okstra 0.220.1 → 0.222.0

package/runtime/python/okstra_ctl/phases/implementation/entry.py

@@ -17,7 +17,7 @@ from typing import Any
 from okstra_ctl import stage_targets
 from okstra_ctl.design_prep import DesignPrepDecision, DesignPrepError, resolve_design_prep
 from okstra_ctl.final_report_paths import final_report_data_path
-from okstra_ctl.stage_reconcile import auto_reconcile_best_effort
+from okstra_ctl.stage_reconcile import StaleStageRecordsError, require_reconciled_stages
 from okstra_ctl.worker_prompt_policy import IMPLEMENTATION_STAGE_HEADER
 
 
@@ -94,7 +94,11 @@ def claim_implementation_stage_run(
 
     plan_run_root = Path(inp.approved_plan_path).resolve().parents[1]
     backfill_done_from_carry(plan_run_root)
-    auto_reconcile_best_effort(inp, plan_run_root)
+    # stage 재배치·base 계산보다 먼저 거부해야 거부된 prepare 가 git 을 건드리지 않는다.
+    try:
+        require_reconciled_stages(inp, plan_run_root)
+    except StaleStageRecordsError as exc:
+        raise ImplementationStageError(str(exc)) from exc
     from okstra_ctl.stage_rebase import synchronize_stage_stack
 
     try:

package/runtime/python/okstra_ctl/phases/implementation/host-rules.md

@@ -47,6 +47,7 @@ If `render-bundle` fails with a `PrepareError` containing `Recorded stage SHAs n
    - **Enter a different ref directly** — the user names a commit/branch/tag.
    - **Abort** — stop the run without recovering.
 3. Run `okstra git-reconcile … --apply --stage <N> --use-ref <ref>` with the chosen ref, then retry the failed `render-bundle` with the same arguments.
+   If that output carries a `Warning` naming the implementation anchor, the chosen head no longer contains the anchor: show the warning to the user and run its printed `--reset-anchor` command only after they confirm the new base, before the retry.
 
 If the anchor (`implementation_base_commit`) is reported unresolvable, run the same command's `--reset-anchor <ref>` after user confirmation. Correcting a confirm item without the picker is forbidden — the runtime also rejects a confirm correction without `--use-ref`.
 

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md

@@ -77,7 +77,7 @@ When the synthesised verdict is `FAIL` and the lead minor fix does not apply, th
 **Entry.** Every blocking finding of the round meets all of these, or the run ends `FAIL` as before:
 
 1. A verifier cited where it is (`path:line`) and what the correct result is.
-2. The fix stays inside this stage's `plannedPaths` or files the executor already changed.
+2. The fix stays inside this stage's `plannedPaths` or files the executor already changed. A `FILE-SIZE:` finding also allows the new files the split creates beside the oversized one, so it always meets this rule.
 3. It needs no new plan step, dependency, schema, migration, or config of record — a finding that does is a plan change: end the run `FAIL` and route by `prompts/lead/phase-routing.md`.
 
 Changing a test's expected value is allowed here when the finding shows the oracle is wrong, because the verifiers re-verify the fix.
@@ -85,12 +85,13 @@ Changing a test's expected value is allowed here when the finding shows the orac
 **Procedure for round `<N>`.**
 
 1. Record the stage HEAD as `<base>` (`git rev-parse HEAD` in the stage worktree).
-2. Write the executor instruction with `okstra correction prompt --run-manifest <path> --round <N> --role executor --base <base> --finding <F-id> [--finding <F-id> ...]` into a file under the run's `state/`, then materialize it with `okstra agent-prompt materialize` — `--audience implementation-executor`, `--assignment-ref initial/<executor worker id>`, `--dispatch-kind correction-r<N>`, a new `--invocation-id` ending `-correction-r<N>-<executor worker id>`, and a result path `<executor worker id>-worker-correction-r<N>-implementation-<seq>.md`. Build a jobs file with `okstra agent-prompt jobs --dispatch-kind correction-r<N>`, dispatch it alone with `okstra team dispatch --jobs-file <path> --dispatch-kind correction-r<N>`, and settle it with `okstra team await`.
+2. Write the executor instruction with `okstra correction prompt --run-manifest <path> --round <N> --role executor --base <base> --stage-base <stage base> --finding <F-id> [--finding <F-id> ...]` into a file under the run's `state/`, then materialize it with `okstra agent-prompt materialize` — `--audience implementation-executor`, `--assignment-ref initial/<executor worker id>`, `--dispatch-kind correction-r<N>`, a new `--invocation-id` ending `-correction-r<N>-<executor worker id>`, and a result path `<executor worker id>-worker-correction-r<N>-implementation-<seq>.md`. Build a jobs file with `okstra agent-prompt jobs --dispatch-kind correction-r<N>`, dispatch it alone with `okstra team dispatch --jobs-file <path> --dispatch-kind correction-r<N>`, and settle it with `okstra team await`.
+   `--stage-base` (the carry's `stageCommitRange.base`) adds a `FILE-SIZE:<path>` finding for each file the stage diff leaves over the 400-line limit, computed by `okstra correction file-size`; a `FILE-SIZE-ADVISORY:` line (the 300-line target) never opens or joins a round; a round may hold only those findings, and `findingIds` records them by that id. Leave out a convergence finding id that restates a `FILE-SIZE:` line, or the executor reads it twice.
 3. Do the same for every verifier with `--role verifier`, `--audience implementation-verifier`, its own `initial/<verifier worker id>` assignment, and result `<verifier worker id>-worker-correction-r<N>-implementation-<seq>.md`; dispatch the verifiers in one batch without the executor.
-4. Converge the re-verification results the way the initial round was converged, restarting Phase 5.5 with `okstra convergence seed ... --restart-from-round0`.
+4. Converge the re-verification results in round `<N>`'s own namespace, leaving the initial convergence as written. Run Phase 5.5 again with `correction-r<N>` before `<task-type>` in every state name: `okstra convergence prepare-groups --correction-round <N>` writes `convergence-groups-correction-r<N>-<task-type>-<seq>.json`; seed it with `--work-state …/convergence-work-correction-r<N>-<task-type>-<seq>.json` and `--final-state …/convergence-correction-r<N>-<task-type>-<seq>.json`; name round plans and results `convergence-round-<k>-plan-correction-r<N>-<task-type>-<seq>.json`. A reverify round in it passes `--correction-round <N>` to `reverify-prompt` and `collect-results`, materializes with `--invocation-id` ending `-correction-r<N>-reverify-r<k>-<worker id>`, and names its result `<worker id>-worker-correction-r<N>-reverify-r<k>-<task-type>-<seq>.md`. Never reseed the initial paths: a terminal final there is reused, and `--restart-from-round0` refuses it. Round `<N+1>`'s `okstra correction prompt` reads its findings from this round's final, and the report writer's synthesis packet carries it as `Convergence state (correction-r<N>)` beside the initial `Convergence state` (`report_synthesis_packet._source_specs`); report assembly projects it into `crossVerification.correctionRounds[]` and appends the evidence it promotes to `evidence.primary` with source `convergence correction-r<N>` (`report_assembly._correction_round_convergence`).
 5. No re-verification verdict is `FAIL`: the round `result` is `pass` and the run continues to persistence with the post-fix head. Otherwise `result: fail`; start round `<N+1>` if the cap allows and the entry rules still hold, or end the run `FAIL`.
 
-**Enforced:** `scripts/okstra_ctl/dispatch_core.py` `_validate_correction_rounds` (via `correction_round.validate_correction_dispatch`) refuses a round past the cap, a verifier dispatch before that round's executor returned an `ok` result, a second executor fix in the same round, and round `<N+1>` before round `<N>` was re-verified. `validators/validate-run.py` `_validate_correction_rounds` (blocking) fails a report whose `correctionRounds` differ from the correction rounds the run dispatched, whose rounds are not 1, 2 in order, whose `result` contradicts its verdicts, or whose `verifierResults` are not the last round's verdicts. The entry rules are instructions only.
+**Enforced:** `okstra convergence seed` (`scripts/okstra_ctl/convergence.py` `_seed`) accepts state paths only in the initial or a `correction-r<N>` namespace, refuses a round grouping before every grouped verifier returned an `ok` round `<N>` result (`convergence_provenance.missing_scope_results`), and checks its cited items against that round's results (`discovery_attempts` per namespace); `convergence_migration.decide_seed_action` refuses `--restart-from-round0` without an invalid working state; `plan-round` refuses to overwrite a round plan whose namespace already dispatched that round (`_refuse_dispatched_plan_overwrite`); `collect-results` reads only the namespace's reverify invocations (`correction_round.reverify_invocation_in_scope`). `scripts/okstra_ctl/dispatch_core.py` `_validate_correction_rounds` (via `correction_round.validate_correction_dispatch`) refuses a round past the cap, a verifier dispatch before that round's executor returned an `ok` result, a second executor fix in the same round, and round `<N+1>` before round `<N>` was re-verified. `validators/validate-run.py` `_validate_correction_rounds` (blocking) fails a report whose `correctionRounds` differ from the correction rounds the run dispatched, whose rounds are not 1, 2 in order, whose `result` contradicts its verdicts, or whose `verifierResults` are not the last round's verdicts. The entry rules are instructions only. `okstra stage-done` (`scripts/okstra_ctl/stage_done.py` `_check_file_size`) refuses to settle a stage whose carry range breaks the 400-line file-size limit and names the `--stage-base` to pass, so a size violation no verifier reported still reaches a correction round, or ends the run `FAIL` when no round is left.
 
 ## Self-review pass before finalising the report (the Okstra lead runs this; do not delegate it)
 

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-executor.md

@@ -92,6 +92,7 @@ template's check; that template is gone.
   The file MUST NOT exist before the run starts (overwrite is refused — see `--force-stage` non-goal). **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` fails a run that declares `stageSidecarEvidence` without the file on disk. Transcribing the JSON into the report is not the same as writing it: `consumers` treats the carry file as the source of truth for marking the stage `done`, so a missing file leaves the stage permanently incomplete and blocks every dependent stage with a `PrepareError` — while this run reports success.
 - **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work — a baseline capture or `--compare` target goes under `<task_root>/qa/baseline/` and anything else it writes (build logs, measurements) under `<task_root>/qa/output/`, the only qa directories besides `qa/scripts/` your attempt may write — but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
 - **An external Tier 3 non-PASS does NOT withhold the carry evidence.** A Tier 3 entry whose `requires` include `http`, `external`, or `db` is advisory. Its FAIL, MISSING, no result, startup failure, or credential / network / service absence gets recorded honestly — exact command, exit code, output tail, marked `ADVISORY` in `Validation evidence` — and you emit the carry evidence anyway. Only Tier 1 and Tier 2 failures withhold it. Withholding on an external result is what actually blocks the stage: the carry file is the only thing that can mark a stage `done`, the verifier re-runs that same command from the host (where a call your sandbox could not complete often passes), and a stage the verifier then PASSes can never be closed because its evidence was never written.
+- **File size: aim for 300 lines, never exceed 400 (BLOCKING at 400).** Each threshold is broken the same three ways — a new file over it, an existing file taken past it, a file already over it that grows by any net line — counted in physical lines. Breaking 400 is a blocking finding; breaking only 300 is an advisory recommendation the verifiers record. Put a new responsibility — a group of functions, a class, a `describe` block — in a new module or test file beside the existing one instead of appending, and when a file would pass 400, split it by responsibility; never compress code or drop comments to meet the number. Lockfiles, data (JSON / YAML), Markdown, fixtures, snapshots, generated and vendored files are exempt, as are languages okstra has no coding preflight for. Check with `okstra correction file-size --base <stage-base>` before you emit the carry evidence; it writes nothing, so you may run it. **Enforced:** every verifier runs the same command and reports each `FILE-SIZE:` line (400) as a blocking finding and each `FILE-SIZE-ADVISORY:` line (300) as a recommendation, and `okstra stage-done` (`scripts/okstra_ctl/stage_done.py` `_check_file_size`) refuses to settle a stage whose carry range still breaks 400, so the stage goes to a correction round.
 - **Reverse link (BLOCKING).** The runtime already appended a `status:"started"` row for this stage before the run began. The terminal row belongs to the lead's post-stage persistence and is verdict-gated — `status:"done"` with `carry_path` on a non-`FAIL` verdict, `status:"failed"` on `FAIL` (`_implementation-deliverable.md` §"Lead post-stage persistence").
 - **No PR / push in this phase.** This run produces local commits, carry sidecar evidence, verifier results, and the implementation final report only. Push and PR creation belong exclusively to the later `release-handoff` phase after `final-verification` returns `accepted`.
 

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-self-check.md

@@ -17,6 +17,7 @@ fails, fix it or surface the violation — do not claim done on a failing item.
 
 - diff-review done: the `Pre-commit diff review sweep` ran over the full diff and its `Coverage:` footer is in your audit sidecar — every changed file named, with each applied rule set carrying its outcome (`clean` or `fixed <n>`). No footer, or entries with no outcome → the sweep is unfinished; do not claim done.
 - functions: every new/edited function ≤50 effective lines, single purpose — cite the longest function's actual line count, not "all under 50"
+- file size: no source or test file this diff adds or grows ends over 400 physical lines, and no file already over 400 grew — paste the output of `okstra correction file-size --base <stage-base>`; it must end `QA-RESULT: PASS`. Aim for 300: for each `FILE-SIZE-ADVISORY:` line it prints, split the file or say why not. A responsibility that would push a file over goes into its own new module or test file
 - conventions: applied the routed pack + project patterns (name which ones)
 - names & comments: names say what, comments say why; no obvious-restatement comments; no truthful-name violations
 - verification: ran the actual build/test — paste the exact command line and its real exit code / output tail, never a paraphrased "tests pass"

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-verifier.md

@@ -214,13 +214,14 @@ Re-running commands proves the diff *builds and passes*; it does NOT prove the d
   - **Non-separating test data:** two scenarios whose setup values and assertions are identical, so a wrong implementation passes both; or new test tooling added in this diff (mock, state setter, repository branch) that no test calls.
   - **Effect claimed under its own mock:** a test presented as covering an effect whose producing path is replaced by a mock inside that same test. The mock's presence in the harness is not evidence the branch behind it works.
   - **Single-caller abstraction (KISS):** an abstraction layer this diff introduces — a helper module, a strategy / factory / builder, an indirection or wrapper layer, an interface or abstract base — that has exactly one caller after the change, where inlining it at that call site would be simpler. The rule is `overview.md` core principle 2: name the second caller now, or inline. Four exits are legitimate and each must **cite its evidence**: the approved plan declares it (a `testSeams[]` boundary or a variation-point extraction — cite the plan step); the project declares `architecture.style = hexagonal` and this is a port at the domain boundary (a port with one adapter is the normal shape, not a violation); it breaks a real import cycle (name both modules); or its single caller is the public API of a published package. Absent one of those, cite `path:line` and recommend the inlined shape. Do NOT raise this on a function extracted purely to bring a body under the 50-line cap — that is principle 5 doing its job — nor on a pre-existing abstraction this diff merely edits.
+  - **File-size limit (every verifier, not only the stage QA owner):** run `okstra correction file-size --base <base>` from the worktree cwd and log it in the `Read-only command log`. Each `FILE-SIZE:<path>:401 <before>-><after>` line it prints is a blocking finding cited exactly as printed — a new file over 400 lines, a file the diff took past 400, or a file already over 400 the diff grew. Recommended fix: move whole responsibilities into new modules or test files beside it. The command writes nothing and its result is the same for every verifier, so the finding converges and the lead sends it to a correction round. Each `FILE-SIZE-ADVISORY:<path>:301` line (the 300-line target, same three conditions) goes under the advisory findings below, not here. Do not judge size yourself: a file it does not print is not a finding (lockfiles, data, Markdown, fixtures, snapshots, generated files and languages without a coding preflight are exempt by `scripts/okstra_ctl/file_size_cap.py` `capped_path`).
   - **Caller-less identifier (YAGNI / orphan):** an identifier this diff leaves with zero callers — either newly added and never called (a speculative parameter, an optional config object, a "future-proof" hook, an exported helper whose only caller is hypothetical), or pre-existing code orphaned because this diff removed its last caller. Grep the identifier across the whole repository rather than the diff alone; a hit inside its own declaration, its own test, or a commented-out line is not a caller. Two exits are legitimate and must be **stated with their evidence**, never assumed: an identifier the approved plan reserves for a named later stage (cite the plan step), and a contract point something other than project code calls (a framework entrypoint, an implemented interface method, a migration hook, the public API of a published package — cite the caller or the registration). Anything else is work no requirement asked for: recommend deleting it, or folding an added parameter back into its single call site. A caller-less identifier is the one YAGNI violation that survives a green pipeline unchanged, which is why it grades here rather than as a recommendation.
-- **Advisory findings (recorded as recommendations; verdict MAY still PASS):** function >50 effective lines, a single body mixing read+write stages, weak readability, a missing-but-non-critical outcome assertion, weak-but-not-misleading names, priority-between-inputs policy inlined in a service condition instead of a named domain function, an error message asserting a cause the code never observed, a memory / concurrency / batching change with no test pinning the bound it claims, or (hexagonal overlay only) a service dependency this diff adds or modifies that injects a concrete adapter instead of a port — record it with the port sketch; advisory only while the project has not declared `architecture.style = hexagonal`, since that declaration — and only that one — promotes exactly this item to blocking per the declared-style bullet above, while a declared `layered` binds dependency direction instead and leaves this item advisory; an existing convention of concrete injections does not convert this one to `clean`, it is the debt the rule pays down. These land in the verifier result as `should-fix` / `nit` recommendations, not as a `FAIL`.
+- **Advisory findings (recorded as recommendations; verdict MAY still PASS):** each `FILE-SIZE-ADVISORY:` line from the file-size command (a file over the 300-line target but within 400), function >50 effective lines, a single body mixing read+write stages, weak readability, a missing-but-non-critical outcome assertion, weak-but-not-misleading names, priority-between-inputs policy inlined in a service condition instead of a named domain function, an error message asserting a cause the code never observed, a memory / concurrency / batching change with no test pinning the bound it claims, or (hexagonal overlay only) a service dependency this diff adds or modifies that injects a concrete adapter instead of a port — record it with the port sketch; advisory only while the project has not declared `architecture.style = hexagonal`, since that declaration — and only that one — promotes exactly this item to blocking per the declared-style bullet above, while a declared `layered` binds dependency direction instead and leaves this item advisory; an existing convention of concrete injections does not convert this one to `clean`, it is the debt the rule pays down. These land in the verifier result as `should-fix` / `nit` recommendations, not as a `FAIL`.
 - **Output.** Every finding — blocking or advisory — is a structured item in the verifier's worker result (`path:line`, rule, severity, suggested fix) so it carries into Phase 5.5 convergence and the final report. A blocking hit sets the verifier verdict to `FAIL` with the rule cited, using the same verdict machinery as the Discrepancy rule above. The Okstra lead MUST NOT silently downgrade a cited blocking finding to advisory during synthesis; an override requires a concrete cited reason, exactly as for the Discrepancy rule.
 
 ### Fix-run incremental scope (applies when the profile carries a "Fix-Run Carry" block)
 
-A correction-round re-verification (`--dispatch-kind correction-r<N>`, a "Correction Round" block in the task instructions) takes the same scope: the block's findings and the correction diff it names, with every validation command re-run.
+A correction-round re-verification (`--dispatch-kind correction-r<N>`, a "Correction Round" block in the task instructions) takes the same scope: the block's findings and the correction diff it names, with every validation command re-run. The file-size command is the exception: run it against the stage base, never the round's base, because a file the round did not touch keeps the violation the initial diff made.
 
 A fix run re-verifies a stage whose previous run already passed a full static
 sweep and failed only on cited blocking findings. Re-sweeping the whole stage

package/runtime/python/okstra_ctl/phases/implementation_option_selection/profile.md

@@ -39,4 +39,4 @@
 
 Record candidate validity, unresolved user decisions, and explicitly classified technical facts. The lead chooses the next phase under `## implementation-option-selection` in `prompts/lead/phase-routing.md`.
 
-When `--clarification-response` carries a technical-verification report, read its source comparison, experiment plans, results and logs. Check that the tested environment matches current code, then author fresh feasibility votes. Do not directly convert a supported result into a feasible candidate, remove unrelated uncertainties or treat a failed or unrun probe as compatibility proof. Preserve the user's pilot scope and any deferred production rollout.
+When `--clarification-response` carries a technical-verification report, read its source comparison, experiment plans, results and logs. The analysis packet's `## Technical Verification Evidence` section names the result record and the experiment directory (rendered by `okstra_ctl.phases.technical_verification.entry.technical_evidence_packet_block`). Check that the tested environment matches current code, then author fresh feasibility votes. Do not directly convert a supported result into a feasible candidate, remove unrelated uncertainties or treat a failed or unrun probe as compatibility proof. Preserve the user's pilot scope and any deferred production rollout.

package/runtime/python/okstra_ctl/phases/implementation_planning/authoring.py

@@ -733,6 +733,23 @@ _DIR_SNAPSHOT_OWNED_NOTE = (
     "planner-fixable DISAGREE that asks to edit these four fields.\n"
 )
 
+# 구현 executor 는 소스 트리의 실 IO 테스트를 첫 편집 전에 거부한다. 계획이 그런
+# step 을 승인받으면 stage 가 변경 0 으로 멈춘다(2026-10-18 dev-11374 실측).
+_REAL_IO_STEP_NOTE = (
+    "\nReal-IO placement: this step must not create, edit, or run a test that "
+    "opens a real database connection, makes a real network call, or talks to "
+    "a real external service inside the project source test tree (`src/**`, "
+    "`test/**`, `tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, "
+    "`*.e2e-spec.*`), and its PASS must not depend on a reachable database or "
+    "service. The implementation executor refuses such a step before any edit. "
+    "Real-backend checks belong only in the stage's `Conformance tests:` "
+    "declaration, which the implementation run writes under "
+    "`<task_root>/qa/scripts/`, never commits, and treats as advisory. If this "
+    "step breaks the rule, vote DISAGREE(b) with Fixability planner-fixable and "
+    "name the real-IO test path or command. A test whose collaborator is "
+    "stubbed is not real IO.\n"
+)
+
 
 def _step_coordinate(payload: object, field: str) -> int | None:
     if not isinstance(payload, Mapping):
@@ -1022,6 +1039,8 @@ def _prompt(args: argparse.Namespace) -> str:
         rows.append(_render_prior_steps(item, all_items))
         if item_id.startswith("P-Prep-"):
             rows.append(_PREP_OWNERSHIP_NOTE)
+        if item_id.startswith("P-Step-"):
+            rows.append(_REAL_IO_STEP_NOTE)
         if item_id == "P-Dir-1":
             rows.append(_DIR_SNAPSHOT_OWNED_NOTE)
         split = _render_analyser_split(

package/runtime/python/okstra_ctl/phases/implementation_planning/instructions/plan-body-verification.md

@@ -316,6 +316,20 @@ from both numerator and denominator, and never converted to `DISAGREE`. Voting `
 dependency-missing command instead manufactures a defect the planner cannot fix by editing the plan,
 which is what sends the item into a self-fix round that can only paper over it.
 
+## Real-IO test in a committed step
+
+A `P-Step-*` item that creates, edits, or runs a test opening a real database connection, a real
+network call, or a real external service inside the project source test tree (`src/**`, `test/**`,
+`tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, `*.e2e-spec.*`), or whose `PASS` depends on a
+reachable database or service, is `DISAGREE(b)` with `planner-fixable`. The implementation executor
+refuses that step before its first edit (`_implementation-executor.md` "Real-IO test isolation"), so
+the stage would end with zero changes. The planner's fix is a stubbed-collaborator unit test in the
+step plus the stage's `Conformance tests:` declaration for the real-backend check. A test whose
+collaborator is stubbed is not real IO. **Enforced:** the rule reaches each verifier on every
+`P-Step-*` item through `okstra plan-items prompt`
+(`okstra_ctl.phases.implementation_planning.authoring._REAL_IO_STEP_NOTE`); the vote itself is
+verifier judgement.
+
 ## Mode constraint
 
 Plan-body verification only supports **lightweight mode** (defined in `prompts/lead/convergence.md` §"Verification Mode"). `full-reanalysis` is not meaningful here because the "original source materials" for a plan item are the worker's own analysis plus the lead-mediated synthesis — there is no independent ground truth to re-read. The manifest's top-level `verificationMode` is ignored for this round; lightweight is always used.

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -147,7 +147,8 @@ Plan for the actual worktree layout before approval. Shared documentation direct
       **Pick the cases by distinct outcome, not by line coverage.** When the stage writes or reconciles state, its meaningfully different outcomes are usually more than three — normal success, target already in the desired state (resume), existing data reused rather than created, a conflicting concurrent state, target absent, and mid-way failure with rollback. Enumerate the ones this stage actually implements and route them across the three lines (the `boundary` line is where resume / already-done / reuse belongs; `failure` carries conflict, absence, and rollback), naming each in the cell rather than collapsing them into "edge input". An implemented outcome with no declared case is a coverage gap the executor will not backfill.
   - **Per-stage subsections** (`## 5.5.<i> Stage <i>: <title>` for each `i`), each containing the four required subsections:
     - `### Carry-In` — for `depends-on (none)`: task-brief only. Otherwise: each depended-on stage's static exit contract + runtime sidecar path `runs/<impl-key>/carry/stage-<i>.json` placeholder.
-    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
+    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** **File size:** the implementation run aims for 300 physical lines per source and test file and enforces 400 — a new file over 400, an existing file taken past 400, and a file already over 400 that grows are blocking findings the executor must split in a correction round; the same conditions at 300 are advisory. When a step would add code or tests to a file near or over 300 lines (`wc -l`), plan a new module or test file for that responsibility in `plannedPaths` instead of appending to the existing one. **Enforced at implementation, not here:** `okstra correction file-size` (`scripts/okstra_ctl/file_size_cap.py`), re-run by `okstra stage-done`. `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
+    - **Real-IO tests stay out of the plan's committed steps (BLOCKING).** A step never creates, edits, or runs a test that opens a real database connection, makes a real network call, or talks to a real external service inside the project source test tree (`src/**`, `test/**`, `tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, `*.e2e-spec.*`), and no step's `PASS` depends on a reachable database or service. The implementation executor refuses such a step before its first edit (`_implementation-executor.md` "Real-IO test isolation"), so a plan that contains one stops the stage with zero changes (observed 2026-10-18, dev-11374: a live-MySQL `test/font-pairing.e2e-spec.ts` planned in steps 1, 4 and 5). The committed RED/GREEN steps test the adapter with its injected collaborator stubbed — the exact query text, its replacements, and the returned rows — and run without any backend. Real-backend verification is declared only as this stage's `Conformance tests:` line below (`requires=[db|http|external]`): the implementation run writes that script under `<task_root>/qa/scripts/`, runs it against a local or replica backend when one is reachable, never commits it, and records a non-PASS or unreachable backend as advisory. Read a brief line such as `verify: integration test against a test database` as that conformance declaration, not as a committed test. Do not plan a shared real-DB guard, a test DDL fixture, or an edit to an existing real-IO suite in source to support it. **Enforced:** every `P-Step-*` item of the §5.5.9 plan-body round carries this rule to its verifiers (`okstra_ctl.phases.implementation_planning.authoring._REAL_IO_STEP_NOTE`), which vote `DISAGREE(b)` on a step that breaks it; no path pattern tells a mocked test from a live one, so no validator checks it.
     - **The `command` cell runs inside an okstra task worktree, not a bare checkout (BLOCKING).** okstra provisions `.okstra`, the configured sync entries (`.project-docs`, `.claude`, …), and — for `implementation` — a nested `stage-<N>/` worktree into the tree the step executes in. Two consequences bind every command you write:
       - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step. Stage completion records the commit in the consumer ledger without creating or moving git tags.
       - **Never read an `.okstra/` artifact back out of a git object.** `.okstra/**` is gitignored and never committed — the executor aborts a commit that stages an ignored path and the verifier reports a committed `.okstra` path as a branch defect — so `git cat-file -e <tag>:.okstra/…`, `git show <tag>:.okstra/…`, and every variant of that read can never resolve, at any tag, in any stage. A later stage that needs a QA artifact reads it from the working tree or receives it through the carry sidecar / verifier result; do not design a stage contract around one being reachable from a tag. Validator S12 rejects the read.

package/runtime/python/okstra_ctl/phases/technical_verification/entry.py

@@ -98,3 +98,40 @@ def materialize_technical_input_packet(payload_json: str, run_root: Path, seq: s
         "- Read the input before planning experiments; copy each fact identity verbatim into results.\n"
         + "\n```json\n" + payload_json + "\n```\n"
     )
+
+
+def technical_evidence_packet_block(source: Path, project_root: Path) -> str:
+    """carry-in 이 시험 결과 기록이면 후속 비교 워커가 읽을 증거 위치를 렌더한다.
+
+    clarification carry-in 은 §1 행만 싣고 원문은 `Source report:` 한 줄로만
+    가리키므로, 이 블록이 없으면 워커는 시험 결과와 로그에 닿지 못한다.
+    """
+    from okstra_ctl.path_resolve import relative_to_project_root
+    from okstra_ctl.phases.technical_verification.validation import REPORT_NAME_RE
+
+    match = REPORT_NAME_RE.fullmatch(source.name)
+    if match is None or not source.is_file():
+        return ""
+    data = load_owned_object_snapshot(
+        source, artifact="technical verification result"
+    ).value
+    if (data.get("header") or {}).get("taskType") != "technical-verification":
+        return ""
+    experiments = source.parent.parent / "experiments" / match[1]
+    lines = [
+        "## Technical Verification Evidence",
+        "",
+        "The clarification response is a technical-verification record. Apply"
+        " `Technical evidence loop` in `## Phase Focus Extract`: read each"
+        " check's plan, commands and logs below before authoring a fresh"
+        " feasibility vote.",
+        "",
+        f"- Result record: `{relative_to_project_root(source, project_root)}`",
+        "- Experiment plans and logs:"
+        f" `{relative_to_project_root(experiments, project_root)}/`",
+    ]
+    for check in (data.get("technicalVerification") or {}).get("checks") or []:
+        lines.append(
+            f"- `{check.get('id')}` on `{check.get('candidateId')}`: {check.get('status')}"
+        )
+    return "\n".join(lines)

package/runtime/python/okstra_ctl/phases/technical_verification/validation.py

@@ -10,6 +10,8 @@ from okstra_ctl.implementation_direction import validate_task_artifact_path
 from okstra_ctl.json_boundary import load_owned_object_snapshot
 from okstra_ctl.technical_verification_facts import TechnicalVerificationError
 
+REPORT_NAME_RE = re.compile(r"final-report-technical-verification-(\d{3,})\.data\.json")
+
 
 def _check_execution_evidence(
     check: Mapping[str, Any], project_root: Path, run_root: Path, seq: str
@@ -51,9 +53,7 @@ def validate_technical_verification_report(
     """발행·최종 검증에서 같은 사실 집합과 실제 시험 산출물을 대조한다."""
     if (data.get("header") or {}).get("taskType") != "technical-verification":
         return []
-    match = re.fullmatch(
-        r"final-report-technical-verification-(\d{3,})\.data\.json", report_path.name
-    )
+    match = REPORT_NAME_RE.fullmatch(report_path.name)
     if match is None:
         return ["technical verification report must use its canonical record path"]
     run_root = report_path.parent.parent

package/runtime/python/okstra_ctl/process_group.py

@@ -84,6 +84,10 @@ def kill_group(pgid: int) -> bool:
         os.killpg(pgid, signal.SIGKILL)
     except ProcessLookupError:
         return False
+    except PermissionError:
+        # expected-miss: macOS 는 남은 구성원이 아직 거둬지지 않은 좀비뿐인 그룹에 EPERM 을
+        # 준다. 죽일 살아 있는 프로세스가 없다는 뜻이라, 끝난 워커의 결과를 버릴 이유가 아니다.
+        return False
     return True
 
 

package/runtime/python/okstra_ctl/render.py

@@ -26,7 +26,7 @@ import sys
 from collections.abc import Mapping
 from pathlib import Path
 
-from okstra_project.dirs import TASK_MANIFEST_FILENAME, OKSTRA_DIR_NAME, project_json_path
+from okstra_project.dirs import TASK_MANIFEST_FILENAME
 
 # phase 시퀀스 / 기본 next-phase 매핑의 SSOT 는 workflow 모듈이다. 과거
 # render_task_manifest 가 동일한 리스트/딕셔너리를 로컬에 중복 정의했는데,
@@ -50,6 +50,8 @@ from .registry.provider_registry import default_provider_registry
 from .path_hints import compact_active_run_context, hydrate_run_context
 from .paths import task_timeline_file
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
+from .mcp_servers import load_declarations as load_mcp_declarations
+from .mcp_servers import render_block as render_mcp_block
 from .report_contract import CURRENT_REPORT_SCHEMA_VERSION
 from .report_language import resolve_report_language
 from .validation_contract import CURRENT_VALIDATION_CONTRACT_VERSION
@@ -2509,54 +2511,11 @@ def render_task_index(template_path: str, output_path: str, ctx: dict) -> None:
 # --------------------------------------------------------------------------- #
 
 
-_NO_MCP_SERVERS_LINE = (
-    f"- No MCP servers are declared in `{OKSTRA_DIR_NAME}/project.json`'s "
-    "`mcpServers` array. Treat MCP tools as unavailable for this run. To enable "
-    "them, add entries shaped `{name, description, tools, notes?}` to that array "
-    "and re-render the bundle."
-)
-
-
 def build_available_mcp_servers_block(project_root: Path) -> str:
-    """Render the `## Available MCP Servers` first bullet from project.json.
-
-    The MCP server list used to be hardcoded for one specific environment.
-    It now comes from the project's okstra project.json (`mcpServers` array),
-    so each user/project declares the MCP surface available to their
-    lead+workers. Missing file or empty array yields a generic "none declared"
-    fallback.
-    """
-    config_path = project_json_path(project_root)
-    try:
-        raw = load_owned_object(config_path, artifact="project config")
-    except JsonBoundaryError:
-        return _NO_MCP_SERVERS_LINE
-    servers = raw.get("mcpServers") if isinstance(raw, dict) else None
-    if not isinstance(servers, list) or not servers:
-        return _NO_MCP_SERVERS_LINE
-    lines: list[str] = []
-    for entry in servers:
-        if not isinstance(entry, dict):
-            continue
-        name = str(entry.get("name", "")).strip()
-        if not name:
-            continue
-        description = str(entry.get("description", "")).strip()
-        tools = entry.get("tools") or []
-        notes = str(entry.get("notes", "")).strip()
-        parts = [f"`mcp__{name}`"]
-        if description:
-            parts.append(description)
-        if isinstance(tools, list) and tools:
-            tool_names = ", ".join(
-                f"`{str(t).strip()}`" for t in tools if str(t).strip()
-            )
-            if tool_names:
-                parts.append(f"Tools: {tool_names}")
-        if notes:
-            parts.append(notes)
-        lines.append("- " + ". ".join(parts) + ".")
-    return "\n".join(lines) if lines else _NO_MCP_SERVERS_LINE
+    """provider 판정 없이 렌더한다. prepare 는 판정한 블록을 ctx 로 넘기므로
+    이 경로는 prepare 를 거치지 않는 렌더 호출자만 쓴다."""
+    declarations, _problems = load_mcp_declarations(project_root)
+    return render_mcp_block(declarations)
 
 
 # --------------------------------------------------------------------------- #

package/runtime/python/okstra_ctl/report_assembly.py

@@ -18,6 +18,7 @@ from .clarification_items import (
 )
 from .final_report_schema import load_schema_version, validate
 from .report_inputs import ReportInputPath, report_input_paths, uses_report_contract_v3
+from .correction_round import correction_convergence_states, correction_round
 from .json_boundary import JsonBoundaryError, load_owned_object, serialize_owned_object
 from .report_narrative import parse_narrative, task_narrative_errors
 from .report_synthesis_packet import (
@@ -98,6 +99,32 @@ def _read_json(row: ReportInputPath) -> dict[str, Any]:
     return value
 
 
+def _correction_round_convergence(
+    initial: ReportInputPath, cross: Mapping[str, Any],
+) -> tuple[list[dict[str, Any]], list[tuple[str, Mapping[str, Any]]]]:
+    """Each correction round's re-convergence, projected like the initial one, and the
+    evidence it promotes labelled `convergence <scope>`."""
+    rows: list[dict[str, Any]] = []
+    promoted: list[tuple[str, Mapping[str, Any]]] = []
+    consensus = len(cross["consensus"])
+    differences = len(cross["differences"])
+    for scope, path in correction_convergence_states(initial.path):
+        row = ReportInputPath(initial.key, initial.owner, path)
+        try:
+            result = project_convergence(
+                _read_json(row),
+                first_consensus=consensus + 1, first_difference=differences + 1,
+            )
+        except ReportProjectionError as exc:
+            _fail(row.owner, path, "$", exc)
+        projected = result["crossVerification"]
+        consensus += len(projected["consensus"])
+        differences += len(projected["differences"])
+        rows.append({"round": correction_round(scope), **projected})
+        promoted.extend((f"convergence {scope}", item) for item in result["promotedEvidence"])
+    return rows, promoted
+
+
 def _input_map(project_root: Path, manifest: Mapping[str, Any]) -> dict[str, ReportInputPath]:
     try:
         return {row.key: row for row in report_input_paths(project_root, manifest)}
@@ -488,6 +515,11 @@ def _compose(
     data = {"schemaVersion": "3.0", **narrative, **execution}
     data["tokenUsage"] = usage
     data["crossVerification"] = convergence_data["crossVerification"]
+    rounds, round_evidence = _correction_round_convergence(
+        inputs["convergence"], data["crossVerification"]
+    )
+    if rounds:
+        data["crossVerification"]["correctionRounds"] = rounds
     data["clarificationItems"] = _clarifications(ledger, activities, inputs["approval-decisions"].path)
     # 작성자의 사실 분류와 리드 원장의 질문 연결은 양쪽 입력을 합친 뒤 검사한다.
     for reason in validate_blocked_answer_channel(data):
@@ -504,8 +536,13 @@ def _compose(
     if scope:
         data["verificationScope"] = scope
     data["agentActivity"] = activities
-    data["evidence"] = {"primary": _promoted_evidence(convergence_data)}
-    data["missingInformation"] = _census_missing_information(project_root, manifest)
+    data["evidence"] = {"primary": _promoted_evidence([
+        *(("convergence", item) for item in convergence_data["promotedEvidence"]),
+        *round_evidence,
+    ])}
+    data["missingInformation"] = _missing_information(
+        project_root, manifest, convergence_data["criticUnverified"],
+    )
     # 스냅샷 복사가 _attach_metadata 보다 먼저다 — frontmatter 가
     # selectedDirectionRef.snapshotPath 를 읽는다.
     _apply_selected_direction_snapshot(data, project_root, manifest)
@@ -529,16 +566,16 @@ def _attach_discussion(data: dict[str, Any], project_root: Path, manifest: Mappi
         _fail("discussion-record", store.records_path, "discussion", exc)
 
 
-def _census_missing_information(
-    project_root: Path, manifest: Mapping[str, Any],
+def _missing_information(
+    project_root: Path, manifest: Mapping[str, Any], critic_unverified: list[dict[str, Any]],
 ) -> list[dict[str, Any]]:
-    """Coverage-census warnings are the only rows this field carries under the
-    v3 contract, so they number from `R-001`."""
-    state = read_census_state(project_root, manifest)
-    if state is None:
-        return []
+    """Coverage-census warnings and unjudged critic gaps are the only rows this
+    field carries under the v3 contract, so they number from `R-001`."""
     _project_id, _task_group, task_id = _identity(manifest)
-    rows = census_warning_rows(state, ticket_id=task_id or "unknown")
+    ticket_id = task_id or "unknown"
+    state = read_census_state(project_root, manifest)
+    rows = [] if state is None else census_warning_rows(state, ticket_id=ticket_id)
+    rows += [{**row, "ticketId": row["ticketId"] or ticket_id} for row in critic_unverified]
     return [{"id": f"R-{index:03d}", **row} for index, row in enumerate(rows, start=1)]
 
 
@@ -717,16 +754,16 @@ def _attach_metadata(data: dict[str, Any], manifest: Mapping[str, Any]) -> None:
     }
 
 
-def _promoted_evidence(convergence: Mapping[str, Any]) -> list[dict[str, Any]]:
+def _promoted_evidence(rows: list[tuple[str, Mapping[str, Any]]]) -> list[dict[str, Any]]:
     return [
         {
             "id": f"E-{index:03d}",
             "ticketId": row["ticketId"],
             "evidence": row["evidence"],
             "sourceItems": row["sourceItems"],
-            "source": "convergence",
+            "source": source,
         }
-        for index, row in enumerate(convergence.get("promotedEvidence") or [], start=1)
+        for index, (source, row) in enumerate(rows, start=1)
     ]
 
 

package/runtime/python/okstra_ctl/report_html/common.py

@@ -403,8 +403,10 @@ def anchor_index(
         for row_id in sorted(found)
         if isinstance(row_id, str) and _anchorable(row_id)
     }
+    cross = data.get("crossVerification") if isinstance(data.get("crossVerification"), dict) else {}
+    rounds = [cross, *(r for r in cross.get("correctionRounds") or [] if isinstance(r, dict))]
     for block in ("consensus", "differences"):
-        for row in _dig(data, ("crossVerification", block)):
+        for row in (row for scope in rounds for row in scope.get(block) or []):
             row_id = row.get("id") if isinstance(row, dict) else None
             if isinstance(row_id, str) and _anchorable(row_id) and row_id not in index:
                 index[row_id] = f"id-xv-{row_id}"

package/runtime/python/okstra_ctl/report_language.py

@@ -1,10 +1,9 @@
 """Report-language resolution — the one place the precedence lives.
 
-Two surfaces need the answer and must agree: the `**Report Language:**` line
-both dispatchers stamp into the report-writer prompt, and `reportLanguage` in
-the run manifest, which report assembly copies into `meta.reportLanguage` and
-the HTML renderer reads. When only the prompt called this, a project could ask
-for `ko`, get a Korean-instructed writer, and still ship an English report.
+Prepare calls this once and freezes the answer as `reportLanguage` in the run
+manifest. Both report-writer dispatch paths stamp that manifest value as the
+`**Report Language:**` line, and report assembly copies it into
+`meta.reportLanguage`, so a config edit after prepare cannot split the two.
 
 The value is a language tag (`en`, `ko`, `fr`, `pt-BR`, …). The report writer
 authors the report prose in that language; nothing here knows any particular

package/runtime/python/okstra_ctl/report_projections.py

@@ -261,8 +261,14 @@ def _source_items(finding: Mapping[str, Any]) -> list[str]:
     return [f"{_text(worker, 'worker').removesuffix('-worker')}:{finding_id}" for worker in workers]
 
 
-def project_convergence(state: Mapping[str, Any]) -> dict[str, Any]:
-    """수렴 상태에서 독자용 합의·이견과 공개 근거만 승격한다."""
+def project_convergence(
+    state: Mapping[str, Any], *, first_consensus: int = 1, first_difference: int = 1,
+) -> dict[str, Any]:
+    """수렴 상태에서 독자용 합의·이견과 공개 근거만 승격한다.
+
+    정정 라운드 재수렴은 초기 행 다음 번호부터 매긴다 — 행 id 가 리포트 앵커라 한 리포트
+    안에서 겹치면 안 된다.
+    """
     consensus = []
     differences = []
     promoted = []
@@ -274,7 +280,7 @@ def project_convergence(state: Mapping[str, Any]) -> dict[str, Any]:
         ticket_id = _text(ticket_ids[0] if ticket_ids else "unknown", "unknown")
         if finding.get("classification") in {"full-consensus", "partial-consensus"}:
             row = {
-                "id": f"CV-{len(consensus) + 1:03d}",
+                "id": f"CV-{len(consensus) + first_consensus:03d}",
                 "ticketId": ticket_id,
                 "statement": _text(finding.get("summary"), "Converged finding"),
                 "sourceItems": _source_items(finding),
@@ -298,7 +304,7 @@ def project_convergence(state: Mapping[str, Any]) -> dict[str, Any]:
                         "position": "origin" if worker == finding.get("originWorker") else "dissent",
                     })
             differences.append({
-                "id": f"D-{len(differences) + 1:03d}",
+                "id": f"D-{len(differences) + first_difference:03d}",
                 "ticketId": ticket_id,
                 "disagreement": _text(finding.get("summary"), "Unresolved difference"),
                 "workersPosition": positions or [{"worker": "unknown", "itemId": "", "position": "unresolved"}],
@@ -311,5 +317,40 @@ def project_convergence(state: Mapping[str, Any]) -> dict[str, Any]:
             "differences": differences,
         },
         "promotedEvidence": promoted,
+        "criticUnverified": _critic_unverified(state),
     }
+    critic = (state.get("config") or {}).get("critic")
+    if isinstance(critic, Mapping):
+        result["crossVerification"]["criticGaps"] = {
+            "proposed": critic.get("gapsProposed", 0),
+            "merged": critic.get("gapsMerged", 0),
+            "unverified": critic.get("gapsUnverified", 0),
+        }
     return result
+
+
+def _critic_unverified(state: Mapping[str, Any]) -> list[dict[str, Any]]:
+    """미판정 gap 하나당 Missing Information 행 하나 — id 와 기본 ticket 은 조립이 채운다."""
+    ledger = (state.get("criticVerification") or {}).get("gaps") or []
+    tickets = {
+        gap.get("gapId"): (gap.get("ticketIds") or [None])[0]
+        for gap in ledger
+        if isinstance(gap, Mapping)
+    }
+    rows = []
+    for gap in state.get("unverifiedGaps") or []:
+        if not isinstance(gap, Mapping):
+            continue
+        gap_id = _text(gap.get("gapId"), "unknown")
+        rows.append({
+            "ticketId": tickets.get(gap_id),
+            "item": f"Coverage critic gap `{gap_id}` was never verified: "
+                    f"{_text(gap.get('summary'), 'no summary')}",
+            "risk": (
+                f"Verification did not complete ({_text(gap.get('reason'), 'unknown reason')}), "
+                "so no analyser has judged this gap; it is neither a finding nor a rejection."
+            ),
+            "owner": "Okstra lead",
+            "source": "critic-unverified",
+        })
+    return rows