okstra 0.218.0 → 0.219.1

package/runtime/python/okstra_ctl/phases/implementation/spec.md

@@ -172,6 +172,10 @@ Stage selection is `auto` or a number. If `--stage` comes from another task-type
 
 The stage worktree base is decided by dependency shape. An independent stage uses the task-key worktree HEAD fixed at first implementation entry as its anchor, and a single-dependency stage branches from the predecessor stage's done `head_commit`. A multi-dependency stage branches from a commit holding exactly its predecessors: the predecessor commit that already contains the others, or else an integration branch merging them (`<work-category-namespace>/<task-id-segment>-g<n1>-<n2>`). okstra creates that branch itself, so a predecessor that has not been merged into the task branch no longer blocks the stage; release-handoff later reuses the same branch as that stage's PR base.
 
+When a predecessor advances, implementation entry synchronizes existing completed stage branches in dependency order through `okstra_ctl.stage_rebase.synchronize_stage_stack`. Each downstream stage is rebased with `git rebase --onto <new-base> <recorded-old-base>`; merging a moving predecessor into that stage is not an update strategy. Re-entering an unfinished stage also rebases its existing worktree when the computed base changes. Old heads are preserved under `refs/okstra/rebase-backups/`, registry bases and completion records are updated, and previous verification no longer qualifies. Conflicts abort the current rebase and stop the chain; active runs and dirty worktrees are not rewritten. Tests: `tests/worktree/test_stage_rebase.py`.
+
+Successful implementation report finalization automatically removes that stage's clean worktree after its `done` record is persisted. The report's last commit, the completion ledger, and the current branch tip must agree for cleanup (`stage_integrate.reclaim_completed_stage`). Failed, active, dirty, nested, or moved stages are preserved with a reason in the finalization step result. Cleanup retains the branch and registry base; implementation re-entry and final-verification restore the worktree from that branch. The task worktree and other stages are outside this scoped cleanup. Tests: `tests/worktree/test_stage_rebase.py` and `tests/report/test_report_finalize.py`.
+
 ## 6. Deliverables
 
 ```mermaid

package/runtime/python/okstra_ctl/phases/release_handoff/boundary.json

@@ -2,7 +2,7 @@
   "allowed": "  - entering this phase only when the cited final-verification report's verdict is release-ready — `Verdict Token` exactly `accepted`, or exactly `conditional-accept` with every Conditional Acceptance Condition row declaring `blocksReleaseHandoff: false` (`okstra_ctl.release_gate.release_handoff_allowed`)\n  - asking the user (via `AskUserQuestion` / interactive prompt) which delivery action to take: `local checkout`, `push + PR`, or `skip` (end the run)\n  - asking the user to pick a PR base branch from `staging` | `preprod` | `prod` | `main` | `dev` | a user-supplied branch name\n  - drafting PR title and PR body **inline as the Okstra lead** (no drafter worker and no delegated dispatch); the lead reviews its own draft with the user before any mutating git / gh command runs\n  - read-only git inspection: `git status`, `git diff`, `git log`, `git rev-parse`\n  - pushing the current feature branch to its origin remote via `git push -u origin <current-branch>` (the feature branch only — NEVER the base branch)\n  - creating a pull request via `gh pr create --base <chosen-base> --head <current-branch>`; if a PR with the same head already exists, surface its URL and skip creation\n  - the lead writes the final report directly (no `Report writer worker` dispatch); the report still conforms to the standard final-report template",
   "forbidden": [
     "entering this phase when the cited final-verification `Verdict Token` is `conditional-accept` or `blocked`, or when no final-verification report is cited",
-    "local commit commands of any kind (`git add`, `git commit`, `git restore --staged`, `git stash`), and any direct `git merge` / `git rebase` / `git rebase --onto` / `git cherry-pick` / `git commit --amend` run by the lead. The single exception is the merge commits `okstra handoff pr-plan` itself creates on a `merge-base` branch — the lead never merges by hand. Rewriting a stage branch breaks the PR stack that sits on it.",
+    "local commit commands of any kind (`git add`, `git commit`, `git restore --staged`, `git stash`), and any direct `git merge` / `git rebase` / `git rebase --onto` / `git cherry-pick` / `git commit --amend` run by the lead. Runtime exceptions are dependency-ordered rebases by `okstra_ctl.stage_rebase` (which invalidate verification and stop PR delivery), and merge commits on a dedicated multi-predecessor `merge-base` branch. Never merge a moving predecessor or origin branch into a downstream stage to update its base.",
     "any git push variant that rewrites remote history, regardless of intent or whether the user said \"force it\": `git push --force`, `git push --force-with-lease`, `git push -f`, `git push +<refspec>`, or any other history-rewriting invocation",
     "pushing directly to a release base branch — i.e. `git push origin <branch>` where `<branch>` is `main`, `master`, `prod`, `preprod`, `staging`, `dev`, or the branch the user chose as the release base in this run. The only permitted push targets are the branches `okstra handoff pr-plan` listed for this run (each stage `head_branch`, and any `merge-base` branch).",
     "bypassing repo safeguards: `--no-verify` / `-n` on `git push`, bypassing GPG signing, disabling safeguards via equivalent flags, or any hook bypass.",

package/runtime/python/okstra_ctl/phases/release_handoff/operations.py

@@ -5,9 +5,14 @@ import subprocess
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
+from okstra_project.dirs import okstra_home
+
 from okstra_ctl import consumers, stage_targets, worktree_registry
 from okstra_ctl.handoff_verification import verification_row_is_current
 from okstra_ctl.handoff_error import HandoffError
+from okstra_ctl.locks import worktree_provision_mutex
+from okstra_ctl.stage_rebase import synchronize_stage_stack
+from okstra_ctl.stage_targets import StageWorktreeIdentity
 from okstra_ctl.stage_integrate import (
     IntegrateError, MergeBranchConflict, ensure_stage_merge_branch,
 )
@@ -306,15 +311,31 @@ def _reconcile_with_origin(
 def pr_plan(*, project_root, plan_run_root, stage_map, stages, base_branch,
             work_category, project_id, task_group, task_id) -> Dict[str, Any]:
     """선택한 stage 각각의 PR head/base 를 정하고, 필요한 선행 머지 브랜치를
-    만든다. PR 은 stage 당 하나이고 head 는 그 stage 의 스택 브랜치다 — 커밋
-    히스토리를 접지 않으므로 이 경로는 stage 브랜치를 고쳐 쓰지 않는다."""
-    stages = sorted(set(stages))
+    만든다. 이동한 의존 기준은 먼저 재배치하고 재검증 전에는 전달하지 않는다."""
+    try:
+        with worktree_provision_mutex(okstra_home(), project_id, task_group, task_id):
+            rebased = synchronize_stage_stack(
+                project_root=Path(project_root), plan_run_root=Path(plan_run_root),
+                stage_map=stage_map,
+                identity=StageWorktreeIdentity(project_id, task_group, task_id, work_category),
+            )
+    except RuntimeError as exc:
+        raise HandoffError(str(exc)) from exc
+    if rebased:
+        raise HandoffError(
+            f"stages {rebased} were rebased onto updated dependencies; "
+            "re-run final-verification before release-handoff"
+        )
     rows = consumers.read_consumers(Path(plan_run_root))
     _require_eligible(stage_map, rows, stages)
     _run_git(["fetch", "origin", base_branch], project_root)
     done = consumers.latest_done_by_stage(rows)
     pr_covered = consumers.pr_covered_stages(rows)
     by_n = {s["stage_number"]: s for s in stage_map}
+    stages = stage_targets.order_stage_closure(
+        [(n, s.get("depends_on") or []) for n, s in by_n.items()],
+        set(stages), set(by_n) - set(stages),
+    )
     anchor_base = worktree_registry.get_implementation_base(
         project_id, task_group, task_id) or ""
 

package/runtime/python/okstra_ctl/phases/release_handoff/profile.md

@@ -3,7 +3,7 @@
 - Record the handoff shape in `releaseHandoff.handoffScope`: the `stages` this run delivered and
   the `releaseBase` the user picked. The report is the only place a reader learns which stages
   shipped and in what order their PRs must be merged — the branch names do not say.
-- Purpose: take a release-ready single-stage final-verification verdict for each already-committed implementation stage and turn it into a delivered push and/or pull request, with explicit user selection at every mutating step. **One stage is one PR.** The PR head is that stage's stack branch (`<prefix>-<task-id>-s<N>`); nothing is squashed, rebased, or collected into a bundle branch.
+- Purpose: take a release-ready single-stage final-verification verdict for each already-committed implementation stage and turn it into a delivered push and/or pull request, with explicit user selection at every delivery step. **One stage is one PR.** The PR head is that stage's stack branch (`<prefix>-<task-id>-s<N>`); nothing is squashed or collected into a bundle branch. Runtime dependency rebases happen before delivery and invalidate the prior verification.
 - **Execution model: single-lead, no worker dispatch.** This phase is a thin orchestrator over `git` / `gh`; it does NOT dispatch teammates, does NOT dispatch analysis or drafter sub-agents, and does NOT run convergence. The host-native Okstra lead performs every step inline (drafting PR text, asking the user, running git / gh, writing the final report) — see "Lead-only contract" below.
 - Worker roster: none — `profile.json` declares no roles; the run is executed entirely by the Okstra lead.
 - Lead-only contract (replaces the shared team contract for this phase):
@@ -20,7 +20,7 @@
   - the lead MUST capture `git status --short` and confirm the working tree is clean. Dirty state aborts the run; release-handoff packages the commits produced by `implementation`, it does not stage or commit changes.
   - the lead MUST capture `git rev-parse --abbrev-ref HEAD` and record it as the run's current branch. It is evidence, not a PR head: every PR head comes from `okstra handoff pr-plan`. If the current branch is `main`, `master`, `prod`, `preprod`, `staging`, or `dev`, record it and do not push it — release-handoff never pushes a base branch.
   - before pushing, run `okstra handoff pr-plan` again if anything mutated since entry, and confirm each selected stage is still present in its output. `pr-plan` re-checks eligibility and each stage's recorded verified commit. Record the pr-plan output in Executed Commands. These pre-push comparisons are lead instructions; the automated entry checks are enforced by `okstra_ctl.handoff_verification` and the handoff tests.
-- **Commit history is preserved — structurally, not as a preference.** These PRs are a stack: stage N's PR base is stage N-1's branch. Squash-merging a PR in the stack replaces its commits with a new one, so the next PR's base points at commits that no longer exist on the target branch and its diff re-shows the predecessor's changes. Therefore: okstra never rebases, squashes, amends, or cherry-picks a stage branch, and the merge policy — **merge commit or rebase-merge, never squash, and merge in ascending stage order** — is stated to the operator in the final report's `Stage PR Plan` and next-action narrative. It does NOT go into the PR body: the reviewer of one stage's PR is not the person merging the stack, and the block was noise they deleted by hand (2026-09-24, dev-10860 PRs #1487-#1490).
+- **Dependency updates use rebase.** When a predecessor advances, the runtime replays each dependent stage's own commits onto the new base in dependency order with `git rebase --onto`; never merge a moving predecessor into a downstream stage. `okstra_ctl.stage_rebase.synchronize_stage_stack` enforces this at implementation entry, verification target acquisition, and PR planning. It preserves the old head under `refs/okstra/rebase-backups/`, updates the registry base and completion ledger, and invalidates prior verification. Conflicts abort the current rebase and stop the remaining stages. The lead does not rebase or merge by hand. A rebase during `pr-plan` stops delivery and requires fresh final-verification. Remote divergence stops delivery for explicit user instructions; never repair it by merging origin back into the rebased stage. Merge PRs in dependency order, using merge commits or rebase-merge rather than squash. State that order and rule in the final report and closeout, not in individual PR bodies.
 - User interaction protocol (Okstra lead — performed in order, using the selected runtime adapter's interactive prompt):
   1. **Action selection** — present three choices and capture exactly one:
      - `local checkout` — bring one stage's branch into the MAIN worktree for local testing (no push, no PR). See step 1c.
@@ -39,8 +39,8 @@
       `okstra handoff pr-plan --plan-run-root <...> --approved-plan <...> --project-root <project root> --project-id <id> --task-group <g> --task-id <t> --work-category <c> --stages <HANDOFF_STAGES> --base <chosen-base>`.
       It returns one row per stage with `head_branch`, `head_commit`, `base_kind` (`release-base` | `stage` | `merge-base`), `base_branch` and `base_commit`. Exit 2 means the predecessors of a multi-dependency stage conflict with each other: show the `conflicts` paths and stop (route: resolve manually, then retry). Exit 1 means an eligibility or dependency violation — most often a stage whose predecessor is neither in this run nor already PR'd nor merged into the release base: show the error verbatim and re-ask the action selection. On success these rows are authoritative for every subsequent step; the lead does not recompute a base by hand.
       A `merge-base` row means `pr-plan` created a branch merging that stage's predecessors. That branch is a PR base only — it is never a PR head — and it MUST be pushed before the PR that targets it.
-      The output also carries `push_plan` and `warnings`. `push_plan` is every branch the PRs sit on, already in push order (each `merge-base` first, then the stage heads in ascending order), with the `commit` it must reach and an `action` of `create` (origin does not have it), `fast-forward` (origin is behind) or `up-to-date` (origin already has that commit — do not push it). GitHub resolves a PR's head and base by name on origin, so this list, not the local branch set, is what makes the stack real. A `warnings` row means `pr-plan` fast-forwarded a local branch to origin because origin was ahead: the commits origin adds are outside what this run verified. Quote every `warnings` row verbatim in Executed Commands and say so in the branch/PR explanation — the user is deciding whether to release commits this run did not verify. `pr-plan` refuses outright when a branch moved outside okstra or diverged from origin, since only a force push could deliver it.
-  2b. **Pre-merge conflict probe** (only when the user picked `push + PR`) — before pushing, for each planned stage in ascending order:
+      The output also carries `push_plan` and `warnings`. `push_plan` is every branch the PRs sit on, already in push order (each `merge-base` first, then the stage heads in dependency order), with the `commit` it must reach and an `action` of `create` (origin does not have it), `fast-forward` (origin is behind) or `up-to-date` (origin already has that commit — do not push it). GitHub resolves a PR's head and base by name on origin, so this list, not the local branch set, is what makes the stack real. A `warnings` row means `pr-plan` fast-forwarded a local branch to origin because origin was ahead: the commits origin adds are outside what this run verified. Quote every `warnings` row verbatim in Executed Commands and say so in the branch/PR explanation — the user is deciding whether to release commits this run did not verify. `pr-plan` refuses outright when a branch moved outside okstra or diverged from origin, since only a force push could deliver it.
+  2b. **Pre-merge conflict probe** (only when the user picked `push + PR`) — before pushing, for each planned stage in dependency order:
      - run `git fetch origin <chosen-base>` once (read-only on the local working tree).
      - run `git merge-tree --write-tree <head_branch> <base_branch>` for that stage, using the `base_branch` from the pr-plan row (`origin/<chosen-base>` for a `release-base` row). Exit 0 means clean. Exit 1 with a result-tree object ID on the first stdout line means a merge conflict. A missing result tree, or any other exit code, is an execution error: stop and report it, without offering permission to proceed as if it were a content conflict. An invalid ref can also return exit 1, so the exit code alone is insufficient.
      - If no stage conflicts, proceed silently to Q3 (do NOT add a confirmation prompt — keep the happy path frictionless).
@@ -59,12 +59,12 @@
   - produce **two artifacts per stage** before showing them to the user:
     1. **PR title** — by default the subject of that stage's most recent implementation commit, or a concise Conventional Commits-style summary of the stage's committed range.
     2. **PR body** — markdown filled from `PR_TEMPLATE_PATH`, and nothing else. Do NOT append a stack plan, a stage checklist, a sentence about where this PR stops in the stack, or a merge-policy line: the stack's shape and merge rule belong to the final report and the closeout, not to a reviewer's PR. The user-confirmation step's diff (Q3 `edit then proceed`) is computed against the filled template, not against the raw template file.
-  - **Filled-body self-check (runs on each drafted body, before Q3 shows it).** "Fill in the placeholders" is only observable if someone checks that they were filled, so scan the drafted body for these and carry the result into Q3: a residual HTML comment or template marker (`<!-- … -->`, `_Describe your changes…_`, a bare `TODO` / `FIXME` the diff did not introduce), an unchecked `- [ ]` box with no inline N/A justification, a section heading whose body is empty, and a whole body short enough to carry no substance. Each hit is reported to the user with its line — never silently left in, and never auto-filled with invented content. The user remains free to accept it; the point is that they see it before choosing `use as-is`.
+  - **Filled-body self-check (runs on each drafted body, before Q3 shows it).** First write the drafted title and body to a file in this run's artifact directory and run `okstra pr check --body-file <that file>` from the stage worktree or the MAIN worktree; each `L<line>: <pattern>: <match>` row it prints is an okstra identifier a reviewer cannot open, reported as a hit with its line (exit 1 means hits, not a failure of the run). Then, because "fill in the placeholders" is only observable if someone checks that they were filled, scan the drafted body for these and carry the result into Q3: a residual HTML comment or template marker (`<!-- … -->`, `_Describe your changes…_`, a bare `TODO` / `FIXME` the diff did not introduce), an unchecked `- [ ]` box with no inline N/A justification, a section heading whose body is empty, and a whole body short enough to carry no substance. Each hit is reported to the user with its line — never silently left in, and never auto-filled with invented content. The user remains free to accept it; the point is that they see it before choosing `use as-is`.
 - Allowed actions during the run (Okstra lead only):
-  - read-only inspection: `git status`, `git status --short`, `git diff`, `git log`, `git rev-parse`, `git ls-remote --heads origin <name>`, `gh pr list --head <branch>`, `gh pr view <url>`, and the drafting bundle `okstra pr gen --base <base_commit> --head <head_commit> --template-file <PR_TEMPLATE_PATH>`.
+  - read-only inspection: `git status`, `git status --short`, `git diff`, `git log`, `git rev-parse`, `git ls-remote --heads origin <name>`, `gh pr list --head <branch>`, `gh pr view <url>`, and the drafting bundle `okstra pr gen --base <base_commit> --head <head_commit> --template-file <PR_TEMPLATE_PATH>`, and the body check `okstra pr check --body-file <draft file>`.
   - merge-conflict probe (only when the user picked `push + PR`): `git fetch origin <chosen-base>` and the exact `git merge-tree` commands from step 2b. Both preserve the working tree and branch tips.
-  - branch push (only when the user picked `push + PR`): `git push -u origin <branch>` for each `push_plan` row whose `action` is `create` or `fast-forward`, in the order `push_plan` lists them (each `merge-base` branch before the PR that targets it, then the stage heads in ascending order). Skip an `up-to-date` row — origin already holds that commit. The pushed ref MUST come from a `push_plan` row — never the release base branch, and never a ref that list does not name.
-  - PR creation, one per stage (only when the user picked `push + PR` AND no PR with the same head already exists on origin): `gh pr create --base <row base_branch> --head <row head_branch> --title "<title>" --body "<body>"`. The title and body are the user-confirmed PR draft for that stage. Open them in ascending stage order so each base branch already exists on origin.
+  - branch push (only when the user picked `push + PR`): `git push -u origin <branch>` for each `push_plan` row whose `action` is `create` or `fast-forward`, in the order `push_plan` lists them (each `merge-base` branch before the PR that targets it, then the stage heads in dependency order). Skip an `up-to-date` row — origin already holds that commit. The pushed ref MUST come from a `push_plan` row — never the release base branch, and never a ref that list does not name.
+  - PR creation, one per stage (only when the user picked `push + PR` AND no PR with the same head already exists on origin): `gh pr create --base <row base_branch> --head <row head_branch> --title "<title>" --body "<body>"`. The title and body are the user-confirmed PR draft for that stage. Open them in dependency order so each base branch already exists on origin.
   - PR reuse: if `gh pr list --head <branch> --state open --json url --jq '.[0].url'` returns a URL, treat that PR as already existing — record the URL in the final report and SKIP `gh pr create` for that stage.
   - after each `gh pr create` succeeds (or an existing PR is reused), the lead MUST run `okstra handoff record-pr --plan-run-root <...> --stage <N> --branch <head branch> --base <base branch> --url <pr url>` and quote the command + exit code in the final report. One record-pr call per stage — the consumers ledger is what stops the same stage being PR'd twice.
   - stage helpers: `okstra handoff eligible`, `okstra handoff pr-plan`, `okstra handoff record-pr`, `okstra handoff local-checkout`. `pr-plan` is the ONLY path that may create commits in this phase (merge commits on a `merge-base` branch, and only for a multi-dependency stage).
@@ -73,8 +73,8 @@
 - Required deliverable shape (final report, in addition to the standard sections):
   - **Source Verification Reports**: one row per selected stage — relative path of that stage's originating `final-verification` final-report plus the literal quoted `Verdict Token` row, and — when that token is `conditional-accept` — every Conditional Acceptance Condition row quoted with its `blocksReleaseHandoff` value.
   - **Feature Branch & Working-Tree State**: the branch from `git rev-parse --abbrev-ref HEAD` at run start and the output of `git status --short` at run start.
-  - **Stage PR Plan**: the pr-plan rows — stage, head branch, head commit, base kind, base branch, base commit — plus, for every `merge-base` row, which predecessor stages it merges and the merge commits it created. This is the table a reader uses to merge the stack in the right order, so it carries the merge rule with it: merge in ascending stage order, with a merge commit or rebase-merge, never a squash.
-  - **User narrative `nextAction`**: when this run opened or reused any PR, it names the merge order (ascending stage number) and the merge rule (merge commit or rebase-merge, never squash), and says why — squashing one PR in the stack invalidates the next PR's base. This is where the operator reads the rule; the PR bodies do not carry it.
+  - **Stage PR Plan**: the pr-plan rows — stage, head branch, head commit, base kind, base branch, base commit — plus, for every `merge-base` row, which predecessor stages it merges and the merge commits it created. This is the table a reader uses to merge the stack in the right order, so it carries the merge rule with it: merge in dependency order, with a merge commit or rebase-merge, never a squash.
+  - **User narrative `nextAction`**: when this run opened or reused any PR, it names the merge order (dependency order) and the merge rule (merge commit or rebase-merge, never squash), and says why — squashing one PR in the stack invalidates the next PR's base. This is where the operator reads the rule; the PR bodies do not carry it.
   - **User Selections**: a block recording each prompt and the user's verbatim answer.
     - Q1 action: `local checkout` | `push + PR` | `skip`.
     - Q1c checkout stage (only when Q1 is `local checkout`): the `--stage <N>` value this answer produced. Record it in the `User Selections` row `H1c` (`userSelections.h1c`); omit the row entirely when Q1 was not `local checkout`.
@@ -108,7 +108,7 @@
   7. **Merge-conflict probe audit** — for any `push + PR` run, confirm the report's `Merge Conflict Probe` section is present and either records `Clean` or records `Conflicts detected` with the user's verbatim choice. A missing or unparseable probe entry on a `push + PR` run is a contract violation.
 - Non-goals:
   - re-litigating a final-verification verdict — release-handoff trusts the cited release-ready verdicts and does not reopen acceptance checks. Restating a conditional-accept's conditions in the PR body is reporting, not verification: the lead does not check whether a condition has been satisfied.
-  - creating, amending, squashing, rebasing, or rewriting commits. Commit production belongs to `implementation`; the only commits this phase may create are the merge commits `okstra handoff pr-plan` makes on a `merge-base` branch.
+  - manual commit creation, amendment, squash, or rebase by the lead. Runtime dependency rebases are owned by `okstra_ctl.stage_rebase`; `pr-plan` stops delivery after any such change until final-verification is repeated. Combining several independent predecessors on a dedicated `merge-base` branch remains separate from updating a downstream stage; never merge that base into the downstream stage.
   - bundling several stages into one PR, or building a branch that collects every stage. One stage is one PR.
   - opening releases or deployments beyond the per-stage PRs the user chose to create.
   - merging the PRs. Merging is a separate, manual step performed by the user (or by repo automation) after release-handoff ends; the lead MUST NOT call `gh pr merge`.

package/runtime/python/okstra_ctl/phases/release_handoff/spec.md

@@ -27,9 +27,11 @@ Report shapes remain in `schemas/final-report-v2.0.schema.json` and `schemas/fin
 
 ## 1. Purpose
 
-`release-handoff` is the terminal phase that pushes already-committed implementation stages with a release-ready verdict, or hands them off as pull requests. **One stage is one PR.** The PR head is that stage's stack branch; the base comes from its `depends-on` — the release base for a stage with no live dependency, the predecessor's branch for a stage with one (a stacked PR), and a branch merging the predecessors for a stage with several. The only commits this phase may create are the merge commits `okstra handoff pr-plan` makes on such a merge-base branch.
+`release-handoff` is the terminal phase that pushes already-committed implementation stages with a release-ready verdict, or hands them off as pull requests. **One stage is one PR.** The PR head is that stage's stack branch; the base comes from its `depends-on` — the release base for a stage with no live dependency, the predecessor's branch for a stage with one (a stacked PR), and a branch merging the predecessors for a stage with several.
 
-Because the PRs are a stack, they must be merged in ascending stage order with a merge commit or a rebase-merge. A squash replaces the commits the next PR's base points at, so the stack breaks — every PR body states this, and the lead never merges.
+When a predecessor advances, `okstra_ctl.stage_rebase.synchronize_stage_stack` rebases downstream stages in dependency order rather than merging the predecessor into them. It records the new bases and completion commits, preserving prior heads under `refs/okstra/rebase-backups/`. Implementation entry and verification target acquisition use the same operation. PR planning stops after a stack change and requires fresh final-verification; the new completion rows invalidate earlier verification through `consumers.verified_accepted_stages`. Dirty or active stages, rewritten unproven predecessors, and rebase conflicts stop synchronization. The tests in `tests/worktree/test_stage_rebase.py` cover ordering, preservation, and verification invalidation. Origin divergence remains a delivery error, never a reason to merge old origin history into the rebased branch.
+
+Because the PRs are a stack, they must be merged in dependency order with a merge commit or a rebase-merge. A squash replaces the commits the next PR's base points at, so the stack breaks — every PR body states this, and the lead never merges.
 
 This phase has no worker dispatch. It does not use a provider or report-writer roster; the host-native Okstra lead performs git/gh inspection, user questions, the PR draft, and the final report inline.
 

package/runtime/python/okstra_ctl/render.py

@@ -697,8 +697,6 @@ def _active_runtime_resources(ctx: dict) -> dict:
             or str(runtime_home / "templates" / "implementation-worker-preamble.md"),
             "report-writer": ctx.get("REPORT_WRITER_PREAMBLE_PATH")
             or str(runtime_home / "templates" / "report-writer-prompt-preamble.md"),
-            "translator": ctx.get("TRANSLATOR_PREAMBLE_PATH")
-            or str(runtime_home / "templates" / "translator-prompt-preamble.md"),
         },
         "workerErrorContractPath": ctx.get("WORKER_ERROR_CONTRACT_PATH")
         or str(runtime_home / "templates" / "worker-error-contract.md"),
@@ -2638,9 +2636,6 @@ def inject_lead_prompt_computed_tokens(ctx: dict) -> None:
     report_writer_preamble = ctx.get("REPORT_WRITER_PREAMBLE_PATH") or str(
         runtime_templates / "report-writer-prompt-preamble.md"
     )
-    translator_preamble = ctx.get("TRANSLATOR_PREAMBLE_PATH") or str(
-        runtime_templates / "translator-prompt-preamble.md"
-    )
     worker_error_contract = ctx.get("WORKER_ERROR_CONTRACT_PATH") or str(
         runtime_templates / "worker-error-contract.md"
     )
@@ -2663,7 +2658,6 @@ def inject_lead_prompt_computed_tokens(ctx: dict) -> None:
         f"- Analysis worker preamble: `{analysis_preamble}`\n"
         f"- Implementation worker preamble: `{implementation_preamble}`\n"
         f"- Report writer preamble: `{report_writer_preamble}`\n"
-        f"- Translator preamble: `{translator_preamble}`\n"
 
         f"- Shared worker error contract: `{worker_error_contract}`"
     )
@@ -2886,10 +2880,6 @@ def apply_lead_prompt_defaults(ctx: dict) -> None:
         "REPORT_WRITER_PREAMBLE_PATH",
         str(runtime_home / "templates" / "report-writer-prompt-preamble.md"),
     )
-    ctx.setdefault(
-        "TRANSLATOR_PREAMBLE_PATH",
-        str(runtime_home / "templates" / "translator-prompt-preamble.md"),
-    )
     ctx.setdefault(
         "WORKER_ERROR_CONTRACT_PATH",
         str(runtime_home / "templates" / "worker-error-contract.md"),

package/runtime/python/okstra_ctl/render_final_report.py

@@ -588,10 +588,10 @@ def _markdown_task_template(task_type: str) -> str:
         return ""
 
 
-# The Markdown is the AI handoff sibling of the data.json — same content, same
-# audience, so it renders in the SSOT's language and nothing else. The field
-# still has to be well-formed here because it decides whether Phase 7 pays for
-# a translator, and a malformed one would surface at the very end of the run.
+# The Markdown is the AI handoff sibling of the data.json. Its prose is the
+# record's own, already in the report language; only its fixed labels come from
+# the English dictionary. A malformed tag is still rejected here, before the
+# HTML render meets it at the very end of the run.
 MARKDOWN_LANG = "en"
 
 

package/runtime/python/okstra_ctl/report_finalize.py

@@ -25,14 +25,6 @@ placeholders, which a v2 report never carries because its numeric cells are
 `null` until this step fills them. Substituting the tokens on a later retry
 then leaves the already-rendered html stale for `validators/validate-report-views.py`.
 
-The translation sidecar is the `translate` step, directly before `render-views`,
-which overlays it. It used to be a manual lead sequence outside this command (materialize the translator
-prompt, dispatch it, resume finalize at `render-views`), written only in a doc
-the lead lazy-reads; a lead that ran the whole sequence at once skipped it and
-the run kept an English view under a `ko` report (2026-09-09, fontsninja-v3-site
-dev-10628-3). `okstra_ctl.report_translation_dispatch` owns the step; an English
-report or an existing sidecar makes it a no-op.
-
 Every lead adapter drives Phase 7 through this module: the Codex adapter calls
 it in-process (``codex_dispatch``), and a Claude-led run reaches the same code
 through the ``okstra report-finalize`` CLI. Neither reimplements the sequence.
@@ -69,12 +61,11 @@ from .handoff_error import HandoffError
 from .paths import RunRef, task_dir, task_manifest_file
 from .report_view_artifacts import html_view_path
 from .release_gate import release_handoff_allowed
-from .report_translation_dispatch import TranslateOutcome, translate_report
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from .stage_integrate import IntegrateError
 from .stage_targets import (
     StageTargetError,
-    integrate_and_teardown_whole_task,
+    teardown_completed_stage_worktrees,
 )
 from .session import observe_lead_session
 from .lead_progress import record_checkpoint
@@ -92,7 +83,6 @@ from okstra_project.phase_pointer import (
 
 
 STEP_PROJECT_ACTIVITY = "project-activity"
-STEP_TRANSLATE = "translate"
 STEP_TOKEN_USAGE = "token-usage"
 STEP_RENDER_VIEWS = "render-views"
 STEP_SPAWN_FOLLOWUPS = "spawn-followups"
@@ -105,7 +95,6 @@ STEP_PRUNE_RUN_ARTIFACTS = "prune-run-artifacts"
 
 STEP_ORDER = (
     STEP_PROJECT_ACTIVITY,
-    STEP_TRANSLATE,
     STEP_TOKEN_USAGE,
     STEP_RENDER_VIEWS,
     STEP_SPAWN_FOLLOWUPS,
@@ -124,8 +113,6 @@ V3_STEP_ORDER = (
     STEP_TOKEN_USAGE,
     STEP_PROJECT_ACTIVITY,
     STEP_PREFLIGHT,
-    # Before the render that overlays its sidecar.
-    STEP_TRANSLATE,
     STEP_RENDER_VIEWS,
     STEP_SPAWN_FOLLOWUPS,
     # Needs the assembled record; `validate-run` requires the row it writes.
@@ -341,10 +328,6 @@ def build_commands(ctx: FinalizeContext) -> list[tuple[str, list[str]]]:
                 str(ctx.data_path),
             ],
         ),
-        (
-            STEP_TRANSLATE,
-            ["<in-process>", "translate", str(ctx.data_path)],
-        ),
         (
             STEP_TOKEN_USAGE,
             [
@@ -571,38 +554,53 @@ def _teardown_stage_worktrees(
     ctx: FinalizeContext,
     command: list[str],
 ) -> subprocess.CompletedProcess:
-    """판정이 릴리스로 향할 때만 stage worktree 와 registry 키를 정리한다.
-
-    whole-task 진입이 통합만 하고 정리를 남겨두므로(`stage_targets`), 정리는 판정이
-    나온 뒤인 여기서 한다. `blocked` 이거나 릴리스를 막는 조건이 남은 판정에서는
-    stage 작업물을 그대로 둬서 재작업이 바로 이어지게 한다. 이미 정리된 뒤 재실행돼도
-    같은 결과를 낸다 — 병합은 `already_merged` 로, 없는 worktree 는 건너뛴다.
-    """
+    """검증된 보고서와 완료 기록이 일치하는 단계 작업 트리를 회수한다."""
     def _done(payload: Mapping[str, Any]) -> subprocess.CompletedProcess:
         return subprocess.CompletedProcess(command, 0, json.dumps(payload), "")
 
-    if ctx.task_type != "final-verification":
-        return _done({"skipped": "not a final-verification run"})
+    if ctx.task_type not in {"implementation", "final-verification"}:
+        return _done({"skipped": "not an implementation or final-verification run"})
     try:
         data = load_owned_object(Path(ctx.data_path), artifact="final report record")
     except JsonBoundaryError as exc:
         return subprocess.CompletedProcess(
             command, 1, "", f"cannot read final-report data.json: {exc}")
-    if data.get("verificationScope") != "whole-task":
-        return _done({"skipped": "single-stage verification owns no teardown"})
-    if not release_handoff_allowed(data):
+    if ctx.task_type == "final-verification" and not release_handoff_allowed(data):
         return _done({"skipped": "verdict does not clear the work for release"})
+    heads = _stage_cleanup_heads(ctx.task_type, data)
+    if heads == {}:
+        return _done({"skipped": "report names no completed stage commit"})
     try:
-        result = integrate_and_teardown_whole_task(
+        result = teardown_completed_stage_worktrees(
             project_root=ctx.project_root,
             task_group=ctx.task_group,
             task_id=ctx.task_id,
+            expected_heads=heads,
         )
-    except (IntegrateError, StageTargetError, OSError) as exc:
+    except (IntegrateError, StageTargetError, JsonBoundaryError, OSError) as exc:
         return subprocess.CompletedProcess(command, 1, "", str(exc))
     return _done(result)
 
 
+def _stage_cleanup_heads(task_type: str, data: Mapping[str, Any]) -> dict[int, str] | None:
+    if task_type == "implementation":
+        implementation = data.get("implementation") or {}
+        evidence = implementation.get("stageSidecarEvidence") or {}
+        stage = evidence.get("stageNumber")
+        commits = implementation.get("commitList") or []
+        head = commits[-1].get("fullSha", "") if commits else ""
+        return {stage: head} if isinstance(stage, int) and head and not evidence.get("withheld") else {}
+    if data.get("verificationScope") == "whole-task":
+        return None
+    verification = data.get("finalVerification") or {}
+    stages = verification.get("stageReports") or []
+    head = (verification.get("sourceImplementationReport") or {}).get("capturedHeadSha", "")
+    if data.get("verificationScope") == "single-stage" and len(stages) == 1 and head:
+        stage = stages[0].get("stage")
+        return {stage: head} if isinstance(stage, int) else {}
+    return {}
+
+
 def _prune_run_artifacts(
     ctx: FinalizeContext,
     command: list[str],
@@ -684,8 +682,6 @@ def run_finalize(
     if only:
         selected = set(only)
         if ctx.report_contract_version == "3.0":
-            if STEP_TRANSLATE in selected:
-                selected.add(STEP_PREFLIGHT)
             if selected - {STEP_TOKEN_USAGE}:
                 # 부분 재개도 이전 조립본이 아닌 현재 소유자 입력을 소비한다.
                 selected.add(STEP_PROJECT_ACTIVITY)
@@ -799,7 +795,6 @@ def _execute_finalize_steps(
                     if consumer != STEP_TOKEN_USAGE or ctx.report_contract_version != "3.0":
                         blocked[consumer] = name
             elif name == STEP_PREFLIGHT:
-                blocked[STEP_TRANSLATE] = name
                 blocked[STEP_SPAWN_FOLLOWUPS] = name
             elif name == STEP_RENDER_VIEWS:
                 blocked[STEP_VALIDATE_RUN] = name
@@ -865,8 +860,6 @@ def _finalize_recovery(ctx: FinalizeContext, result: Mapping[str, Any]) -> dict[
             "Repair the reported causes in this run using the owning input's correction command, "
             "then execute resumeCommand. Preserve approvals, model choices and completed evidence. "
             "If plan content changes, re-verify the affected items before finalizing. "
-            "After a narrative correction, check existing translations with report-translate check-data "
-            "and regenerate them if their source no longer matches. "
             "Ask only for an unresolved user decision or an actual external prerequisite."
         ),
     }
@@ -1018,8 +1011,6 @@ def _run_finalize_step(
     """한 Phase 7 단계를 실행하고 그 단계의 종료 코드만 돌려준다."""
     if name == STEP_PROJECT_ACTIVITY:
         return _run_project_activity(ctx, command)
-    if name == STEP_TRANSLATE:
-        return _run_translate(ctx, command)
     if name == STEP_TEARDOWN_STAGES:
         return _teardown_stage_worktrees(ctx, command)
     if name == STEP_PRUNE_RUN_ARTIFACTS:
@@ -1043,31 +1034,6 @@ def _run_finalize_step(
     )
 
 
-def _run_translate(
-    ctx: FinalizeContext,
-    command: Sequence[str],
-) -> subprocess.CompletedProcess[str]:
-    """비영어 리포트의 번역 사이드카를 만든다. 영어 리포트는 건너뛴다.
-
-    실패는 다른 단계처럼 기록만 하고 시퀀스는 계속 돈다 — `render-views` 는
-    사이드카 없이 영어 열람본을 내고, `validate-run` 은 권고를 남기며, 결과의
-    `--only translate --only render-views …` 재개 힌트가 그 둘을 다시 돌린다.
-    """
-    try:
-        outcome = translate_report(
-            project_root=ctx.project_root,
-            workspace_root=ctx.workspace_root,
-            manifest_path=ctx.manifest_path,
-            manifest=_load_manifest(ctx.manifest_path),
-            data_path=ctx.data_path,
-        )
-    except (FinalizeError, OSError, JsonBoundaryError) as exc:
-        outcome = TranslateOutcome(1, "", f"translate failed: {exc}")
-    return subprocess.CompletedProcess(
-        command, outcome.returncode, outcome.stdout, outcome.stderr
-    )
-
-
 def _run_project_activity(
     ctx: FinalizeContext,
     command: Sequence[str],
@@ -1206,18 +1172,13 @@ _CLI_EPILOG = r"""Usage:
 Runs the Phase 7 steps in their contractual order against one final-report:
 
   1. project-activity  project the run's activity events into the data.json
-  2. translate         for a non-English reportLanguage, materialize and
-                       dispatch the translator worker and require its
-                       *.i18n.<lang>.json sidecar; a no-op for English or
-                       when the sidecar already exists
-  3. token-usage       substitute real token/cost numbers into the data.json
-  4. render-views      write the schema-v2 task-specific *.html sibling with
-                       the translation overlaid; v1 keeps the
-                       legacy conditional interactive view
-  5. spawn-followups   turn section 4 rows into task stubs
-  6. validate-run      validate the finished run artifacts
-  7. record-group-memory / 8. teardown-stages  after a clean validation
-  9. prune-run-artifacts  remove node_modules and .next under this run
+  2. token-usage       substitute real token/cost numbers into the data.json
+  3. render-views      write the schema-v2 task-specific *.html sibling;
+                       v1 keeps the legacy conditional interactive view
+  4. spawn-followups   turn section 4 rows into task stubs
+  5. validate-run      validate the finished run artifacts
+  6. record-group-memory / 7. teardown-stages  after a clean validation
+  8. prune-run-artifacts  remove node_modules and .next under this run
                        directory, and the dispatch snapshots and publication
                        locks of a validated run; runs after a failure too
 

package/runtime/python/okstra_ctl/report_html/render.py

@@ -3,16 +3,14 @@ from __future__ import annotations
 
 import hashlib
 import json
-import sys
 from pathlib import Path
 
 import okstra_vendor  # noqa: F401  # registers vendored dependency aliases
 from jinja2 import Environment, StrictUndefined, select_autoescape
 
-from ..final_report_paths import final_report_data_path, translation_sidecar_path
+from ..final_report_paths import final_report_data_path
 from ..final_report_schema import load_schema_for_data, validate
 from ..i18n import HTML_DICTIONARY_REL, load_dictionary, make_jinja_global
-from ..report_translation import overlay
 from ..report_view_artifacts import user_responses_dir_for_report
 from ..usage_cells import format_duration_ms
 from ..json_boundary import load_owned_object
@@ -76,44 +74,8 @@ def _report_meta(data: dict, run_meta: HtmlRunMeta) -> dict[str, object]:
     }
 
 
-def _localize(data: dict, data_path: Path) -> tuple[dict, str]:
-    """이 리포트 언어의 번역 사이드카를 메모리 복사본에 덮어쓴다.
-
-    data.json 은 영어 정본이고 고치지 않는다. 사람이 읽는 HTML 만 독자 언어다.
-    사이드카가 빠진 포인터는 영어로 남긴다.
-
-    사이드카 파일 자체가 없으면 요청 언어를 버리고 전부 영어로 렌더한다.
-    종전에는 여기서 렌더를 거부했다 — 크롬만 번역된 반쪽 페이지를 내보내지
-    않겠다는 이유였고, 그 판단 자체는 옳다. 틀린 것은 남은 선택지였다: 번역
-    워커가 못 도는 이유(호스트 승인 게이트, 공급자 부재)는 리포트의 품질과
-    무관한데, 거부는 열람본을 통째로 없애고 `validate-run` 이 그 부재를 차단
-    실패로 삼아 run 을 `contract-violated` 로 끝냈다 — 분석도 리포트도 끝난
-    run 이 그렇게 끝났다(2026-09-08 FontsNinja/app/jobs dev-10784
-    error-analysis). 언어를 낮추면 크롬과 본문이 같은 영어라 반쪽 페이지도
-    아니고, 독자는 읽을 것을 갖는다. 번역이 나중에 도착하면 다시 렌더해
-    덮어쓴다.
-    """
-    lang = str((data.get("meta") or {}).get("reportLanguage") or "en")
-    if lang == "en":
-        return data, lang
-    sidecar_file = translation_sidecar_path(data_path, lang)
-    if not sidecar_file.is_file():
-        sys.stdout.write(
-            f"no {lang} translation sidecar at {sidecar_file.name}; "
-            "rendering the English source\n"
-        )
-        return data, "en"
-    payload = load_owned_object(sidecar_file, artifact="translation sidecar")
-    strings = payload.get("strings")
-    if not isinstance(strings, dict):
-        raise HtmlRenderError(f"translation sidecar has no 'strings' object: {sidecar_file}")
-    localized, report = overlay(data, strings)
-    sys.stdout.write(
-        f"translated {report.applied} string(s) into {lang}"
-        f" ({len(report.untranslated)} left in English"
-        f", {len(report.unresolved)} unresolved)\n"
-    )
-    return localized, lang
+def _report_language(data: dict) -> str:
+    return str((data.get("meta") or {}).get("reportLanguage") or "en")
 
 
 def _html_path(data_path: Path) -> Path:
@@ -140,9 +102,7 @@ def render_v2_html_view(
     errors = validate(data, load_schema_for_data(data))
     if errors:
         raise HtmlRenderError("invalid v2 final-report data: " + "; ".join(errors[:5]))
-    # Validate the SSOT, then localize — the sidecar carries presentation and
-    # has no say in whether the report is well-formed.
-    data, lang = _localize(data, data_path)
+    lang = _report_language(data)
     route = resolve_html_route(run_meta.task_type)
     view = route.view_builder(data)
     root = _templates_root(templates_root)

package/runtime/python/okstra_ctl/report_language.py

@@ -6,9 +6,9 @@ the run manifest, which report assembly copies into `meta.reportLanguage` and
 the HTML renderer reads. When only the prompt called this, a project could ask
 for `ko`, get a Korean-instructed writer, and still ship an English report.
 
-The value is a language tag (`en`, `ko`, `fr`, `pt-BR`, …). The Phase 7
-translator receives that tag and translates into it; nothing here knows any
-particular language. Precedence: project config → global config → `en`.
+The value is a language tag (`en`, `ko`, `fr`, `pt-BR`, …). The report writer
+authors the report prose in that language; nothing here knows any particular
+language. Precedence: project config → global config → `en`.
 """
 from __future__ import annotations