6 +9,7 @@ _STAGE_MARKER_KEYS = {
     "active": "mark_active",
     "ready": "mark_ready",
     "blocked": "mark_blocked",
+    "cancelled": "mark_cancelled",
 }
 
 

package/runtime/python/okstra_ctl/phases/implementation_planning/authoring.py

@@ -1284,7 +1284,8 @@ def _stage_ledger_snapshot(run_manifest: Path | None) -> dict[str, str] | None:
     """`{스테이지 번호: 상태}`. 원장을 못 읽으면 ``None``.
 
     게이트가 범위를 좁히려면 어느 스테이지가 지금 시작 가능한지 알아야 한다. 그
-    사실은 Stage 원장에 있고, 상태 어휘(`done` / `active` / `ready` / `blocked`)는
+    사실은 Stage 원장에 있고, 상태 어휘(`done` / `cancelled` / `active` / `ready` /
+    `blocked`)는
     `stage_targets.StageLifecycle.status` 의 것을 그대로 쓴다 — 원장이 자기 어휘를
     따로 가지면 같은 stage 가 소비처마다 다르게 읽힌다.
 
@@ -1644,6 +1645,8 @@ def _replace_item_verdicts(
 ) -> None:
     item["verdicts"] = _stamped_verdicts(incoming, round_number, project_root)
     _remember_verified_hash(item)
+    # 이번 run 의 표로 바뀌었으니 더는 직전 run 에서 이월된 항목이 아니다.
+    item.pop("carriedForwardFromSeq", None)
 
 
 def _append_item_verdicts(
@@ -1768,11 +1771,13 @@ def _reject_uncompleted_round_loss(
     for item in recorded:
         if not isinstance(item, Mapping) or item.get("id") not in rows:
             continue
+        # `seed --prior-state` 는 이월 표시를 항목에 찍는다. 이번 run 이 항목을
+        # 다시 판정하면 그 표시는 지워지므로, 표시가 남은 항목의 표는 모두 직전 run 것이다.
+        if str(item.get("carriedForwardFromSeq") or "").strip():
+            continue
         for row in item.get("verdicts") or []:
             if not isinstance(row, Mapping):
                 continue
-            if str(row.get("carriedForwardFromSeq") or "").strip():
-                continue
             recorded_round = row.get("round")
             if (
                 isinstance(recorded_round, int)

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -42,9 +42,9 @@ Plan for the actual worktree layout before approval. Shared documentation direct
   - **directive-first ambiguity resolution** (the same rule, pointed at the user instead of the code): any ambiguity the run's directive, the brief, the carried-in `user-responses/` sidecars, or the user's in-session instruction already answers MUST be resolved that way and recorded with the quoted instruction. Writing a clarification row for something the user already decided is the same defect as writing one for something the code already answers — and it costs more, because the row withholds approval until a whole separate answer cycle closes it. When an instruction points at a document, treat every item in that document as decided, including the ones the document itself flagged as needing a decision (shared rule: `_common-contract.md` "User instruction outranks the material it points at").
   - flag any requirement that is ambiguous, contradictory, or missing success criteria — register each one as a row in the report's `## 1. Clarification Items` table with `Blocks=approval` instead of guessing
   - read `<PROJECT_ROOT>/.okstra/glossary.md` and `<PROJECT_ROOT>/.okstra/decisions/` titles if present. Absent okstra memory files are the normal state — do not error. Treat the brief's `terminology:*` resolutions from `requirements-discovery` (if any) as authoritative; if missing, resolve any remaining fuzzy term as a `Blocks=approval` clarification row.
-  - **Stage Ledger (read before drafting the Stage Map):** when this task already has a plan on disk, the analysis packet carries a `## Stage Ledger` JSON block listing every stage with its `status` (`done` / `active` / `ready` / `blocked`), `dependsOn`, and done commit. It states what exists, not what to plan. Two rules follow from it:
+  - **Stage Ledger (read before drafting the Stage Map):** when this task already has a plan on disk, the analysis packet carries a `## Stage Ledger` JSON block listing every stage with its `status` (`done` / `active` / `cancelled` / `ready` / `blocked`), `dependsOn`, and done commit. It states what exists, not what to plan. Two rules follow from it:
     - A stage whose `status` is `done` is already implemented and will not be executed again. Declare it in this report's `stages[]` and `stageMap[]` with its plan body copied forward as written; do not rewrite its steps, and do not fold its work into a new stage. Its plan items are `observed`, not `in-scope` (`okstra_ctl.plan_items.stage_scope_bucket`), so re-declaring it adds no verification load. A carried body is also not re-judged: the planning conformance gate skips a stage the consumer ledger records as `done`, and report assembly issues no design-prep request for one (`okstra_ctl.design_prep.materialize_design_prep_requests`). A rule that widened since that stage shipped cannot be satisfied by a body you are forbidden to rewrite.
-    - Every stage number in the ledger is taken. This report declares every one of them — rows run `1..N` with no gap — and a new stage takes the next number after the highest one listed; numbers are never reused or reordered. A report that declares only its new stages satisfies neither rule and is refused twice over. **Enforced:** `okstra_ctl.stage_map._validate_stage_numbers` rejects the gap in every published plan it parses, so `okstra prepare` refuses the implementation run (`okstra_ctl.run._parse_stage_map_into_ctx`) and the Stage Ledger of every later run reads as `unreadable`; `validators/validate-implementation-plan-stages.py` check **S2** reports the same defect at authoring time. Cancelling a stage you no longer want is not yet expressible — that lands with the plan-amendment feature — so an unstarted stage you drop still keeps its number and body here.
+    - Every stage number in the ledger is taken. This report declares every one of them — rows run `1..N` with no gap — and a new stage takes the next number after the highest one listed; numbers are never reused or reordered. A report that declares only its new stages satisfies neither rule and is refused twice over. **Enforced:** `okstra_ctl.stage_map._validate_stage_numbers` rejects the gap in every published plan it parses, so `okstra prepare` refuses the implementation run (`okstra_ctl.run._parse_stage_map_into_ctx`) and the Stage Ledger of every later run reads as `unreadable`; `validators/validate-implementation-plan-stages.py` check **S2** reports the same defect at authoring time. To drop a stage that has not started — `ready` or `blocked` in the ledger — keep its row and body in place in both `stageMap[]` and `stages[]` and set that `stageMap[]` row's `status` to `cancelled`; its number stays taken, and stage selection, whole-task final-verification, integration and release-handoff skip it. A `done` or `active` stage is never cancelled: to change finished work, keep that stage and add a correction stage numbered after the highest one. No remaining stage may depend on a cancelled one — point it at the stage that replaces it. **Enforced:** `validators/validate-implementation-plan-stages.py` check **S14** rejects a cancelled stage the ledger records `done` or `active` and a dependency on a cancelled stage.
     - The ledger answers two questions from two sources, and the block names both. `sourcePlan` is the plan the completed stages were actually built against; `latestPlan` is the plan the `stages` list came from and is therefore the numbering authority. When they differ, the completed work followed the former and the highest taken number comes from the latter.
     - A `planDivergence` entry means one of two things: the two plans disagree about a stage that is already `done` — the same number naming different work, or a completed stage the latest plan no longer declares — or the plan the completed stages were built against could not be read at all, so that comparison never ran. Both block the same way: do not pick one of the two plans yourself; register it as a `Blocks=approval` clarification row and assign no new stage number until it is resolved. Completed stages built against an *earlier* plan are not a divergence — that is the normal shape of an amended plan and the ledger folds it silently.
     - The block is absent ONLY on a task's first planning run. Its absence then means there is no prior plan, not that no stage is done. When the ledger could not be read, the packet names the source and reason. Continue planning to repair unambiguous dependency notation in the new report, retaining every stage number and title and every completed stage body. Record the original and corrected values with their source. Do not overwrite the prior report or select an older plan. Assign no new stage number until the corrected Stage Map validates; unresolved dependency meaning remains a blocker. The preparation behavior is covered by `tests/run/test_stage_ledger_prepare.py`; preservation of author intent remains a review guideline.

package/runtime/python/okstra_ctl/phases/implementation_planning/report_assets/implementation-planning-input.template.md

@@ -127,7 +127,7 @@ Enforced: `scripts/okstra_ctl/run.py` `_validate_approved_plan` reads that front
 
 ## Stage Output Shape (reference)
 
-**Enforced:** `validators/validate-implementation-plan-stages.py` fails a plan missing `## 5.5 Stage Map` and checks each `## 5.5.<i> Stage <i>` section against it (S1–S13).
+**Enforced:** `validators/validate-implementation-plan-stages.py` fails a plan missing `## 5.5 Stage Map` and checks each `## 5.5.<i> Stage <i>` section against it (S1–S14).
 
 This run's final report MUST emit `## 5.5 Stage Map` and `## 5.5.<i> Stage <i>` sections per the implementation-planning profile §"Required deliverable shape". Two illustrative Stage Map tables:
 

package/runtime/python/okstra_ctl/phases/release_handoff/operations.py

@@ -58,6 +58,12 @@ def _run_git(args: List[str], cwd, check: bool = True) -> subprocess.CompletedPr
 
 
 def _require_eligible(stage_map, rows, stages) -> Dict[int, Dict[str, Any]]:
+    cancelled = sorted(
+        s["stage_number"] for s in stage_map
+        if s.get("cancelled") and s["stage_number"] in stages)
+    if cancelled:
+        raise HandoffError(
+            f"stages cancelled in the approved plan have no PR: {cancelled}")
     elig = {e["stage"]: e for e in compute_eligibility(stage_map, rows)}
     unknown = [n for n in stages if n not in elig]
     if unknown:

package/runtime/python/okstra_ctl/plan_items.py

@@ -396,6 +396,8 @@ def expected_plan_item_ids(implementation_planning: Mapping[str, Any]) -> list[s
 
 
 _STARTABLE_STATUSES = frozenset({"ready", "active"})
+# 다시 실행되지 않는 stage. 그 항목은 관찰만 하고 착수를 막지 않는다.
+_FROZEN_STATUSES = frozenset({"done", "cancelled"})
 
 # 계획 전체를 판정하는 항목. 스테이지 하나를 고쳐도 요청하지 않은 작업이
 # 들어왔는지 다시 봐야 한다. P-Val / P-Req / P-Rb 는 여기 넣지 않는다 —
@@ -454,7 +456,7 @@ def stage_scope_bucket(
     statuses = {str(ledger.get(str(stage)) or "") for stage in stages}
     if statuses & _STARTABLE_STATUSES:
         return "in-scope"
-    return "observed" if "done" in statuses else "deferred"
+    return "observed" if statuses & _FROZEN_STATUSES else "deferred"
 
 
 def _depends_on(value: object) -> tuple[int, ...]:
@@ -504,15 +506,30 @@ def _planning_stage_rows(planning: Mapping[str, Any]) -> list[tuple[int, tuple[i
     return rows
 
 
+def _cancelled_stage_numbers(planning: Mapping[str, Any]) -> set[int]:
+    stage_map = planning.get("stageMap")
+    if not isinstance(stage_map, list):
+        return set()
+    return {
+        row["stage"] for row in stage_map
+        if isinstance(row, Mapping)
+        and isinstance(row.get("stage"), int)
+        and row.get("status") == "cancelled"
+    }
+
+
 def planning_stage_ledger(
     planning: Mapping[str, Any],
     disk_status: Mapping[str, str] | None = None,
 ) -> dict[str, str]:
-    """지금 계획의 스테이지를 ``done`` / ``active`` / ``ready`` / ``blocked`` 로.
+    """지금 계획의 스테이지를 ``done`` / ``active`` / ``cancelled`` / ``ready`` /
+    ``blocked`` 로.
 
     디스크 원장은 이미 구현된 것만 안다. 첫 계획 run 에는 원장이 없어서
     게이트가 전 항목을 in-scope 로 읽었다. 이 함수는 현재 계획의 depends-on 으로
-    그 빈칸을 채운다. 디스크에 ``done`` / ``active`` 가 있으면 그쪽이 이긴다.
+    그 빈칸을 채운다. 디스크에 ``done`` / ``active`` 가 있으면 그쪽이 이긴다 —
+    그런 stage 를 계획이 취소했다면 그것은 검증기(S14)가 거부할 결함이고, 원장은
+    실제 상태를 그대로 보여야 한다.
     """
     recorded = {
         key: value
@@ -520,6 +537,7 @@ def planning_stage_ledger(
         if value in {"done", "active", "ready", "blocked"}
     }
     done = {key for key, value in recorded.items() if value == "done"}
+    cancelled = _cancelled_stage_numbers(planning)
     ledger: dict[str, str] = {}
     for number, depends in _planning_stage_rows(planning):
         key = str(number)
@@ -527,6 +545,9 @@ def planning_stage_ledger(
         if status in {"done", "active"}:
             ledger[key] = status
             continue
+        if number in cancelled:
+            ledger[key] = "cancelled"
+            continue
         ready = all(str(dep) in done for dep in depends)
         ledger[key] = "ready" if ready else "blocked"
     return ledger

package/runtime/python/okstra_ctl/report_html/run_usage.py

@@ -37,6 +37,10 @@ def _agent_row(row: dict) -> dict[str, str]:
     there would read as a missing measurement instead of an absent charge.
     """
     cli_tokens = _number(row.get("cliTotalTokens")) or 0
+    if cli_tokens == _number(row.get("totalTokens")):
+        # A CLI-only agent's raw figure is its CLI figure; a second line would
+        # print the same number twice.
+        cli_tokens = 0
     cli_cost = _number(row.get("cliCostUsd")) or 0
     cost = _number(row.get("costUsd"))
     if cost is None and cli_cost:
@@ -124,10 +128,15 @@ def run_usage(data: dict) -> dict[str, object] | None:
     if not measured:
         return None
     cli_cost = _number((usage.get("cli") or {}).get("costUsd")) or 0
+    grand_cost = _number((usage.get("grand") or {}).get("costUsd")) or 0
+    # The total holds API spend only, while a CLI-only agent's charge sits in
+    # its row's cost cell; this line is what the cost column adds up to.
+    grand_with_cli = grand_cost + cli_cost if cli_cost else 0
     return {
         "rows": [_agent_row(row) for row in rows],
         "unaccounted": _unaccounted(rows, usage.get("grand") or {}),
         **totals,
         "taskCumulative": _task_cumulative(usage.get("taskCumulative")),
         "cliCost": format_usd(cli_cost) if cli_cost else "",
+        "grandWithCli": format_usd(grand_with_cli) if grand_with_cli else "",
     }