okstra 0.219.0 → 0.220.0

package/runtime/prompts/lead/report-writer.md

@@ -129,29 +129,22 @@ For historical schema-v1 Markdown only, the following heading table remains a re
 
 **Enforced:** `okstra_ctl.report_finalize.V3_STEP_ORDER` is the order — `report-finalize` runs the steps from that tuple, so the sequence cannot be reordered by a caller. Running the steps by hand is what this rule forbids, and that path is not reachable through the CLI.
 
-Do not run the eleven steps below manually. Invoke `okstra report-finalize`; contract 3.0 runs them in this order:
+Do not run the ten steps below manually. Invoke `okstra report-finalize`; contract 3.0 runs them in this order:
 
 1. **`token-usage`** — collect usage into team state without touching the final record.
 2. **`project-activity`** — report assembly validates every owner input and publishes the final record once.
-3. **`preflight`** — run the same schema and conformance checks used by final validation before translation, without writing run status. Structural failure skips translation; rendering and final validation still record the failure. `--only translate` also includes this check.
-4. **`translate`** — for a non-English `reportLanguage`, materialize and dispatch the translator worker and require its `*.i18n.<lang>.json` sidecar; a no-op for English or when the sidecar already exists.
-5. **`render-views`** — render the Markdown reading copy and human HTML, with the translation sidecar overlaid.
-6. **`spawn-followups`** — materialize registered follow-up tasks.
-7. **`record-verified`** — for a final-verification whose verdict clears the work for release, run `okstra handoff record-verified` once per stage in `finalVerification.stageReports`, so the `verified` rows exist before validation reads them; a no-op for other task types and for a verdict that blocks release. Do not run `handoff record-verified` by hand.
-8. **`validate-run`** — validate the record, views, run manifest, and team state.
-9. **`record-group-memory`** — write this run's conclusion (headline, decisions, watch-outs, open follow-ups, record path, next phase) and the group's start order into the task-group's `group-context.md` okstra region, creating the file when the group has none; skipped, like teardown, when an earlier step failed. Sibling tasks read it as `## Task-Group Memory`.
-10. **`teardown-stages`** — remove eligible stage worktrees after successful validation.
-11. **`prune-run-artifacts`** — remove every `node_modules` and `.next` directory under the run directory, and the dispatch snapshots (`*.mutation-audit.json`) and publication locks (`*.publish.lock`) recorded by a run whose validation passed or by an earlier run in the same run directory as a passed run; it runs even after a failed step.
+3. **`preflight`** — run the same schema and conformance checks used by final validation before rendering, without writing run status. Structural failure skips `spawn-followups`; rendering and final validation still record the failure.
+4. **`render-views`** — render the Markdown reading copy and human HTML from the record. The report writer already wrote the prose in `reportLanguage`; nothing translates it.
+5. **`spawn-followups`** — materialize registered follow-up tasks.
+6. **`record-verified`** — for a final-verification whose verdict clears the work for release, run `okstra handoff record-verified` once per stage in `finalVerification.stageReports`, so the `verified` rows exist before validation reads them; a no-op for other task types and for a verdict that blocks release. Do not run `handoff record-verified` by hand.
+7. **`validate-run`** — validate the record, views, run manifest, and team state.
+8. **`record-group-memory`** — write this run's conclusion (headline, decisions, watch-outs, open follow-ups, record path, next phase) and the group's start order into the task-group's `group-context.md` okstra region, creating the file when the group has none; skipped, like teardown, when an earlier step failed. Sibling tasks read it as `## Task-Group Memory`.
+9. **`teardown-stages`** — remove eligible stage worktrees after successful validation.
+10. **`prune-run-artifacts`** — remove every `node_modules` and `.next` directory under the run directory, and the dispatch snapshots (`*.mutation-audit.json`) and publication locks (`*.publish.lock`) recorded by a run whose validation passed or by an earlier run in the same run directory as a passed run; it runs even after a failed step.
 
 After `report-finalize` returns with `ok: true`, the lead closes the run with the launch prompt's User closeout. A generated HTML file alone does not establish successful validation.
 
-When the result carries `recovery.mode: same-run`, continue the authorized work in this run. Read every `recovery.issues` entry and failed step output. Correct writer-owned fields through the correction ledger procedure above; correct orchestrator-owned inputs through their owning commands. If plan content changes, prepare and verify the affected items before finalizing. Then execute `recovery.resumeCommand`, which retains this run manifest and resumes from the earliest failure, including reassembly of contract 3.0 inputs. After a narrative correction, check an existing translation with `okstra report-translate check-data --run-manifest <manifest>` and regenerate it if its source no longer matches. Keep previous approvals, user decisions, model selections and completed evidence. Do not ask for another `/okstra-run` to repair references, coverage summaries, narrative syntax or command spelling. Ask only when an unresolved user decision or an actual external prerequisite prevents the correction. Do not edit an installed runtime or another repository while recovering a consuming project's task. **Enforced:** `report_finalize._finalize_recovery` returns the same-run command and complete owner issues, `closeout_command` suppresses the new-run closeout for that result, and `tests/report/test_report_finalize.py` checks recovery after a failed step. Execution of the correction remains the lead's responsibility.
-
-### The translation sidecar: the `translate` step
-
-`report-finalize` dispatches the translator itself. Its `translate` step runs directly before `render-views` (which overlays the sidecar), and it is a no-op when `reportLanguage` is `en` or the `*.i18n.<lang>.json` sidecar already exists. When the sidecar is missing, the step reuses this run's undispatched translator reservation if the lead already materialized one, otherwise it materializes the prompt itself — instruction file `state/translator-instructions-<task-type>-<seq>.md` (kept when the lead wrote one), prompt `prompts/translator-worker-prompt-<task-type>-<seq>.md`, `--result worker-results/translator-translations-<task-type>-<seq>.md`, `--audit-source worker-results/translator-worker-<task-type>-<seq>.md`, invocation id `<task-type>-<seq>-translator` (`-r2`, `-r3` after a failed attempt) — then dispatches the worker and waits for it: on a `terminalBackend: cmux-pane` run into a cmux pane like every other worker (the same code as `okstra team dispatch` followed by `okstra team await`; run-end `okstra team teardown` closes that pane), otherwise through the CLI-wrapper dispatcher. Either path records the dispatch and links the result. Do not run `agent-prompt materialize --audience translator` or `worker-dispatch --workers translator` by hand before `report-finalize`; the sequence used to be a manual lead step and was skipped in practice (2026-09-09, fontsninja-v3-site dev-10628-3: a `ko` run finalized in one call, zero translator reservations, English HTML). **Enforced:** `okstra_ctl.report_finalize.V3_STEP_ORDER` places the step; `okstra_ctl.report_translation_dispatch.translate_report` owns it; `_translator_job_from_reservation` in `scripts/okstra_ctl/dispatch_core.py` still refuses two undispatched reservations for one run, which only a hand-made second reservation produces.
-
-The step succeeds only when the sidecar exists afterwards; a translator that exits 0 without publishing it fails the step. A failed `translate` does not stop the sequence: `render-views` still writes the view from the English body, `validate-run` records the missing sidecar as an advisory, and the result's resume hint starts at `--only translate --only render-views …` — run that once the cause (a host approval gate, an unavailable provider) is cleared rather than closing the run on an English view.
+When the result carries `recovery.mode: same-run`, continue the authorized work in this run. Read every `recovery.issues` entry and failed step output. Correct writer-owned fields through the correction ledger procedure above; correct orchestrator-owned inputs through their owning commands. If plan content changes, prepare and verify the affected items before finalizing. Then execute `recovery.resumeCommand`, which retains this run manifest and resumes from the earliest failure, including reassembly of contract 3.0 inputs. Keep previous approvals, user decisions, model selections and completed evidence. Do not ask for another `/okstra-run` to repair references, coverage summaries, narrative syntax or command spelling. Ask only when an unresolved user decision or an actual external prerequisite prevents the correction. Do not edit an installed runtime or another repository while recovering a consuming project's task. **Enforced:** `report_finalize._finalize_recovery` returns the same-run command and complete owner issues, `closeout_command` suppresses the new-run closeout for that result, and `tests/report/test_report_finalize.py` checks recovery after a failed step. Execution of the correction remains the lead's responsibility.
 
 ## Routing pointer
 

package/runtime/prompts/lead/team-contract.md

@@ -13,7 +13,7 @@ Okstra tasks use one lead plus the exact worker assignments selected in the prep
 
 ### Role Definitions
 
-The start screen assigns a **model ref** (`provider/model`) to each **canonical role** slot: `leader`, `analyser`, `critic`, `designer`, `planner`, `implementer`, `verifier`, `report-writer`, `translator`. A provider name is the front of a model ref, not a role. Every `analyser` in the run shares an identical core responsibility. Specialization is additive — it lives in optional Section 7 of the worker output, NOT in differentiated core questions. Cross-verification only converges if every rostered analyser answers the same questions against the same brief.
+The start screen assigns a **model ref** (`provider/model`) to each **canonical role** slot: `leader`, `analyser`, `critic`, `designer`, `planner`, `implementer`, `verifier`, `report-writer`. A provider name is the front of a model ref, not a role. Every `analyser` in the run shares an identical core responsibility. Specialization is additive — it lives in optional Section 7 of the worker output, NOT in differentiated core questions. Cross-verification only converges if every rostered analyser answers the same questions against the same brief.
 
 | Canonical role | Core responsibility | Notes |
 |------|------|------|
@@ -25,7 +25,6 @@ The start screen assigns a **model ref** (`provider/model`) to each **canonical
 | `implementer` | Sole change author for one approved stage | Used by `implementation` |
 | `verifier` | Independent review of the assigned duty's subject | Duty varies by task type |
 | `report-writer` | **Authors** the final-report file in Phase 6 | Excluded from Phase 4/5 and convergence |
-| `translator` | Translates the designated sidecar only | Phase 7 |
 
 **Dispatch does not invent a missing model assignment.** Launch-time empty slots are filled by the model default chain before the run starts. At dispatch the model for every role comes from `resultContract.workerRoles[*].modelExecutionValue` in `task-manifest.json` (and lead model metadata). There is no per-role hard-coded fallback — see "Model Assignment Rules" below.
 

package/runtime/prompts/wizard/prompts.ko.json

@@ -569,7 +569,6 @@
   },
   "confirmation": {
     "header": "선택 확인:",
-    "translation_scope": "  번역 작업자: {model} — 보고서 작성자와 같은 제공자·모델을 사용합니다. 선택 언어의 보고서가 필요하면 보고서 본문과 관련 분석·검증 결과를 전달해 번역하고 최종 보고서를 생성합니다. 같은 작업 범위의 재검증·수정·재시도에도 위에서 선택한 제공자·모델을 사용합니다.",
     "provider_data_scope": "\n전달 대상: 위 역할·모델 목록의 제공자(현재 세션 및 선택한 외부 모델 제공자).\n전달 자료: `{project_root}`의 이 작업에 대한 작업 개요, 작업 수행에 필요한 저장소 소스·문서, 선택한 근거 자료 및 실행 중 생성되는 관련 분석·검증 결과.\n진행을 선택하면 위 대상에 해당 자료를 전달하여 선택한 작업을 실행하는 것을 승인합니다. 선택에 없는 제공자나 작업과 무관한 자료는 승인 범위에 포함되지 않습니다. 실행 환경의 권한 검토는 별도로 적용됩니다.",
     "static_role": "  static-role   : {role}#{ordinal} / {model}",
     "dynamic_role": "  dynamic-role  : {role} / reuse selected participant model",

package/runtime/python/okstra_ctl/adapters/hosts/codex/relay.md

@@ -190,7 +190,7 @@ If preparation has already failed with a Git lock creation error or `Operation n
 
 ### Permission at the dispatch boundary
 
-Read `runManifest.userAuthorization` before a live dispatch, including `report-finalize`, which can start the translator internally. It preserves the confirmation text and the user response relayed through the wizard; quote its relevant recipient/material scope and response in the execution justification alongside the prepared assignment. The translator reuses the report writer's provider/model, as disclosed at confirmation. Do not wait until translation to inspect that authorization. A missing record is not consent, and the record does not override a host rejection. If review reports missing evidence already present in the record, submit that existing evidence through the permitted review mechanism; ask the user only when the actual approved scope does not cover the dispatch.
+Read `runManifest.userAuthorization` before a live dispatch. It preserves the confirmation text and the user response relayed through the wizard; quote its relevant recipient/material scope and response in the execution justification alongside the prepared assignment. A missing record is not consent, and the record does not override a host rejection. If review reports missing evidence already present in the record, submit that existing evidence through the permitted review mechanism; ask the user only when the actual approved scope does not cover the dispatch.
 
 Before a live CLI worker dispatch, check the current host's declared sandbox and approval policy. In a restricted Codex session, request the host's supported execution permission on the dispatch command itself (`sandbox_permissions: "require_escalated"` for `exec_command` when that mechanism is available and permitted). Scope the request to the prepared run and explain that it starts the selected worker processes. Follow the host's approval decision; a wizard confirmation or a successful preflight does not grant this permission.
 

package/runtime/python/okstra_ctl/adapters/providers/antigravity/adapter.py

@@ -303,7 +303,7 @@ def create_provider() -> ProviderSpec:
             role: "gemini-3.1-pro"
             for role in (
                 "lead", "analyser", "critic", "designer", "planner", "executor",
-                "verifier", "report-writer", "translator",
+                "verifier", "report-writer",
             )
         },
         wrapper="okstra-antigravity-exec.sh",

package/runtime/python/okstra_ctl/adapters/providers/claude/adapter.py

@@ -168,7 +168,6 @@ def create_provider() -> ProviderSpec:
             "executor": "opus",
             "verifier": "opus",
             "report-writer": "sonnet",
-            "translator": "sonnet",
         },
         wrapper="okstra-claude-exec.sh",
         supported_roles=ALL_ROLE_TOKENS,

package/runtime/python/okstra_ctl/adapters/providers/codex/adapter.py

@@ -133,7 +133,7 @@ def create_provider() -> ProviderSpec:
         models=CODEX,
         default_models={
             role: "gpt-6.1-sol"
-            for role in ("lead", "analyser", "critic", "designer", "planner", "executor", "verifier", "report-writer", "translator")
+            for role in ("lead", "analyser", "critic", "designer", "planner", "executor", "verifier", "report-writer")
         },
         wrapper="okstra-codex-exec.sh",
         supported_roles=ALL_ROLE_TOKENS,

package/runtime/python/okstra_ctl/adapters/providers/grok/adapter.py

@@ -308,7 +308,6 @@ def create_provider() -> ProviderSpec:
                 "executor",
                 "verifier",
                 "report-writer",
-                "translator",
             )
         },
         wrapper="okstra-grok-exec.sh",

package/runtime/python/okstra_ctl/adapters/providers/kimi/adapter.py

@@ -104,7 +104,6 @@ def create_provider() -> ProviderSpec:
             "executor": "kimi-k3",
             "verifier": "kimi-k3",
             "report-writer": "kimi-k3",
-            "translator": "kimi-k3",
         },
         wrapper="okstra-kimi-exec.sh",
         supported_roles=ALL_ROLE_TOKENS,

package/runtime/python/okstra_ctl/agent/invocation.py

@@ -39,7 +39,6 @@ AgentAudience = Literal[
     "scope-critic",
     "acceptance-critic",
     "report-writer",
-    "translator",
     "code-reviewer",
     "schedule-verifier",
     "business-flow-investigator",
@@ -604,7 +603,7 @@ def load_role_duty_contract(duty_root: Path, audience: AgentAudience) -> DutyCon
 def digest_duty_catalog(duty_root: Path) -> str:
     """Return the canonical digest of every contract file in a snapshot.
 
-    역할 계약은 하위 `roles/` 에 둔다 — `report-writer` 와 `translator` 는 직무
+    역할 계약은 하위 `roles/` 에 둔다 — `report-writer` 는 직무
     id 이면서 역할 id 라, 한 폴더에 두면 두 계약이 같은 파일 이름을 두고 겹친다.
     """
     names = [

package/runtime/python/okstra_ctl/agent/prompt_cli/cli.py

@@ -114,8 +114,8 @@ def _add_materialize_parser(commands: argparse._SubParsersAction) -> None:
     )
     materialize.add_argument(
         "--audit-source",
-        help=run_only + "; accepted only for report-writer and translator, whose "
-             "result is not their own worker result",
+        help=run_only + "; accepted only for report-writer, whose result is "
+             "not its own worker result",
     )
     materialize.add_argument("--host-runtime", help=standalone_only)
     materialize.add_argument("--execution-runner", choices=("cli-wrapper",), help=standalone_only)

package/runtime/python/okstra_ctl/agent/prompt_cli/jobs.py

@@ -81,8 +81,6 @@ def _metadata_job(
     if metadata.get("executionIdentityVersion") != 2 or metadata["dispatchKind"] != dispatch_kind:
         raise AgentPromptCliError(f"{metadata_path}: expected v2 dispatchKind {dispatch_kind!r}")
     execution = next(row for row in manifest["roleExecutions"] if row["roleExecutionRef"] == metadata["roleExecutionRef"])
-    if execution["role"] == "translator":
-        raise AgentPromptCliError("translator uses canonical reservation dispatch: worker-dispatch --workers translator")
     prompt = _project_input(project, metadata["prompt"]["path"], "prompt")
     anchors = prompt_anchor_values(prompt, ("Result Path", "Worker Result Path"))
     result = anchors.get("Worker Result Path") or anchors.get("Result Path")

package/runtime/python/okstra_ctl/agent/prompt_cli/materialize.py

@@ -99,7 +99,7 @@ _AUDIENCES = frozenset(get_args(AgentAudience))
 # 결과 파일과 별개의 워커 결과 포인터를 가진 audience. 이들만 `--audit-source` 로
 # 두 번째 경로를 받고, 프롬프트에 `**Worker Result Path:**` 앵커가 생긴다.
 # 나머지 audience 의 결과는 하나뿐이고 감사 사이드카는 그 이름에서 파생된다.
-_POINTER_AUDIENCES = frozenset({"report-writer", "translator"})
+_POINTER_AUDIENCES = frozenset({"report-writer"})
 
 
 def _materialize(args: argparse.Namespace) -> PreparedAgentInvocation:
@@ -196,7 +196,7 @@ def _materialize_run(
                 "the same path in the jobs file's workerResultPath"
             )
         audit_source_path = result_path
-    elif args.audience == "report-writer":
+    else:
         if audit_source_path is None:
             # The report writer is the one audience whose result path is not its
             # own worker result: it writes the report body, while the audit
@@ -234,31 +234,6 @@ def _materialize_run(
             result_path=result_path,
             audit_source_path=audit_source_path,
         )
-    elif (
-        audit_source_path is None
-        or _normalized(audit_source_path) == _normalized(result_path)
-    ):
-        # translator 다. report-writer 와 같은 두-경로 audience 인데 종전엔 빠진
-        # `--audit-source` 를 `--result` 로 조용히 접었다. 그러면 프롬프트에
-        # `**Worker Result Path:**` 앵커가 안 생기는데, `worker-dispatch` 는 그
-        # 앵커가 `**Result Path:**` 와 다를 것을 요구하므로 발행은 되지만 어떤
-        # 디스패치도 받지 못하는 예약이 남는다. 예약은 회수 명령이 없어 리드가
-        # 두 번째 id 로 다시 만드는 순간 "exactly one reservation" 이 영영
-        # 깨졌다(2026-09-08 실측, fontsninja-v3-site dev-10627-2
-        # requirements-discovery). 발행 시점에 거절한다.
-        raise AgentPromptCliError(
-            "translator materialization requires --audit-source distinct from "
-            "--result: --result is the translator's own report "
-            "(e.g. worker-results/translator-translations-<task-type>-<seq>.md) "
-            "and --audit-source the worker-result .md the audit sidecar is "
-            "derived from (worker-results/translator-worker-<task-type>-<seq>.md). "
-            "`worker-dispatch --workers translator` reads both from the prompt's "
-            "**Result Path:** and **Worker Result Path:** anchors and refuses a "
-            "prompt without the second. To fix a prompt already published "
-            "without it, re-run this command with the same --invocation-id and "
-            "--prompt plus --replace-undispatched; a new invocation id would "
-            "leave two reservations and block the translator for this run"
-        )
     _validate_run_identity(
         manifest,
         worker_id=args.worker_id,

package/runtime/python/okstra_ctl/agent/prompt_cli/run_identity.py

@@ -29,10 +29,6 @@ def _validate_run_identity(
         expected = "lead"
         if worker_id != "lead":
             raise AgentPromptCliError("lead assignment requires worker ID 'lead'")
-    elif assignment_ref == "translator":
-        expected = "translator"
-        if worker_id != "translator":
-            raise AgentPromptCliError("translator assignment requires worker ID 'translator'")
     elif assignment_ref.startswith("critic/"):
         scope = assignment_ref.split("/", 1)[1]
         expected = CRITIC_DUTY_BY_ASSIGNMENT_SEGMENT.get(scope, "")

package/runtime/python/okstra_ctl/blocking_checks.py

@@ -227,6 +227,14 @@ _BLOCKING: tuple[tuple[str, str], ...] = (
         "stage_fix_carry.py 는 통과로 기록된 리드 수정이 답한 FAIL 을 다시 "
         "fix run 으로 넘기지 않는다.",
     ),
+    # 수정 라운드의 FAIL 은 correctionRounds 에만 남는다(`_implementation-deliverable.md`
+    # "Correction round"). 기록이 원장과 어긋나면 그 FAIL 이 보고서에서 사라진다.
+    (
+        "correction-round BLOCKING:",
+        "수정 라운드 기록이 실제 dispatch 나 마지막 재검증 verdict 와 어긋난다 — "
+        "verifierResults 가 마지막 라운드의 verdict 가 아니면 release_gate.py 와 "
+        "stage_fix_carry.py 가 다른 라운드의 판정으로 stage 를 정착시키거나 fix run 을 연다.",
+    ),
     (
         "implementation run declares stage-",
         "stage 캐리 사이드카가 디스크에 없다 — consumers.py 의 "

package/runtime/python/okstra_ctl/convergence_provenance.py

@@ -21,6 +21,7 @@ from pathlib import Path
 from typing import Mapping
 
 from okstra_ctl.convergence_engine import grouped_input_digest
+from okstra_ctl.correction_round import correction_round
 from okstra_ctl.execution_identity import Attempt, ExecutionManifest
 from okstra_ctl.execution_manifest import read_execution_manifest_view
 from okstra_ctl.json_boundary import (
@@ -101,7 +102,11 @@ def groups_digest_ok(state_dir: Path, suffix: str, document: dict) -> bool:
 
 
 def discovery_attempts(manifest: ExecutionManifest) -> dict[str, list[Attempt]]:
-    """교정 실행은 발견 결과를 대체하지만 재검증 투표는 발견 출처가 아니다."""
+    """교정 실행과 수정 라운드 재검증은 발견 결과를 대체하지만 재검증 투표는 발견 출처가 아니다.
+
+    수정 라운드(`correction-r<N>`) 뒤 수렴을 다시 시작하면 마지막 라운드의 verifier 결과가
+    출처여야 한다. 빠지면 고치기 전 FAIL 결과로 다시 수렴한다.
+    """
     latest: dict[str, Attempt] = {}
     for attempt in manifest.attempts:
         current = latest.get(attempt.invocation_ref)
@@ -109,7 +114,8 @@ def discovery_attempts(manifest: ExecutionManifest) -> dict[str, list[Attempt]]:
             latest[attempt.invocation_ref] = attempt
     by_role: dict[str, list[Attempt]] = {}
     for invocation in manifest.invocations:
-        if invocation.dispatch_kind not in {"initial", "correction"}:
+        if (invocation.dispatch_kind not in {"initial", "correction"}
+                and correction_round(invocation.dispatch_kind) is None):
             continue
         attempt = latest.get(invocation.invocation_ref)
         if attempt is not None:

package/runtime/python/okstra_ctl/correction_cli.py

@@ -0,0 +1,59 @@
+"""`okstra correction` CLI — prints one correction-round instruction body (`correction_round`)."""
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from .convergence import canonical_run_state_artifact, validated_run_authority
+from .correction_round import CorrectionRoundError, correction_instruction
+
+
+_CLI_EPILOG = r"""Usage:
+  okstra correction prompt --run-manifest <path> --round <N> --role <executor|verifier> \
+    --base <sha> --finding <F-id> [--finding <F-id> ...]
+
+Prints the instruction body for one correction-round prompt; pass it to
+`okstra agent-prompt materialize --instruction` with --dispatch-kind correction-r<N>.
+Findings are read from the run's convergence record. Exit 1 on a refusal.
+"""
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="okstra correction",
+        description="Fix confirmed verifier findings inside the same implementation run.",
+        epilog=_CLI_EPILOG,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    commands = parser.add_subparsers(dest="command", required=True)
+    prompt = commands.add_parser("prompt", help="print one correction-round instruction body")
+    prompt.add_argument("--run-manifest", type=Path, required=True)
+    prompt.add_argument("--round", type=int, required=True)
+    prompt.add_argument("--role", choices=("executor", "verifier"), required=True)
+    prompt.add_argument("--base", required=True,
+                        help="the stage HEAD before this round")
+    prompt.add_argument("--finding", action="append", default=[], required=True,
+                        help="a convergence finding id to fix; repeat for several")
+    args = parser.parse_args(argv)
+
+    try:
+        authority = validated_run_authority(args.run_manifest)
+        if authority.task_type != "implementation":
+            raise CorrectionRoundError("correction rounds exist only in implementation runs")
+        convergence_path = canonical_run_state_artifact(
+            authority, manifest_field="convergenceStatePath", prefix="convergence",
+            label="convergence state",
+        )
+        print(correction_instruction(
+            convergence_path=convergence_path, round_number=args.round, role=args.role,
+            base=args.base, finding_ids=args.finding,
+        ))
+    except (CorrectionRoundError, OSError, ValueError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/python/okstra_ctl/correction_round.py

@@ -0,0 +1,168 @@
+"""`okstra correction` — fix confirmed verifier findings inside the same implementation run.
+
+A verifier FAIL used to end the run: FAIL report, `failed` row, finalize, a new wizard pass and
+a fix run that repeated the executor, every verifier and the report writer. Measured
+2026-10-17 (figma-plugin dev-11377 stage 1): one field rename (2 source lines, 24 test
+expectations) cost that whole cycle, because the lead minor fix may not change test
+expectations. A correction round sends the executor a bounded fix and the verifiers a
+re-verification of that fix, then the run writes its report once.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Mapping, Sequence
+
+from .execution_identity import ExecutionManifest
+from .json_boundary import load_owned_object
+
+MAX_CORRECTION_ROUNDS = 2
+CORRECTION_DISPATCH_KIND_PREFIX = "correction-r"
+_ROUND_RE = re.compile(r"^correction-r([1-9][0-9]*)$")
+
+
+class CorrectionRoundError(ValueError):
+    """A correction dispatch or instruction request that the run cannot accept."""
+
+
+def correction_round(dispatch_kind: str) -> int | None:
+    """`correction-r2` → 2; any other dispatch kind → None."""
+    match = _ROUND_RE.match(dispatch_kind)
+    return int(match.group(1)) if match else None
+
+
+def validate_correction_dispatch(
+    manifest: ExecutionManifest, jobs: Sequence[object],
+) -> None:
+    """Refuse a correction dispatch that skips a step or exceeds the round cap.
+
+    The executor fix of round N comes after round N-1 was re-verified, and the verifiers of
+    round N re-verify only after the executor of round N returned a result; otherwise a
+    verifier reads a tree the fix has not reached, as the executor/verifier batch split
+    already guards for the initial round.
+    """
+    roles = {row.role_execution_ref: row.role for row in manifest.role_executions}
+    finished_ok = {
+        row.invocation_ref for row in manifest.attempts
+        if row.finished_at is not None and row.status == "ok"
+    }
+
+    def completed(round_number: int, role: str) -> bool:
+        return any(
+            correction_round(row.dispatch_kind) == round_number
+            and roles.get(row.role_execution_ref) == role
+            and row.invocation_ref in finished_ok
+            for row in manifest.invocations
+        )
+
+    for job in jobs:
+        round_number = correction_round(getattr(job, "dispatch_kind", ""))
+        if round_number is None:
+            continue
+        if round_number > MAX_CORRECTION_ROUNDS:
+            raise CorrectionRoundError(
+                f"{job.dispatch_kind}: a run holds at most {MAX_CORRECTION_ROUNDS} correction "
+                "rounds; end the run FAIL and let a fix run take the remaining findings"
+            )
+        audience = getattr(job, "audience", "")
+        if audience == "implementation-executor":
+            if round_number > 1 and not completed(round_number - 1, "verifier"):
+                raise CorrectionRoundError(
+                    f"{job.dispatch_kind}: correction round {round_number - 1} has no "
+                    "re-verification result yet; await its verifiers first"
+                )
+            if completed(round_number, "implementer"):
+                raise CorrectionRoundError(
+                    f"{job.dispatch_kind}: the executor already returned this round's fix; "
+                    "dispatch the verifiers, or start the next round"
+                )
+        elif audience == "implementation-verifier":
+            if not completed(round_number, "implementer"):
+                raise CorrectionRoundError(
+                    f"{job.dispatch_kind}: the executor has not returned this round's fix; "
+                    "dispatch and await it before re-verifying"
+                )
+        else:
+            raise CorrectionRoundError(
+                f"{job.dispatch_kind} is an implementation executor or verifier dispatch, "
+                f"not {audience or 'this audience'}"
+            )
+
+
+def _finding_lines(findings: Sequence[Mapping[str, object]]) -> list[str]:
+    lines = []
+    for finding in findings:
+        workers = ", ".join(str(w) for w in finding.get("consensusWorkers") or []) or str(
+            finding.get("originWorker") or "")
+        lines.append(
+            f"- `{finding['findingId']}` ({finding.get('classification', '')}; {workers}): "
+            f"{finding.get('summary', '')} — evidence: {finding.get('originEvidence', '')}"
+        )
+    return lines
+
+
+def correction_instruction(
+    *, convergence_path: Path, round_number: int, role: str, base: str,
+    finding_ids: Sequence[str],
+) -> str:
+    """The instruction body one correction-round prompt carries, read from the convergence record."""
+    if not 1 <= round_number <= MAX_CORRECTION_ROUNDS:
+        raise CorrectionRoundError(f"--round must be 1..{MAX_CORRECTION_ROUNDS}")
+    if not finding_ids:
+        raise CorrectionRoundError("name at least one --finding")
+    if not base.strip():
+        raise CorrectionRoundError("--base is required: the stage HEAD before this round")
+    record = load_owned_object(convergence_path, artifact="convergence record")
+    by_id = {
+        str(row.get("findingId")): row for row in record.get("findings") or []
+        if isinstance(row, Mapping)
+    }
+    missing = [fid for fid in finding_ids if fid not in by_id]
+    if missing:
+        raise CorrectionRoundError(
+            f"findings not in {convergence_path.name}: {', '.join(missing)}; "
+            f"it holds {', '.join(sorted(by_id)) or 'none'}"
+        )
+    findings = [by_id[fid] for fid in finding_ids]
+    results_dir = convergence_path.parent.parent / "worker-results"
+    header = [
+        f"- Convergence record: `{convergence_path}`",
+        f"- Verifier results (each finding's suggested fix): `{results_dir}`",
+        f"- Stage HEAD before this round: `{base.strip()}`",
+        "- Findings:",
+        *("  " + line for line in _finding_lines(findings)),
+        "",
+    ]
+    if role == "executor":
+        return "\n".join([
+            f"## Correction Round {round_number} — fix confirmed verifier findings",
+            "",
+            *header,
+            "Rules:",
+            "- Change only what these findings require, inside this stage's planned paths or "
+            "files this stage already changed. A finding that needs a new plan step, a new "
+            "dependency, or a schema or migration change is not fixed here: stop and say so.",
+            "- Update a test's expected value only where the finding shows the oracle itself is "
+            "wrong; never weaken or delete an assertion to make a test pass.",
+            "- Follow the executor sidecar's TDD, pre-commit diff review and self-check, and "
+            "commit with a Conventional Commit whose body names the finding ids.",
+            "- Re-run the plan validation commands that cover the fix, and end with a "
+            "`### Stage Carry Evidence` block whose `stageCommitRange.head` is the new HEAD.",
+        ])
+    if role == "verifier":
+        return "\n".join([
+            f"## Correction Round {round_number} — re-verify the fix",
+            "",
+            *header,
+            "Rules:",
+            f"- For each finding, state `fixed` or `not fixed` against `git diff {base.strip()}..HEAD`, "
+            "with `path:line` evidence.",
+            "- Apply the static review's blocking checks to the correction diff only; the rest of "
+            "the stage was reviewed in the initial round.",
+            "- Re-run every plan validation command, as the verifier sidecar's Fix-run "
+            "incremental scope requires.",
+            "- Verdict `PASS` when every finding is fixed and no blocking check hits the "
+            "correction diff; otherwise `FAIL`, with each remaining or new finding in the "
+            "usual format.",
+        ])
+    raise CorrectionRoundError("--role must be executor or verifier")