okstra 0.213.0 → 0.214.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.213.0",
+  "version": "0.214.1",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.213.0",
-  "builtAt": "2026-10-06T12:54:53.696Z",
+  "package": "0.214.1",
+  "builtAt": "2026-10-06T14:25:05.491Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -137,6 +137,7 @@ Every `okstra` command the lead documents cite, grouped by phase, each spelled w
 | `okstra plan-items next-dispatch --state <path>` | Decide whether the round opens another worker batch | `plan-body-verification` "Round protocol" |
 | `okstra plan-items resolve-dissent --state <path> --item <P-id> --decision-file <path>` | Record an evidence-based lead decision after the single self-fix | `plan-body-verification` "Round protocol" |
 | `okstra plan-verify --report <path>` | Score the plan-body gate; never tally votes in a script | `plan-body-verification` "Round protocol" |
+| `okstra worktree-lock --worktree <dir> --command <text>` | Lead minor fix (implementation only): re-run each Tier 1 command and failing verifier check that covers a fixed finding, in the stage worktree, under its lock | `_implementation-deliverable.md` "Lead minor fix" |
 
 ### Phase 7 — persist
 
@@ -354,6 +355,8 @@ For `--task-type implementation` runs, the task bundle additionally pins one of
 
 Lead MUST dispatch Edit/Write-bearing work only through that executor binding: use the host primitive with `hostModelValue` for `runner=native-session`. For `runner=cli-wrapper`, use `okstra team dispatch` when `terminalBackend` is `cmux-pane`, or `okstra worker-dispatch` with `modelExecutionValue` otherwise. The other providers in the roster still run as read-only verifiers in the same run; the executor's own provider does not, because its worker ID materializes as the executor on every dispatch — so the diff is reviewed context-isolated by the remaining verifiers. Session isolation is the primary self-review safeguard — a verifier reusing the executor's model variant is acceptable in a distinct session. A different model variant (e.g. executor=opus / Claude verifier=sonnet) is recommended but not mandatory.
 
+The one exception is the **lead minor fix**: after the verifier round and Phase 5.5 convergence, and before the report-writer dispatch, the lead edits and commits in the stage worktree itself to fix verifier FAIL findings that meet every eligibility rule in `scripts/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md` "Lead minor fix" — a local fix at the cited location, at most 30 changed lines in total, no change to a test's expected values, dependencies, schemas, migrations or config of record, only files inside the stage's planned paths or already changed by the executor, one pass per run. It then re-runs the covering checks through `okstra worktree-lock --worktree <dir> --command <text>` and records them in `implementation.leadFixes`. No worker dispatch is open at that point, so no read-only worker's mutation audit window covers the edit. Any finding outside those rules goes through the executor in a fix run. **Enforced:** `validators/validate-run.py` `_validate_lead_fixes` fails a fix recorded as passing with a failing check, a fix over 30 lines, and a stage settled over a FAIL that no passing fix answers; the remaining eligibility rules are instructions only.
+
 Executor is chosen at run-prep time via `--executor <claude|codex|antigravity>` (or `OKSTRA_DEFAULT_EXECUTOR`, fallback `claude`); the model used by the executor is taken from the corresponding worker model flag (`--claude-model` / `--codex-model` / `--antigravity-model`). For CLI-backed executors, the underlying file mutation happens inside the executor CLI's own auto-edit mode (e.g. `codex exec --sandbox danger-full-access`), not through the lead runtime's `write_artifact` operation.
 
 **Enforced:** every non-executor assignment is dispatched under `writePolicy.sourcePolicy.mode` `source-readonly`, and `scripts/okstra_ctl/execution_mutation_audit.py` `_source_changes` compares the before/after snapshots and reports a read-only worker that mutated source; `assert_compatible_batch` refuses a batch that mixes a mutating worker with read-only ones.

package/runtime/python/okstra_ctl/blocking_checks.py

@@ -216,6 +216,17 @@ _BLOCKING: tuple[tuple[str, str], ...] = (
         "stage_fix_carry.py 가 통과 판정만 보므로 거부된 작업이 "
         "release-handoff 로 넘어간다.",
     ),
+    # 검증자 FAIL 이 남은 stage 를 `done` 으로 정착시키는 길은 재실행 검사가
+    # 전부 통과한 리드 수정 하나뿐이다(`_implementation-deliverable.md`
+    # "Lead minor fix"). 기록이 그 조건을 어기면 stage_fix_carry.py 가 통과한
+    # 리드 수정이 답한 FAIL 행을 해소된 것으로 읽어 fix run 을 열지 않는다.
+    (
+        "lead-fix BLOCKING:",
+        "검증자가 거부했고 통과 기록이 없는 head 가 done 으로 정착된다 — "
+        "consumers.py 의 done 행으로 후속 stage 가 그 head 에서 분기하고, "
+        "stage_fix_carry.py 는 통과로 기록된 리드 수정이 답한 FAIL 을 다시 "
+        "fix run 으로 넘기지 않는다.",
+    ),
     (
         "implementation run declares stage-",
         "stage 캐리 사이드카가 디스크에 없다 — consumers.py 의 "

package/runtime/python/okstra_ctl/phases/implementation/host-rules.md

@@ -54,7 +54,7 @@ If the anchor (`implementation_base_commit`) is reported unresolvable, run the s
 Because of the dependency closure, the chain queue **may include a stage that another implementation run has occupied as started/reserved.** That stage's `render-bundle` is rejected with `--stage N already in progress or reserved by another run` (StageTargetError). This is **not** an exception gate needing human judgment but a "next stage not yet ready" situation. On this rejection, **terminate the chain normally** and report the remaining queue to the user (e.g. `remaining queue: stage 4, 5 — resume with okstra-run after occupancy is released`). This is a different branch from the exception gate below (data corruption·concurrent-occupancy conflict confirmation).
 
 ### Stage ended FAIL — stop the queue and report (not an exception gate)
-When a stage's synthesised verdict is `FAIL`, Phase 6 writes no carry sidecar and appends a `status:"failed"` row in place of `done` (`scripts/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md` "Lead post-stage persistence"). **Stop the queue at that stage** and report the failed stage, its report path, and the remaining queue (e.g. `stage 1 FAIL — remaining queue: stage 2, 3, 5; re-enter with okstra-run --stage 1 after the fix`). Do **not** continue to the next stage even when that stage is dependency-independent: an unattended chain that keeps building past a confirmed regression stacks later work on top of it. The `failed` row releases the stage's occupancy, so `--stage <N>` re-enters the same stage on its preserved worktree and branch — there is nothing to unblock by hand.
+A verifier FAIL that a passing lead minor fix answered does not make the verdict `FAIL` (`_implementation-deliverable.md` "Lead minor fix"); that stage settles `done` and the queue continues. When a stage's synthesised verdict is `FAIL`, Phase 6 writes no carry sidecar and appends a `status:"failed"` row in place of `done` (`scripts/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md` "Lead post-stage persistence"). **Stop the queue at that stage** and report the failed stage, its report path, and the remaining queue (e.g. `stage 1 FAIL — remaining queue: stage 2, 3, 5; re-enter with okstra-run --stage 1 after the fix`). Do **not** continue to the next stage even when that stage is dependency-independent: an unattended chain that keeps building past a confirmed regression stacks later work on top of it. The `failed` row releases the stage's occupancy, so `--stage <N>` re-enters the same stage on its preserved worktree and branch — there is nothing to unblock by hand.
 
 ### Exception gate during chaining
 If `render-bundle` raises Step 5's concurrent-run conflict detection (concurrent-run branch) or git stale-SHA reconciliation (git-reconcile branch), **stop the chain at that stage** and present the gate to the user exactly as Step 5 prescribes. Once the user resolves the gate, resume the chain in place (continue with the remaining queue). Data corruption·concurrent-occupancy conflicts are confirmed by a human — this is the safety boundary of unattended chaining. (Unlike the "not ready" rejection above, these two branches do not discard the queue; they wait for user resolution.)

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md

@@ -6,12 +6,13 @@ are collected and convergence finished. Phase 1-5 do not need it.
 
 # Implementation profile — Deliverable sidecar
 
-> **When to read**: lead reads this file ONCE at the start of Phase 6 (after Phase 5.5 convergence completes, before constructing the report-writer dispatch prompt). Carries the final-report deliverable shape, lead's post-stage persistence rules, and the self-review checklist.
+> **When to read**: lead reads this file ONCE at the start of Phase 6 (after Phase 5.5 convergence completes, before constructing the report-writer dispatch prompt). Carries the final-report deliverable shape, the lead minor fix, lead's post-stage persistence rules, and the self-review checklist.
 
 ## Required deliverable shape (final report, in addition to the standard sections)
 
 - **Plan link & approval evidence**: path to the approved `final-report.md`, the exact quoted approval marker, AND the executed stage number / title quoted from the Stage Map row. For a selected-direction plan, also quote `selectedDirectionRef.optionId`, `snapshotPath`, and the validated snapshot digest; for a legacy plan, quote the effective `implementation-option` or the Recommended Option fallback.
-- **Commit list**: each commit's SHA (or short SHA), message, and the plan step(s) / TDD cycle it satisfies
+- **Commit list**: each commit's SHA (or short SHA), message, and the plan step(s) / TDD cycle it satisfies. A lead minor fix commit is listed too, with `planStep` `Lead minor fix (<finding ids>)`.
+- **Lead minor fixes**: when the lead fixed verifier findings in this run, pass each `implementation.leadFixes[]` entry to the report writer as recorded (§"Lead minor fix"). Omit the field when there was none.
 - **Diff summary**: capture `git diff --stat <base>..<captured-head>` and `git diff --numstat <base>..<captured-head>` for the full implementation stage, including after a fix run. Supply both outputs to the report writer; put each file's added/deleted counts alone in `diffSummary.files[].lines` (`+150/-0`) and one sentence on what the change in that file does in `diffSummary.files[].summary` — the report renders `summary` as the file's "what it does" column and `lines` as a separate number column. Do not substitute a fix-run aggregate or carry forward older statistics. If the captured commits are unavailable, identify the missing reference in the evidence instead of inventing counts.
 - **Change narrative scope**: `userNarrative.changeExplanation` describes the same scope as `diffSummary` — the whole stage from its base, every file the table lists. On a fix run, state what the fix run itself changed (its commits and files) as a separate sentence; never present the fix-run delta as the stage's change.
 - **Out-of-plan edits block**: every file edited that was not in the approved plan's file list, with rationale (empty block is acceptable and preferred)
@@ -26,7 +27,7 @@ are collected and convergence finished. Phase 1-5 do not need it.
   - **independent validation re-run results** — per plan-validation command: command line, exit code, and tail of output captured by the verifier (not the executor); any divergence from the executor's reported result MUST be called out as a `Discrepancy` line citing both sides — and, when the divergence rests on a plan `validationChecklist` row, naming that row with its `phase` (`VC-003 (phase: mid)`; `_validate_verifier_discrepancy_names_checklist_phase` fails a row cited without it) — and when nothing diverged the line is omitted rather than written as `None` — an empty `discrepancy` is how "no divergence" is recorded, and non-empty text there with verdict `PASS` fails the run,
   - **style / lint / type-check results** — each check-only tool the verifier ran, its exit code, and the count of new findings attributable to lines this run introduced. When no tool is configured for a touched language, record the single line `no lint/style tool configured for <language>`,
   - any fix recommendations the verifier declined to apply.
-  The Okstra lead synthesises a unified verdict but MUST preserve dissent — do not collapse opinions into one paragraph. External Tier 3 advisory results are excluded from this aggregate promotion and remain user-owned follow-up evidence. If any other verifier issued `FAIL` on a `Discrepancy` line, the synthesised verdict MUST be `FAIL`. There is no exception and no override: `_validate_verifier_fail_blocks_verdict` in `validators/validate-run.py` fails any report whose `finalVerdict.verdictToken` passes while a `verifierResults[]` row records `FAIL`, and it reads that row alone — a rationale written beside it changes nothing. A divergence the lead believes is not the code's (a committed flaky-test record, a documented environment delta) belongs in the routing recommendation and the user-owned follow-up, and is settled in the next fix run where the verifier re-checks the finding and cites it `resolved`.
+  The Okstra lead synthesises a unified verdict but MUST preserve dissent — do not collapse opinions into one paragraph. External Tier 3 advisory results are excluded from this aggregate promotion and remain user-owned follow-up evidence. If any other verifier issued `FAIL` on a `Discrepancy` line, the synthesised verdict MUST be `FAIL`. The one exception is a passing lead minor fix (§"Lead minor fix" below), which answers the FAIL inside this run; there is no other override: `_validate_verifier_fail_blocks_verdict` in `validators/validate-run.py` fails any report whose `finalVerdict.verdictToken` passes while a `verifierResults[]` row records `FAIL`, `_validate_lead_fixes` reports (advisory) a settled stage whose `FAIL` row no passing `leadFixes[]` entry names, and both read the rows alone — a rationale written beside them changes nothing. The verifier's `FAIL` row stays in `verifierResults[]` after a lead fix; the fix is recorded beside it, not over it. A divergence the lead believes is not the code's (a committed flaky-test record, a documented environment delta) belongs in the routing recommendation and the user-owned follow-up, and is settled in the next fix run where the verifier re-checks the finding and cites it `resolved`.
 - **Rollback verification** (advisory — never blocks): a human-facing record of whether the plan's rollback path is still valid after the changes. A rollback is executed by a human, not by an okstra worker/verifier, so nothing here blocks the run, forces a `contract-violated` outcome, or routes back to planning. Each `rollbackVerification` row's `result` is `ok` (verified), `not-applicable` (nothing to roll back), or `advisory — human-run` (could not verify here; a human owns it). Strength of the record depends on the change category:
   - **Pure code changes** (no persisted state, no infra mutation): a reachable revert SHA is sufficient. Record the exact `git revert <SHA>` command that would undo the change, and confirm `git rev-parse <SHA>` resolves.
   - **Feature-flag-gated changes**: prefer confirming the off-switch path was exercised in this run's validation evidence (i.e. one of the validation commands ran with the flag off and succeeded). If the off-path was not exercised here, record the row as `advisory — human-run` rather than treating it as a blocking requirement.
@@ -41,6 +42,33 @@ are collected and convergence finished. Phase 1-5 do not need it.
 - **Routing recommendation**: `implementation.routingRecommendation` is an **object** with exactly two fields — `target`, one of `final-verification`, `error-analysis`, `implementation-planning`, `implementation`, and `rationale`, one or two sentences on why that target and nothing else. It is not a prose note: Phase 7 projects `workflow.nextRecommendedPhase` from `target` alone, so a phase named only in the prose does not route the task. Record the stage completion, validation outcome, failure-cause certainty, and plan-fit evidence; the lead chooses the destination using `prompts/lead/phase-routing.md` §implementation. **Enforced:** `schemas/final-report-v2.0.schema.json` rejects a `target` outside the enum, a missing `rationale`, and a string in place of the object.
 - **Follow-up tasks (Section 4 of the final report)**: every item discovered during this run that was *not* delivered MUST appear in the final report's `## 4. Follow-up Tasks` table with a concrete `Origin`, `New Task ID`, `Suggested task-type`, `Scope`, and `Reason / Why deferred`. Sources include: out-of-scope discoveries that the executor consciously chose not to fold into this run, verifier concerns the executor declined to fix in-place, scope-boundary items from the approved plan that turned out to need their own ticket, and any unresolved `## 1. Clarification Items` row carried over from the approved plan (`Status` ∈ `{open, answered}` at approval time). An empty section is acceptable but only when expressed as the single line `- No follow-up tasks.` — silence is treated as a contract violation. Rows with `Auto-spawn? = yes` will be materialised by `scripts/okstra-spawn-followups.py` in Phase 7; rows with `Auto-spawn? = no` MUST also appear in `Section 3. Recommended Next Steps` so the user knows to act manually.
 
+## Lead minor fix (decided after convergence, before the report-writer dispatch)
+
+When the synthesised verdict would be `FAIL` only because of verifier findings that are small and local, the lead fixes them itself in this run instead of ending it and opening a fix run. Decide after Phase 5.5 convergence, before building the report-writer dispatch prompt and before "Lead post-stage persistence" below. No worker dispatch is open then, so the edit falls inside no read-only worker's mutation audit window. Never edit while a verifier, convergence, or report-writer dispatch is running: its audit reports `readonly source changed` and discards that worker's result.
+
+**Eligibility.** Every rule holds for every blocking finding of the round, or the lead fixes none of them and the normal FAIL → fix-run path applies:
+
+1. The fix is a code change at, or next to, the location the verifier cited.
+2. The lead's total diff is at most 30 changed lines (added plus deleted, `git diff --numstat`).
+3. It changes no test's expected values or an assertion's meaning, adds no dependency, and changes no schema, migration, or config of record.
+4. It touches only files inside this stage's `plannedPaths` or files the executor already changed in this stage.
+5. One lead-fix pass per run. A failing re-run check gets no second attempt.
+
+A finding that needs no code change (convergence settled it as a verifier misreading) is not a lead fix; it stays in the routing recommendation and the verdict stays `FAIL`.
+
+**Procedure.**
+
+1. Edit in the stage worktree (`approvedPlanReference.executorWorktreePath`).
+2. Commit with a Conventional Commit (`fix(<scope>): …`) whose body names the finding id(s). Run the executor sidecar's ignored-file check on the staged paths first; it must print nothing.
+3. Re-run, each through `okstra worktree-lock --worktree <stage worktree> --command '<command>'`, the plan's Tier 1 command(s) that cover each fixed finding and the check the verifier reported failing. Keep each command line, exit code, and output tail.
+4. Every check exits 0: `result: pass`. The FAIL rows the fix answers no longer make the verdict `FAIL`, and the stage settles like any non-`FAIL` run. Any check exits non-zero: `result: fail`. Revert nothing; the verdict stays `FAIL`, the stage is withheld, and the next fix run starts from the lead commit.
+
+**Record.** One `implementation.leadFixes[]` entry per fixed finding group: `findingIds`, `verifiers` (the `verifierResults[].verifier` names whose FAIL it answers — every `FAIL` row is named by a passing entry before the stage may settle), `summary` (one sentence on what changed), `commit` (full SHA), `files`, `changedLines`, `commands[]` (`command`, `exitCode`, `outputTail`), and `result`. Keep each verifier's `FAIL` row as written. Leave the fixed findings out of `humanSummary.blockers`, and state in `userNarrative.validationExplanation` that the lead fixed them in this run.
+
+**Persistence after a passing fix.** The executor's `### Stage Carry Evidence` was emitted before the fix and names the pre-fix head. Before writing the carry sidecar, set `stageCommitRange.head` to the post-fix HEAD (`git rev-parse HEAD` in the stage worktree), add the fixed files to `filesChanged`, and append one `notes` line naming the lead commit and the finding ids. `stepResults` stays as the executor wrote it: a lead fix is not a plan step. Append the `done` row after the fix commit, so its `head_commit` is the post-fix HEAD, and capture `diffSummary` against the same head.
+
+**Enforced:** `validators/validate-run.py` `_validate_lead_fixes` (blocking) fails an entry recorded `pass` whose command exited non-zero or that has no command, an entry over 30 changed lines, and a settled stage holding a `result: fail` entry; it reports (advisory) a settled stage whose `FAIL` row no passing entry names in `verifiers` — advisory because validate-run runs after the `done` row is appended, so blocking would undo nothing. `_validate_lead_fix_carry_head` (advisory) reports a carry sidecar whose head is not a passing lead fix commit. Eligibility rules 1, 3, 4 and 5 and the match between findings and `findingIds` are instructions only: the report carries no structured finding id or planned-path list to compare against.
+
 ## Self-review pass before finalising the report (the Okstra lead runs this; do not delegate it)
 
 1. **Plan coverage** — for a selected-direction plan, every step in the approved `plan-ready` stage must point to a commit (or an explicit `Skipped: <reason>` entry), and the diff must preserve the selected snapshot's mechanism and invariants. For a legacy plan, every step in the effective implementation option (explicit frontmatter value or Recommended Option fallback) must point to a commit or an explicit skip. List gaps. A `RED:` step and its `GREEN:` step pointing to the same merged commit SHA is NOT a coverage gap — one SHA may be shared by both.
@@ -62,9 +90,9 @@ are collected and convergence finished. Phase 1-5 do not need it.
 
 - Parse the executor's `### Stage Carry Evidence` JSON block. If absent or unparsable, end with status `contract-violated` and route to a follow-up `error-analysis`.
 - The `### Stage Carry Evidence` JSON may include `designPrepEvidence[]`. Emit a row only when this stage produced concrete evidence that refines an effective PREP item: `itemId`, the injected `assessmentFingerprint`, `resolution`, and non-empty `evidence[]` are required; `overrides` is optional and only records observed, non-authoritative refinements. Carry evidence never represents user approval. Downstream resolution accepts it only from transitive dependency stages with the matching fingerprint.
-- **A `FAIL` synthesised verdict withholds the two writes below.** They are what marks the stage `done`, so performing them on a stage whose verifier found a blocking defect stacks the next stage on a confirmed regression. When the synthesised verdict is `FAIL`: write NO carry sidecar, and append a `status:"failed"` row in place of the `done` row — same `okstra_ctl.consumers.append_consumer` call, carrying `report_path` and the SHA of HEAD. That row is terminal *without* completion: dependent stages stay blocked because this stage is not done, while its worktree-registry occupancy is released so a fix run can re-enter the same stage number — `--stage <N>` reuses the preserved worktree and branch instead of provisioning a new one. State the reason in the report's `Stage sidecar evidence` section as `withheld`. **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` accepts a missing carry file only when that field is non-empty, so silently skipping the sidecar still fails the run.
+- **A `FAIL` synthesised verdict withholds the two writes below.** A verifier `FAIL` that a passing lead minor fix answered does not make the verdict `FAIL` (§"Lead minor fix"); persist with the post-fix head it names. They are what marks the stage `done`, so performing them on a stage whose verifier found a blocking defect stacks the next stage on a confirmed regression. When the synthesised verdict is `FAIL`: write NO carry sidecar, and append a `status:"failed"` row in place of the `done` row — same `okstra_ctl.consumers.append_consumer` call, carrying `report_path` and the SHA of HEAD. That row is terminal *without* completion: dependent stages stay blocked because this stage is not done, while its worktree-registry occupancy is released so a fix run can re-enter the same stage number — `--stage <N>` reuses the preserved worktree and branch instead of provisioning a new one. State the reason in the report's `Stage sidecar evidence` section as `withheld`. **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` accepts a missing carry file only when that field is non-empty, so silently skipping the sidecar still fails the run.
 - **A run that ends with no verifier result still closes.** When the stage ends before any verifier returned a verdict — the executor stopped without a change and the user chose not to verify, or every dispatched verifier ended without a result — append the `failed` row as above, record each roster verifier `not-run` with its reason (`okstra worker-state transition --team-state <path> --worker <worker-id> --status not-run --reason <text>`; a worker the dispatch skipped already carries one), and write the convergence state with `okstra convergence skip --run-manifest <path> --reason <text>` before dispatching the report writer. Without that state the report-writer packet refuses with `convergence … required source is missing`. The command refuses while any analyser, verifier, or critic attempt returned a result or is still running; such a run converges normally. In the report, write each verifier's `verifierResults[]` row as `verdict: not-run`, and state the reason under `Stage sidecar evidence` as `withheld`.
-- On a non-`FAIL` verdict, for this run's single stage: write its JSON verbatim to `runs/<impl-task-key>/carry/stage-<N>.json`. Refuse to overwrite an existing file (one stage = one sidecar; a fix run re-entering after a `failed` row writes the first one, because a withheld stage never wrote it). A stage reopened after a `done` row (see "Reopening a settled stage" below) still has the sidecar of the run that first settled it, naming a head the stage has since moved past: move it unchanged to `runs/<impl-task-key>/carry/superseded/stage-<N>-from-<that run's task-type>-<seq>.json` before writing the new one, and name both paths in `Stage sidecar evidence`. Do not rename it inside `carry/`: the readers glob `carry/stage-*.json` (`okstra_ctl.stage_map`, `okstra_ctl.consumers.backfill_done_from_carry`), so a renamed file there is read again as a live sidecar. A reopened stage whose run ends `FAIL` writes nothing and leaves the old file where it is.
+- On a non-`FAIL` verdict, for this run's single stage: write its JSON verbatim to `runs/<impl-task-key>/carry/stage-<N>.json` — after a passing lead minor fix, with the head, files, and note that §"Lead minor fix" adds. Refuse to overwrite an existing file (one stage = one sidecar; a fix run re-entering after a `failed` row writes the first one, because a withheld stage never wrote it). A stage reopened after a `done` row (see "Reopening a settled stage" below) still has the sidecar of the run that first settled it, naming a head the stage has since moved past: move it unchanged to `runs/<impl-task-key>/carry/superseded/stage-<N>-from-<that run's task-type>-<seq>.json` before writing the new one, and name both paths in `Stage sidecar evidence`. Do not rename it inside `carry/`: the readers glob `carry/stage-*.json` (`okstra_ctl.stage_map`, `okstra_ctl.consumers.backfill_done_from_carry`), so a renamed file there is read again as a live sidecar. A reopened stage whose run ends `FAIL` writes nothing and leaves the old file where it is.
 - On a non-`FAIL` verdict, for this run's single stage: append a `status:"done"` row to `runs/<plan-task-key>/consumers.jsonl` with `completed_at`, `carry_path`, `report_path` (this run's final-report path relative to the run root), and the SHA of HEAD. Append it with `okstra_ctl.consumers.append_consumer` (NOT a raw filesystem write) — that call honours the consumers lock AND releases this stage's worktree-registry occupancy, so later runs stop seeing a finished stage as a concurrent run. `report_path` lets `final-verification` cite each stage's originating report when assembling its Source Implementation Report list.
 - **Reopening a settled stage.** Appending a `status:"failed"` row after a `done` one withdraws that stage: `--stage N` accepts it again, its dependents stop resolving a base from the withdrawn head, and whole-task final-verification blocks until it is settled again. Use the same `okstra_ctl.consumers.append_consumer` call with a `reason`, and re-run the stage rather than repairing the tree outside okstra — a stage reverted outside the ledger leaves the recorded `head_commit` and the carry sidecar naming a tree that no longer exists, and the next stage branches from it.
 - The verifier round, Phase 5.5 convergence, and this Phase 6 report run **once per run** over this stage's diff — NOT per step.

package/runtime/python/okstra_ctl/phases/implementation/profile.md

@@ -3,6 +3,7 @@
 - Purpose: realise the approved `implementation-planning` deliverable as actual source changes, with cross-model verification, while keeping the run reversible
 - **Run-level fixed cost:** the verifier set, Phase 5.5 convergence, and the Phase 6 report-writer run exactly once per implementation run, over this run's single stage diff — never once per step.
 - **Fix run (profile carries a "Fix-Run Carry" block):** the executor's scope is the carried blocking findings plus the previous routing recommendation — it MUST NOT re-execute plan steps the previous run completed. Verifiers apply the "Fix-run incremental scope" section of `_implementation-verifier.md`. The full validation-command re-run is NOT reduced.
+- **Lead minor fix:** a verifier FAIL whose findings are small and local is fixed by the lead inside this run, after convergence and before the report-writer dispatch, under `_implementation-deliverable.md` "Lead minor fix"; a passing fix settles the stage without a fix run.
 - **Executor binding (resolved at run-prep time, fixed for this run):**
   - Executor display name: `{{EXECUTOR_DISPLAY_NAME}}`
   - Executor worker ID: `{{EXECUTOR_WORKER_ID}}`

package/runtime/python/okstra_ctl/phases/implementation/report_assets/implementation.template.html

@@ -26,6 +26,12 @@
   {% for row in implementation.verifierResults %}<article class="summary-card tone-{{ row.verdict | lower }}"><p class="eyebrow">{{ row.verifier | inline_code }} · <span class="status status-{{ row.verdict | lower }}">{{ row.verdict }}</span></p>{% for label, text in ((t('tasks.implementation.independent-rerun'), row.get("independentValidationRerun")), (t('tasks.implementation.command-log'), row.get("readOnlyCommandLog"))) if text %}<details><summary><strong>{{ label }}</strong> {{ t('tasks.implementation.entry-count') | replace('{count}', text.strip().splitlines() | select | list | length | string) }}</summary><pre>{{ text }}</pre></details>{% endfor %}{% if row.get("discrepancy") %}<p class="evidence-refs">{{ t('tasks.implementation.discrepancy') }} {{ row.discrepancy | inline_code }}</p>{% endif %}{% if row.get("declinedFixRecommendations") %}<p>{{ row.declinedFixRecommendations | inline_code }}</p>{% endif %}</article>{% endfor %}
 </section>
 
+{% if implementation.get("leadFixes") %}<section data-report-section="lead-fixes" data-report-field="implementation.leadFixes">
+  <h2>{{ t('tasks.implementation.lead-fixes') }}</h2>
+  <p>{{ t('tasks.implementation.lead-fixes-intro') }}</p>
+  {% for row in implementation.leadFixes %}<article class="summary-card tone-{{ 'neutral' if row.result == 'pass' else 'important' }}"><p class="eyebrow">{{ row.findingIds | join(', ') | inline_code }} · <span class="status status-{{ row.result }}">{{ t('tasks.implementation.lead-fix-result-' ~ row.result) }}</span></p><p>{{ row.summary | inline_code }}</p><table><tbody><tr><th>{{ t('tasks.implementation.commit') }}</th><td><code>{{ row.commit }}</code></td></tr><tr><th>{{ t('tasks.implementation.lead-fix-verifiers') }}</th><td>{{ row.verifiers | join(', ') | inline_code }}</td></tr><tr><th>{{ t('tasks.implementation.files') }}</th><td>{% for path in row.files %}<code>{{ path }}</code>{% if not loop.last %}, {% endif %}{% endfor %}</td></tr><tr><th>{{ t('tasks.implementation.lead-fix-changed-lines') }}</th><td class="figure">{{ row.changedLines }}</td></tr></tbody></table>{% for command in row.commands %}<details><summary><code title="{{ command.command }}">{{ command.command }}</code> · {{ t('tasks.implementation.exit-code') }} {{ command.exitCode }}</summary><pre>{{ command.outputTail }}</pre></details>{% endfor %}</article>{% endfor %}
+</section>{% endif %}
+
 <section data-report-section="remaining-issues">
   <h2>{{ t('tasks.implementation.what-is-left') }}</h2>
   {{ render_narrative(narrative.remainingIssues, "implementation.userNarrative.remainingIssues") }}

package/runtime/python/okstra_ctl/phases/implementation/spec.md

@@ -148,7 +148,7 @@ flowchart TD
     Verdict --> Report[Final report preserves dissent]
 ```
 
-Only the executor may mutate project files. The verifier independently re-runs the diff and validation command read-only in the same worktree. Even a verifier with the same provider as the executor runs again in a separate fresh CLI session. This is to prevent a structure where the same session approves a diff the same session wrote.
+Only the executor may mutate project files, with one exception: after the verifier round and convergence, the lead may fix small, local verifier FAIL findings itself (at most 30 changed lines, no test-expectation, dependency, schema, migration or config-of-record change), re-run the checks that found them, and settle the stage when they pass, instead of opening a fix run (`instructions/_implementation-deliverable.md` "Lead minor fix"). The verifier independently re-runs the diff and validation command read-only in the same worktree. Even a verifier with the same provider as the executor runs again in a separate fresh CLI session. This is to prevent a structure where the same session approves a diff the same session wrote.
 
 ## 5. stage and consumers
 
@@ -195,6 +195,7 @@ The final report requires at least the following.
 - actual stdout/stderr and exit code of the plan validation command
 - TDD failing-then-passing evidence
 - per-verifier independent validation rerun result
+- lead minor fixes, when any: finding ids, commit, files, changed lines, and re-run checks (`implementation.leadFixes`)
 - `carry/stage-<N>.json` evidence sidecar and `consumers.jsonl` started/done row
 - rollback verification
 - `implementation.manualUserTest` finalized against the actual diff and whether it is executable

package/runtime/python/okstra_ctl/phases/implementation/validation.py

@@ -175,6 +175,97 @@ def _validate_verifier_command_log_is_read_only(
             )
 
 
+LEAD_FIX_LINE_LIMIT = 30
+_LEAD_FIX_BLOCKING = "lead-fix BLOCKING:"
+
+
+def _stage_settled(implementation: dict) -> bool:
+    """carry 를 쓰고 `done` 행을 남긴 run — `withheld` 가 비어 있다."""
+    evidence = implementation.get("stageSidecarEvidence")
+    return isinstance(evidence, dict) and not str(evidence.get("withheld") or "").strip()
+
+
+def _lead_fix_rows(implementation: dict) -> list[dict]:
+    return [row for row in implementation.get("leadFixes") or [] if isinstance(row, dict)]
+
+
+def lead_fixed_verifiers(implementation: dict) -> frozenset[str]:
+    """정착된 stage 에서 통과한 리드 수정이 답한 FAIL 검증자 이름.
+
+    stage 가 `withheld` 이면 리드 수정은 아무것도 해소하지 않는다 — 다음 run 은
+    그 FAIL 행을 그대로 fix-run carry 로 받아야 한다.
+    """
+    if not _stage_settled(implementation):
+        return frozenset()
+    return frozenset(
+        str(name)
+        for row in _lead_fix_rows(implementation)
+        if row.get("result") == "pass"
+        for name in row.get("verifiers") or []
+    )
+
+
+def _validate_lead_fixes(data: dict, failures: list[str]) -> None:
+    """리드 수정 기록과, FAIL 이 남은 채 정착된 stage 를 검사한다.
+
+    `_implementation-deliverable.md` "Lead minor fix": 검증자 FAIL 이 있는 stage 를
+    `done` 으로 정착시킬 수 있는 길은 재실행 검사가 전부 통과한 리드 수정뿐이다.
+    finding 단위 대응은 검사하지 않는다 — `verifierResults[]` 에 구조화된 finding
+    id 가 없어 계산할 수 없다. 검증자 행 단위(`verifiers`)까지만 본다.
+    """
+    implementation = data.get("implementation")
+    if not isinstance(implementation, dict):
+        return
+    fixes = _lead_fix_rows(implementation)
+    for index, row in enumerate(fixes):
+        ids = ", ".join(str(item) for item in row.get("findingIds") or []) or "no finding id"
+        label = f"implementation.leadFixes[{index}] ({ids})"
+        commands = [cmd for cmd in row.get("commands") or [] if isinstance(cmd, dict)]
+        failed = [cmd for cmd in commands if cmd.get("exitCode") != 0]
+        if row.get("result") == "pass" and (failed or not commands):
+            evidence = (
+                f"`{str(failed[0].get('command'))[:120]}` exited {failed[0].get('exitCode')}"
+                if failed else "no re-run command is recorded"
+            )
+            failures.append(
+                f"{_LEAD_FIX_BLOCKING} {label} records `result: pass` but {evidence}. "
+                "A lead fix passes only when every re-run check exits 0; otherwise "
+                "record `result: fail` and withhold the stage."
+            )
+        lines = row.get("changedLines")
+        if isinstance(lines, int) and lines > LEAD_FIX_LINE_LIMIT:
+            failures.append(
+                f"{_LEAD_FIX_BLOCKING} {label} changed {lines} lines; a lead minor fix "
+                f"is limited to {LEAD_FIX_LINE_LIMIT}. A larger change belongs to a fix "
+                "run, where the verifiers review it."
+            )
+    if not _stage_settled(implementation):
+        return
+    unsettled = [index for index, row in enumerate(fixes) if row.get("result") != "pass"]
+    if unsettled:
+        failures.append(
+            f"{_LEAD_FIX_BLOCKING} implementation.leadFixes{unsettled} recorded "
+            "`result: fail` but the stage was settled (no `stageSidecarEvidence.withheld`). "
+            "A failed lead fix leaves the verdict FAIL: withhold the carry sidecar and "
+            "append a `failed` consumers row."
+        )
+    rejected = {
+        who for who, row in _verifier_rows(data)
+        if str(row.get("verdict") or "").strip() == "FAIL"
+    }
+    uncovered = sorted(rejected - lead_fixed_verifiers(implementation))
+    if uncovered:
+        # 권고로 둔다 — 정착 여부는 종합 판정이 정하고, 수렴에서 반박된 한 검증자의
+        # FAIL 위에 PASS 로 정착한 run 은 계약대로다. 막으면 그런 run 이 전부 멈춘다.
+        failures.append(
+            f"lead-fix advisory: verifier(s) {uncovered} recorded `verdict: FAIL` but "
+            "the stage was settled (no `stageSidecarEvidence.withheld`) and no "
+            "`implementation.leadFixes[]` entry with `result: pass` names them in "
+            "`verifiers`. If convergence did not refute that FAIL, the stage should have "
+            "been withheld or answered by a passing lead minor fix."
+        )
+
+
 def _validate_verifier_fail_blocks_verdict(data: dict, failures: list[str]) -> None:
     """A verifier FAIL cannot be dropped during synthesis.
 

package/runtime/python/okstra_ctl/phases/implementation_planning/entry.py

@@ -47,15 +47,15 @@ def _resolve_planning_input_path(path_value: str, project_root: Path) -> Path |
     return None
 
 
-def _is_existing_planning_report(
-    path_value: str, project_root: Path, inp: PlanningInputs
+def is_existing_planning_report(
+    path_value: str, project_root: Path, task_group: str, task_id: str,
 ) -> bool:
     from okstra_ctl.paths import task_dir
 
     try:
         report = lexical_absolute_path(Path(path_value))
         task_root = lexical_absolute_path(
-            task_dir(project_root, inp.task_group, inp.task_id)
+            task_dir(project_root, task_group, task_id)
         )
         relative = report.relative_to(task_root)
     except ValueError:
@@ -95,8 +95,8 @@ def _validate_planning_entry_inputs(project_root: Path, inp: PlanningInputs) ->
     if inp.selected_direction_path:
         return
     if inp.clarification_response_path:
-        if not _is_existing_planning_report(
-            inp.clarification_response_path, project_root, inp
+        if not is_existing_planning_report(
+            inp.clarification_response_path, project_root, inp.task_group, inp.task_id
         ):
             raise PrepareError(
                 "implementation-planning rerun --clarification-response must point "

package/runtime/python/okstra_ctl/stage_fix_carry.py

@@ -15,6 +15,7 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from .json_boundary import JsonBoundaryError, load_owned_object
+from .phases.implementation.validation import lead_fixed_verifiers
 
 _REPORT_RE = re.compile(r"final-report-implementation-(\d+)\.data\.json$")
 
@@ -68,9 +69,12 @@ def derive_stage_fix_carry(
     impl = data.get("implementation")
     if not isinstance(impl, dict):
         return None
+    # 통과한 리드 수정이 답한 FAIL 은 그 run 안에서 해소됐다 — 다시 fix run 으로 넘기지 않는다.
+    fixed = lead_fixed_verifiers(impl)
     failed = [
         row for row in impl.get("verifierResults") or []
         if isinstance(row, dict) and row.get("verdict") == "FAIL"
+        and str(row.get("verifier") or "") not in fixed
     ]
     if not failed:
         return None

package/runtime/python/okstra_ctl/wizard/registry.py

@@ -588,10 +588,12 @@ STEPS: list[Step] = [
                             and s.confirmed is None),
          build=_build_confirm, submit=_submit_confirm,
          owns=("confirmed", "edit_target", "confirmation_prompt", "confirmation_stages", "confirmation_scope", "user_authorization")),
+    # 되감기는 이 step 뒤에서 일어나 answered 에 남는다. 반복 가능이 아니면 두 번째
+    # 수정에서 건너뛰어져 위저드가 미확정인 채 done 을 냈다(dev-11126 planning).
     Step(S_EDIT_TARGET,
          applies=lambda s: s.confirmed is False and not s.edit_target,
          build=_build_edit_target, submit=_submit_edit_target,
-         owns=()),
+         owns=(), repeatable=True),
 ]
 
 

package/runtime/python/okstra_ctl/wizard/steps_options.py

@@ -10,6 +10,7 @@ from okstra_ctl.clarification_items import user_response_sidecars
 from okstra_ctl.manager_paths import MANAGER_CONTEXT_DIRECTIVE_PREFIX
 from okstra_ctl.json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from okstra_ctl.report_language import is_language_tag
+from okstra_ctl.phases.implementation_planning.entry import is_existing_planning_report
 from okstra_ctl.pr_template import PrTemplateError, resolve_pr_template_path
 from okstra_project.dirs import project_json_path
 from okstra_project.state import StateError, list_project_tasks
@@ -358,6 +359,16 @@ def _submit_clarification(state: WizardState, value: str) -> Optional[str]:
         state.clarification_response_path = ""
         return "clarification: (none)"
     p = _require_file(val, Path(state.project_root), "clarification-response")
+    # prepare 가 거절할 경로를 여기서 받으면 재실행이 조용히 새 계획 흐름
+    # (selected_direction_pick)으로 바뀌었다(dev-11126: implementation 리포트를 넣음).
+    if state.task_type == "implementation-planning" and not is_existing_planning_report(
+        str(p), Path(state.project_root), state.task_group, state.task_id,
+    ):
+        raise WizardError(
+            "an implementation-planning rerun takes an implementation-planning report "
+            "of this task (runs/implementation-planning/reports/"
+            f"final-report-implementation-planning-<seq>.data.json); got {p}"
+        )
     state.clarification_response_path = str(p)
     return f"clarification: {p}"
 

package/runtime/schemas/final-report-v3.0.schema.json

@@ -1347,6 +1347,13 @@
             "$ref": "#/$defs/VerifierResultBlock"
           }
         },
+        "leadFixes": {
+          "type": "array",
+          "description": "Lead minor fixes applied in this run after the verifier round (`_implementation-deliverable.md` \"Lead minor fix\"). Optional so reports of tasks already in flight keep validating.",
+          "items": {
+            "$ref": "#/$defs/LeadFixRow"
+          }
+        },
         "rollbackVerification": {
           "type": "array",
           "minItems": 1,
@@ -10063,6 +10070,92 @@
         }
       }
     },
+    "LeadFixRow": {
+      "type": "object",
+      "description": "One lead minor fix: the verifier findings it answers, the commit that carries it, and the re-run checks that decide whether the run may settle the stage. `changedLines` has no schema maximum on purpose: an over-limit fix must still be recordable, and `_validate_lead_fixes` reports it.",
+      "required": [
+        "findingIds",
+        "verifiers",
+        "summary",
+        "commit",
+        "files",
+        "changedLines",
+        "commands",
+        "result"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "findingIds": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "verifiers": {
+          "description": "The `verifierResults[].verifier` names whose FAIL this fix answers.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "summary": {
+          "type": "string",
+          "minLength": 1
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{7,40}$"
+        },
+        "files": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "changedLines": {
+          "description": "Added plus deleted lines of the lead commit (`git diff --numstat`).",
+          "type": "integer",
+          "minimum": 1
+        },
+        "commands": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "command",
+              "exitCode",
+              "outputTail"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "command": {
+                "type": "string",
+                "minLength": 1
+              },
+              "exitCode": {
+                "type": "integer"
+              },
+              "outputTail": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "result": {
+          "enum": [
+            "pass",
+            "fail"
+          ]
+        }
+      }
+    },
     "RollbackVerificationRow": {
       "type": "object",
       "required": [

package/runtime/skills/okstra-run/SKILL.md

@@ -428,7 +428,7 @@ If the anchor (`implementation_base_commit`) is reported unresolvable, run the s
 Because of the dependency closure, the chain queue **may include a stage that another implementation run has occupied as started/reserved.** That stage's `render-bundle` is rejected with `--stage N already in progress or reserved by another run` (StageTargetError). This is **not** an exception gate needing human judgment but a "next stage not yet ready" situation. On this rejection, **terminate the chain normally** and report the remaining queue to the user (e.g. `remaining queue: stage 4, 5 — resume with okstra-run after occupancy is released`). This is a different branch from the exception gate below (data corruption·concurrent-occupancy conflict confirmation).
 
 ### Stage ended FAIL — stop the queue and report (not an exception gate)
-When a stage's synthesised verdict is `FAIL`, Phase 6 writes no carry sidecar and appends a `status:"failed"` row in place of `done` (`scripts/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md` "Lead post-stage persistence"). **Stop the queue at that stage** and report the failed stage, its report path, and the remaining queue (e.g. `stage 1 FAIL — remaining queue: stage 2, 3, 5; re-enter with okstra-run --stage 1 after the fix`). Do **not** continue to the next stage even when that stage is dependency-independent: an unattended chain that keeps building past a confirmed regression stacks later work on top of it. The `failed` row releases the stage's occupancy, so `--stage <N>` re-enters the same stage on its preserved worktree and branch — there is nothing to unblock by hand.
+A verifier FAIL that a passing lead minor fix answered does not make the verdict `FAIL` (`_implementation-deliverable.md` "Lead minor fix"); that stage settles `done` and the queue continues. When a stage's synthesised verdict is `FAIL`, Phase 6 writes no carry sidecar and appends a `status:"failed"` row in place of `done` (`scripts/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md` "Lead post-stage persistence"). **Stop the queue at that stage** and report the failed stage, its report path, and the remaining queue (e.g. `stage 1 FAIL — remaining queue: stage 2, 3, 5; re-enter with okstra-run --stage 1 after the fix`). Do **not** continue to the next stage even when that stage is dependency-independent: an unattended chain that keeps building past a confirmed regression stacks later work on top of it. The `failed` row releases the stage's occupancy, so `--stage <N>` re-enters the same stage on its preserved worktree and branch — there is nothing to unblock by hand.
 
 ### Exception gate during chaining
 If `render-bundle` raises Step 5's concurrent-run conflict detection (concurrent-run branch) or git stale-SHA reconciliation (git-reconcile branch), **stop the chain at that stage** and present the gate to the user exactly as Step 5 prescribes. Once the user resolves the gate, resume the chain in place (continue with the remaining queue). Data corruption·concurrent-occupancy conflicts are confirmed by a human — this is the safety boundary of unattended chaining. (Unlike the "not ready" rejection above, these two branches do not discard the queue; they wait for user resolution.)

package/runtime/templates/reports/html/i18n/en.json

@@ -673,6 +673,12 @@
       "action-deleted": "Deleted",
       "what-it-does": "What it does",
       "advisory": "advisory",
+      "lead-fixes": "Fixed by the lead after verification",
+      "lead-fixes-intro": "A verifier rejected the change for a small, local defect. The lead fixed it in this run and re-ran the checks that found it, instead of starting a fix run.",
+      "lead-fix-verifiers": "Answers the FAIL of",
+      "lead-fix-changed-lines": "Changed lines",
+      "lead-fix-result-pass": "checks pass",
+      "lead-fix-result-fail": "checks still fail",
       "entry-count": "{count} entries",
       "manual-user-test": "Manual user test",
       "environment": "Environment:",

package/runtime/templates/reports/html/i18n/ko.json

@@ -673,6 +673,12 @@
       "action-deleted": "삭제",
       "what-it-does": "하는 일",
       "advisory": "권고",
+      "lead-fixes": "검증 뒤 리드가 고친 것",
+      "lead-fixes-intro": "검증자가 작고 국소적인 결함으로 변경을 거부했습니다. 리드가 fix run 을 새로 여는 대신 이 run 안에서 고치고, 그 결함을 찾은 검사를 다시 돌렸습니다.",
+      "lead-fix-verifiers": "FAIL 을 낸 검증자",
+      "lead-fix-changed-lines": "바뀐 줄 수",
+      "lead-fix-result-pass": "검사 통과",
+      "lead-fix-result-fail": "검사 여전히 실패",
       "entry-count": "{count}개 항목",
       "manual-user-test": "수동 사용자 테스트",
       "environment": "환경:",

package/runtime/validators/validate-run.py

@@ -40,6 +40,7 @@ from okstra_ctl.phases.implementation.validation import (
     _validate_verifier_reran_independently,
     _validate_verifier_discrepancy_is_not_passed,
     _validate_verifier_fail_blocks_verdict,
+    _validate_lead_fixes,
     _validate_verifier_command_log_is_read_only as validate_verifier_command_log_is_read_only,
     _validate_verifier_discrepancy_names_checklist_phase as validate_verifier_discrepancy_names_checklist_phase,
     _warn_out_of_plan_edits_not_in_diff as warn_out_of_plan_edits_not_in_diff,
@@ -194,6 +195,7 @@ from okstra_ctl.dispatch_state import (  # noqa: E402
     v2_worker_state_key,
 )
 from okstra_ctl.paths import RunRef, okstra_home, project_rel  # noqa: E402
+from okstra_ctl.consumers import carry_head_commit  # noqa: E402
 from okstra_ctl.tdd_bypass import (  # noqa: E402
     bypass_file as tdd_bypass_file,
     granted_stages,
@@ -3182,6 +3184,8 @@ def validate_final_report_data(
         )
     elif task_type == "implementation":
         _validate_stage_carry_sidecar_exists(data, report_path, failures)
+        _validate_lead_fixes(data, failures)
+        _validate_lead_fix_carry_head(data, report_path, failures)
     _validate_lead_authored_report(data, report_path, failures)
     if task_type == "error-analysis":
         _validate_error_analysis_consistency(data, failures)
@@ -4090,6 +4094,53 @@ def _validate_stage_carry_sidecar_exists(
         )
 
 
+def _validate_lead_fix_carry_head(
+    data: dict,
+    report_path: Path,
+    failures: list[str],
+) -> None:
+    """A settled stage with a passing lead fix must carry the post-fix head.
+
+    The executor emits the carry before the verifier round, so its
+    `stageCommitRange.head` names the pre-fix commit. Persisted verbatim, the
+    next dependent stage branches from a head without the fix
+    (`consumers.backfill_done_from_carry` reads the same field). Advisory: the
+    carry file is never overwritten, so a blocking failure here would leave
+    the run no way forward.
+    """
+    implementation = data.get("implementation")
+    if not isinstance(implementation, dict):
+        return
+    evidence = implementation.get("stageSidecarEvidence")
+    if not isinstance(evidence, dict) or str(evidence.get("withheld") or "").strip():
+        return
+    stage = evidence.get("stageNumber")
+    commits = {
+        str(row.get("commit"))
+        for row in implementation.get("leadFixes") or []
+        if isinstance(row, dict) and row.get("result") == "pass" and row.get("commit")
+    }
+    if not isinstance(stage, int) or not commits:
+        return
+    carry_path = RunRef.from_report_path(report_path).carry(stage)
+    if not carry_path.is_file():
+        return
+    try:
+        carry = json.loads(carry_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        failures.append(f"lead-fix carry: cannot read {carry_path.name} to compare its head: {exc}")
+        return
+    head = carry_head_commit(carry) if isinstance(carry, dict) else ""
+    if not any(head and (head.startswith(c) or c.startswith(head)) for c in commits):
+        failures.append(
+            f"lead-fix carry: {carry_path.name} names head `{head or '<none>'}`, not "
+            f"a passing lead fix commit {sorted(commits)}. Dependent stages branch "
+            "from that head and miss the fix; set `stageCommitRange.head` to the "
+            "post-fix HEAD before persisting the carry "
+            '(_implementation-deliverable.md "Lead minor fix").'
+        )
+
+
 def _normalize_report_contracts(raw_contracts: object) -> set[str]:
     if isinstance(raw_contracts, str):
         candidates = [raw_contracts]