okstra 0.225.0 → 0.226.0

package/runtime/python/okstra_ctl/phases/implementation_option_selection/authoring.py

@@ -52,12 +52,18 @@ def requirement_instructions(original_requirement_ids: Sequence[str], participat
         "A ranked option is valid only when every participating analyser "
         "supplied one feasibility vote, at least "
         f"{required_feasible_votes(participating_analysers)} of them are "
-        "`feasible`, and both `safetyBlockers` and `unresolvedFeasibilityFacts` "
-        "are empty.",
+        "`feasible`, `safetyBlockers` is empty, and every "
+        "`unresolvedFeasibilityFacts` entry is a `deferred-gate` fact that names "
+        "its `gate`. A candidate whose `splitAcceptance.clarificationRef` names "
+        "the user's `accept-risk` answer to the split needs one `feasible` vote, "
+        "and its remaining facts stay on the row as the accepted risk; never set "
+        "`splitAcceptance` before that answer is recorded.",
         ("Classify each `unresolvedFeasibilityFacts` entry with `resolutionKind`: "
         "`user-decision` requires nonempty `clarificationRefs` linking that fact "
         "to actual C-NNN records, including answered records; `technical-verification` "
-        "requires no user question. Preserve the fact, whyItMatters, and evidence. "
+        "requires no user question; `deferred-gate` is for a fact only a later gate "
+        "can close (a deployed-environment measurement technical-verification may not "
+        "run) and requires `gate` naming that gate. Preserve the fact, whyItMatters, and evidence. "
         "Historical unclassified facts remain readable but require classification "
         "before blocked report reassembly. Saving does not lift blocked routing."),
         ("After a linked decision is answered, preserve its disposition and selected "
@@ -73,8 +79,10 @@ def requirement_instructions(original_requirement_ids: Sequence[str], participat
         "`requirement-fit`, `correctness-risk`, `architecture-fit`, "
         "`weightedScore`, then id.",
         "In `candidate-comparison`, keep `preselectedDirection` null. In "
-        "`preselected-validation`, emit exactly one validated option, an empty "
-        "`candidateAudit`, and a cited `preselectedDirection`.",
+        "`preselected-validation`, keep a cited `preselectedDirection`; a "
+        "validated direction is the only ranked option with an empty "
+        "`candidateAudit`, and a direction that did not validate is the only "
+        "`candidateAudit` row with no ranked option.",
         "Record candidate validity and selection mode; the lead chooses the next "
         "phase under `## implementation-option-selection` in "
         "`prompts/lead/phase-routing.md`.",

package/runtime/python/okstra_ctl/phases/implementation_option_selection/boundary.json

@@ -1,5 +1,5 @@
 {
-  "allowed": "  - candidate-comparison evidence for up to three options per worker\n  - preselected-validation of exactly ONE candidate: every analyser returns its own feasibility verdict on that one direction, `candidateAudit` stays empty, and no analyser generates an alternative. It is not a re-evaluation of the merged set — `okstra_ctl.phases.implementation_option_selection.validation._validate_mode` rejects a preselected-validation report carrying more than one option or a non-empty audit\n  - a ranked display of at most three options with requirement mappings\n  - an audit record for every rejected candidate\n  - one endStateCoverage row per brief end-state id (this phase authors no goal of its own)",
+  "allowed": "  - candidate-comparison evidence for up to three options per worker\n  - preselected-validation of exactly ONE candidate: every analyser returns its own feasibility verdict on that one direction and no analyser generates an alternative. A validated direction is the only ranked option with an empty `candidateAudit`; a direction that did not validate is the only `candidateAudit` row and the run routes `blocked` or `technical-verification`. It is not a re-evaluation of the merged set — `okstra_ctl.phases.implementation_option_selection.validation._validate_mode` rejects any other shape\n  - a ranked display of at most three options with requirement mappings\n  - an audit record for every rejected candidate\n  - one endStateCoverage row per brief end-state id (this phase authors no goal of its own)",
   "forbidden": [
     "source or configuration edits, refactors, or fix attempts",
     "tests, builds, migrations, deployments, or any state-mutating command",

package/runtime/python/okstra_ctl/phases/implementation_option_selection/entry.py

@@ -2,9 +2,15 @@
 from __future__ import annotations
 
 from pathlib import Path
+from okstra_ctl.final_report_paths import final_report_data_path
+from okstra_ctl.json_boundary import JsonBoundaryError, load_owned_object
+from okstra_ctl.path_resolve import relative_to_project_root
 from okstra_ctl.prepare_error import PrepareError
 from okstra_ctl.scope_provenance import brief_end_state_id_sequence
 
+CANDIDATE_COMPARISON = "candidate-comparison"
+PRESELECTED_VALIDATION = "preselected-validation"
+
 
 def validate_brief_requirements(brief_path: Path) -> None:
     if not brief_end_state_id_sequence(brief_path):
@@ -12,3 +18,64 @@ def validate_brief_requirements(brief_path: Path) -> None:
             "regenerate the brief with stable end-state IDs before starting "
             "implementation-option-selection"
         )
+
+
+def selection_mode(preselected_direction: str) -> str:
+    return PRESELECTED_VALIDATION if preselected_direction.strip() else CANDIDATE_COMPARISON
+
+
+def upstream_next_steps(carry_in: Path) -> tuple[str, ...]:
+    """The next-phase instruction a carried-in report gave this phase.
+
+    The clarification carry-in projects only the report's C-NNN rows, so a
+    routing rationale such as "confirm one already-chosen direction" never
+    reached the designers.
+    """
+    data_path = final_report_data_path(carry_in)
+    if not data_path.is_file():
+        return ()
+    try:
+        data = load_owned_object(data_path, artifact="carried-in final report")
+    except JsonBoundaryError as exc:
+        raise PrepareError(str(exc)) from exc
+    card = data.get("verdictCard")
+    steps = [card.get("nextStep")] if isinstance(card, dict) else []
+    for row in data.get("recommendedNextSteps") or []:
+        if isinstance(row, dict):
+            steps.append(row.get("text"))
+    return tuple(step.strip() for step in steps if isinstance(step, str) and step.strip())
+
+
+def selection_mode_packet_block(
+    preselected_direction: str, carry_in: Path | None, project_root: Path,
+) -> str:
+    mode = selection_mode(preselected_direction)
+    lines = ["## Direction Selection Mode", "", f"This run's mode: `{mode}`.", ""]
+    if mode == PRESELECTED_VALIDATION:
+        lines += [
+            "The lead preselected the direction below. Validate only this direction",
+            "as `Worker direction-selection procedure` describes for",
+            "`preselected-validation`: do not generate, rank or compare alternatives.",
+            "Record open choices inside the direction as uncertainties with evidence.",
+            "",
+            "### Preselected Direction and Citation",
+            "",
+            preselected_direction.strip(),
+        ]
+    else:
+        lines += [
+            "No direction was preselected for this run. Propose and compare",
+            "candidates as `Worker direction-selection procedure` describes for",
+            "`candidate-comparison`.",
+        ]
+    steps = upstream_next_steps(carry_in) if carry_in is not None else ()
+    if steps:
+        lines += [
+            "",
+            "### Upstream Next-Phase Instruction",
+            "",
+            f"From `{relative_to_project_root(final_report_data_path(carry_in), project_root)}`:",
+            "",
+            *(f"- {step}" for step in steps),
+        ]
+    return "\n".join(lines)

package/runtime/python/okstra_ctl/phases/implementation_option_selection/profile.md

@@ -8,7 +8,8 @@
 - Worker direction-selection procedure:
   - In `candidate-comparison` mode, produce candidate, supporting and contradicting evidence, criterion scores, and requirement mappings. For every candidate, state one feasibility verdict — `feasible`, `not-feasible`, or `uncertain` — with a rationale and the strongest counterevidence, each citing inspected evidence. Write the rationale as long as the argument needs: say why each cited finding supports the verdict, not only which findings do. The report's `feasibilityVotes` row for this worker is built from that statement, so a candidate without one leaves the writer nothing but another worker's words.
   - In `candidate-comparison` mode only, submit at most three candidates. A candidate must be feasible from inspected evidence, not from an assumed future change.
-  - In `preselected-validation` mode, receive one preselected direction from the lead and validate its evidence, counterevidence, criterion scores, and requirement mappings, and state the same feasibility verdict with its rationale and counterevidence. The worker must not generate new candidates.
+  - Read the run's mode, and in `preselected-validation` the one preselected direction with its citation, from the packet's `## Direction Selection Mode` section (`--preselected-direction`).
+  - In `preselected-validation` mode, validate the one preselected direction: its evidence, counterevidence, criterion scores, and requirement mappings, and state the same feasibility verdict with its rationale and counterevidence. The worker must not generate new candidates.
   - Do not produce detailed file lists, stage maps, execution commands, or a plan approval request.
 - Census aspects:
   - requirement mapping: Which candidate or preselected direction satisfies this requirement, and how?
@@ -26,7 +27,8 @@
   - Map every displayed candidate or preselected direction to the stable brief end-state IDs it satisfies, preserves, or leaves unresolved.
   - **Close the vote gaps before you conclude `blocked`.** Round 1 runs the designers in parallel, so each one votes only on the candidates it proposed and the merged set ends up with a different hole per analyser. A candidate that is otherwise sound then fails the every-analyser clause and drops out of the ranking — three such candidates blocked a run whose comparison had in fact converged (2026-09-10, dev-10629-4: IO-001, IO-002 and IO-003 each held two `feasible` votes and each was missing a different designer). Run `okstra option-votes gaps --task-manifest <taskManifestPath> --narrative <report writer narrative>` before assembly. For each analyser it names, dispatch one vote-completion assignment asking for that analyser's own feasibility verdict, rationale, and counterevidence on the named candidate — no new candidate, so the run stays in `candidate-comparison` mode. The command reports no gap when a vote cannot settle the block (safety blockers, unresolved feasibility facts, too few feasible verdicts); that is the honest `blocked`.
 - Clarification request policy (phase-specific addenda — shared policy is in `_common-contract.md`):
-  - Classify every `unresolvedFeasibilityFacts` entry with `resolutionKind`: `user-decision` requires nonempty `clarificationRefs` naming the actual C-NNN records for that fact; `technical-verification` requires source review, design evidence, or experiments and does not require a user question. Preserve `fact`, `whyItMatters`, and `evidence`. Reuse answered questions and their recorded dispositions; never reopen one merely to save the report. An unrelated open question does not satisfy a missing reference. Historical unclassified entries remain readable, but blocked report reassembly requires the writer to classify them explicitly. Enforced by `validate_blocked_answer_channel` in `scripts/okstra_ctl/phases/implementation_option_selection/validation.py`, called by report assembly and `validate-run.py`. Saving preserves `routing: blocked` and does not make a candidate valid. In `humanSummary.actions`, `verdictCard.nextStep`, and selection guidance, distinguish pending user decisions from remaining technical verification; after the pilot route is answered, carry the selected route and remove the old answer-waiting instruction.
+  - Classify every `unresolvedFeasibilityFacts` entry with `resolutionKind`: `user-decision` requires nonempty `clarificationRefs` naming the actual C-NNN records for that fact; `technical-verification` requires source review, design evidence, or experiments and does not require a user question. `deferred-gate` marks a fact that no technical-verification run can close because closing it needs something that phase forbids, such as a deployed environment (for example, a cold-start measurement of a deployed Lambda); it requires `gate`, naming where the fact closes (a brief `External Gates` entry, or final-verification user-owned external QA), and it does not make the candidate invalid. A fact that a probe, a source read, or a disposable local service can close is `technical-verification`, not `deferred-gate`. The selected direction snapshot carries every remaining fact of the chosen option as `deferredFeasibilityFacts`, so planning schedules its gate. Enforced by `blocking_feasibility_facts` in `scripts/okstra_ctl/phases/implementation_option_selection/validation.py`. Preserve `fact`, `whyItMatters`, and `evidence`. Reuse answered questions and their recorded dispositions; never reopen one merely to save the report. An unrelated open question does not satisfy a missing reference. Historical unclassified entries remain readable, but blocked report reassembly requires the writer to classify them explicitly. Enforced by `validate_blocked_answer_channel` in `scripts/okstra_ctl/phases/implementation_option_selection/validation.py`, called by report assembly and `validate-run.py`. Saving preserves `routing: blocked` and does not make a candidate valid. In `humanSummary.actions`, `verdictCard.nextStep`, and selection guidance, distinguish pending user decisions from remaining technical verification; after the pilot route is answered, carry the selected route and remove the old answer-waiting instruction.
+  - **A split vote ends in a user decision, not another run.** When no candidate is valid only because its votes split (at least one `feasible`, the others `uncertain` or `not-feasible`, no `safetyBlockers`), another option-selection or technical-verification run asks the same designers the same question and returns the same split (fontradar dev-11562: three runs, `feasible` against `uncertain` each time). Before you route `blocked` or `technical-verification` on such a candidate, open one approval decision for it with `okstra approval-decision open --ledger <approvalDecisionsPath>` (classification `noncritical-dissent`): the recommended option is `accept-risk` (proceed with this direction and carry the dissent and the remaining facts into planning), the alternative is `request-revision` (keep the run blocked). Ask the user in-session; record the answer with `okstra approval-decision resolve`. On `accept-risk`, the writer sets `splitAcceptance.clarificationRef` on that candidate, which makes it valid with one `feasible` vote; it then follows the ordinary routing (`implementation-planning` for a validated preselected direction, `pending-direction-selection` in `candidate-comparison`). Leave the votes and facts on the row. When the user is not present, publish the report `blocked` with that approval row open; the next run carries the answer. Enforced by `validate_split_acceptance` in `scripts/okstra_ctl/phases/implementation_option_selection/validation.py`, called by report assembly and `validate-run.py`.
 {{INCLUDE:_clarification-recommendation.md}}
 - Cross-verification mode:
   - Phase 5.5 convergence runs in adversarial mode (`convergence.adversarial=true`).

package/runtime/python/okstra_ctl/phases/implementation_option_selection/report_assets/implementation-option-selection.template.html

@@ -33,6 +33,7 @@
       <table data-report-field="implementationOptionSelection.rankedOptions.feasibilityVotes"><thead><tr><th>{{ t('tasks.implementation-option-selection.worker') }}</th><th>{{ t('tasks.implementation-option-selection.reason') }}</th><th>{{ t('tasks.implementation-option-selection.counterevidence') }}</th></tr></thead><tbody>{% for vote in row.feasibilityVotes %}<tr>{{ row_key(pairs=[(t('tasks.implementation-option-selection.worker'), vote.worker)], status_name=t('tasks.implementation-option-selection.verdict'), status_raw=vote.verdict, status_text=vote.verdict | enum_label('feasibilityVerdict')) }}<td>{{ vote.rationale | inline_code(extra) }}</td><td>{{ vote.counterevidence | inline_code(extra) }}</td></tr>{% endfor %}</tbody></table>
       {% if row.safetyBlockers %}<p><strong>{{ t('tasks.implementation-option-selection.safety-blockers') }}</strong></p>
       <ul>{% for blocker in row.safetyBlockers %}<li><span class="status status-risk">{{ blocker.category | enum_label('safetyCategory') }}</span> {{ blocker.statement | inline_code(extra) }} <span class="evidence-refs">{{ t('macros.layout.evidence') }} {{ blocker.evidence | evidence_refs(extra) }}</span></li>{% endfor %}</ul>{% endif %}
+      {% if row.get('splitAcceptance') %}<p><strong>{{ t('tasks.implementation-option-selection.split-acceptance') }}</strong> {{ row.splitAcceptance.clarificationRef | inline_code(extra) }}</p>{% endif %}
       {{ unresolved_facts(row, extra) }}
     </div>
     <div class="option-detail">
@@ -49,7 +50,7 @@
 
 {% macro unresolved_facts(row, extra) -%}
 {% if row.unresolvedFeasibilityFacts %}<p><strong>{{ t('tasks.implementation-option-selection.unresolved-facts') }}</strong></p>
-      <ul>{% for fact in row.unresolvedFeasibilityFacts %}<li>{% if fact.get('resolutionKind') == 'technical-verification' %}{{ t('tasks.implementation-option-selection.technical-verification') }}: {% elif fact.get('resolutionKind') == 'user-decision' %}{{ t('tasks.implementation-option-selection.user-decision') }} ({{ fact.get('clarificationRefs', []) | join(', ') | inline_code(extra) }}): {% else %}{{ t('tasks.implementation-option-selection.classification-required') }}: {% endif %}{{ fact.fact | inline_code(extra) }} — {{ t('tasks.implementation-option-selection.why-it-matters') }} {{ fact.whyItMatters | inline_code(extra) }} <span class="evidence-refs">{{ t('macros.layout.evidence') }} {{ fact.evidence | evidence_refs(extra) }}</span></li>{% endfor %}</ul>{% endif %}
+      <ul>{% for fact in row.unresolvedFeasibilityFacts %}<li>{% if fact.get('resolutionKind') == 'technical-verification' %}{{ t('tasks.implementation-option-selection.technical-verification') }}: {% elif fact.get('resolutionKind') == 'deferred-gate' %}{{ t('tasks.implementation-option-selection.deferred-gate') }} ({{ fact.get('gate', '') | inline_code(extra) }}): {% elif fact.get('resolutionKind') == 'user-decision' %}{{ t('tasks.implementation-option-selection.user-decision') }} ({{ fact.get('clarificationRefs', []) | join(', ') | inline_code(extra) }}): {% else %}{{ t('tasks.implementation-option-selection.classification-required') }}: {% endif %}{{ fact.fact | inline_code(extra) }} — {{ t('tasks.implementation-option-selection.why-it-matters') }} {{ fact.whyItMatters | inline_code(extra) }} <span class="evidence-refs">{{ t('macros.layout.evidence') }} {{ fact.evidence | evidence_refs(extra) }}</span></li>{% endfor %}</ul>{% endif %}
 {%- endmacro %}
 
 {% block human_content %}

package/runtime/python/okstra_ctl/phases/implementation_option_selection/validation.py

@@ -41,6 +41,11 @@ MAX_RANKED_OPTIONS = 3
 MAX_RAW_CANDIDATES_PER_ANALYSER = 3
 CANDIDATE_COMPARISON_ROUTING = "pending-direction-selection"
 NO_VALID_OPTIONS_ROUTING = "blocked"
+# 배포된 환경이 있어야 닫히는 사실(예: 배포된 Lambda 의 실행 시간)은
+# technical-verification 이 배포를 금하므로 그 phase 의 재실행으로 닫히지 않는다.
+# 그런 사실은 닫히는 게이트를 적고 후보를 무효로 만들지 않는다.
+DEFERRED_GATE_KIND = "deferred-gate"
+SPLIT_ACCEPTANCE_DISPOSITION = "accept-risk"
 
 _FINGERPRINT_FIELDS = (
     "goal",
@@ -233,6 +238,37 @@ def required_feasible_votes(participating_analysers: Sequence[str]) -> int:
     return min(MIN_FEASIBLE_VOTES, max(1, len(set(participating_analysers))))
 
 
+def split_acceptance_ref(option: Mapping[str, object]) -> str:
+    """후보가 인용한 사용자 위험 감수 결정의 C-id. 없으면 빈 문자열."""
+    acceptance = option.get("splitAcceptance")
+    if not isinstance(acceptance, Mapping):
+        return ""
+    return str(acceptance.get("clarificationRef") or "").strip()
+
+
+def _is_deferred_gate_fact(fact: object) -> bool:
+    return (
+        isinstance(fact, Mapping)
+        and fact.get("resolutionKind") == DEFERRED_GATE_KIND
+        and bool(str(fact.get("gate") or "").strip())
+    )
+
+
+def blocking_feasibility_facts(option: Mapping[str, object]) -> list[object]:
+    """후보를 무효로 두는 미확정 사실.
+
+    게이트를 적은 `deferred-gate` 사실은 막지 않는다. 사용자가 위험 감수로
+    받아들인 후보(`splitAcceptance`)는 남은 사실을 기록으로만 들고 간다 —
+    계획 phase 의 `accept-risk` 와 같은 뜻이다.
+    """
+    if split_acceptance_ref(option):
+        return []
+    return [
+        fact for fact in option.get("unresolvedFeasibilityFacts") or ()
+        if not _is_deferred_gate_fact(fact)
+    ]
+
+
 def _validate_option_feasibility(
     option: Mapping[str, object],
     participating_analysers: Sequence[str],
@@ -255,13 +291,36 @@ def _validate_option_feasibility(
         isinstance(vote, Mapping) and vote.get("verdict") == "feasible"
         for vote in votes
     )
-    required = required_feasible_votes(participating_analysers)
+    # 갈린 표는 같은 분석자들에게 다시 물어도 갈린다. 사용자가 위험 감수로
+    # 받아들인 후보는 `feasible` 한 표로 충분하다 — 방향을 낸 근거가 있어야
+    # 받아들일 대상이 있다.
+    accepted = bool(split_acceptance_ref(option))
+    required = 1 if accepted else required_feasible_votes(participating_analysers)
     if require_valid and feasible < required:
-        errors.append(f"{option_id} must have at least {required} feasible vote(s)")
+        errors.append(
+            f"{option_id} must have at least {required} feasible vote(s); a split "
+            "vote is settled by a user accept-risk decision cited in splitAcceptance, "
+            "not by another run with the same analysers"
+        )
     if require_valid and option.get("safetyBlockers"):
         errors.append(f"{option_id} safetyBlockers must be empty")
-    if require_valid and option.get("unresolvedFeasibilityFacts"):
-        errors.append(f"{option_id} unresolvedFeasibilityFacts must be empty")
+    blocking_facts = blocking_feasibility_facts(option)
+    if require_valid and blocking_facts:
+        errors.append(
+            f"{option_id} unresolvedFeasibilityFacts must be empty, "
+            f"{DEFERRED_GATE_KIND} facts that name their gate, or accepted through "
+            "splitAcceptance"
+        )
+    for index, fact in enumerate(option.get("unresolvedFeasibilityFacts") or ()):
+        if (
+            isinstance(fact, Mapping)
+            and fact.get("resolutionKind") == DEFERRED_GATE_KIND
+            and not _is_deferred_gate_fact(fact)
+        ):
+            errors.append(
+                f"{option_id} unresolvedFeasibilityFacts[{index}]: a "
+                f"{DEFERRED_GATE_KIND} fact must name the gate that closes it"
+            )
     copied = _copied_votes(votes)
     for first, second in copied:
         errors.append(
@@ -272,7 +331,7 @@ def _validate_option_feasibility(
         all_participated
         and feasible >= required
         and not option.get("safetyBlockers")
-        and not option.get("unresolvedFeasibilityFacts")
+        and not blocking_facts
         and not copied
     )
 
@@ -415,9 +474,7 @@ def vote_gaps(
         for row in (selection.get(key) or ())
         if isinstance(row, Mapping)
     ):
-        if candidate.get("safetyBlockers") or candidate.get(
-            "unresolvedFeasibilityFacts"
-        ):
+        if candidate.get("safetyBlockers") or blocking_feasibility_facts(candidate):
             continue
         votes = candidate.get("feasibilityVotes") or ()
         if _copied_votes(votes):
@@ -489,12 +546,13 @@ def validate_blocked_answer_channel(
                 continue
             label += f" ({fact.get('fact')})"
             kind = fact.get("resolutionKind")
-            if kind == "technical-verification":
+            if kind in {"technical-verification", DEFERRED_GATE_KIND}:
                 continue
             if kind != "user-decision":
                 errors.append(f"{label}: classification required — set resolutionKind to "
-                              "user-decision or technical-verification; preserve the fact "
-                              "and evidence, then reassemble; do not infer a user question")
+                              "user-decision, technical-verification or deferred-gate; "
+                              "preserve the fact and evidence, then reassemble; do not "
+                              "infer a user question")
                 continue
             refs = fact.get("clarificationRefs")
             if not isinstance(refs, list) or not refs or any(
@@ -507,6 +565,46 @@ def validate_blocked_answer_channel(
     return errors
 
 
+def validate_split_acceptance(report_data: Mapping[str, object]) -> list[str]:
+    """`splitAcceptance` 가 인용한 C-id 가 사용자의 위험 감수 기록인지 검사한다.
+
+    서술 검증(`validate_implementation_option_selection`)은 clarification 행을
+    보지 못한다. 리드 원장이 합쳐진 뒤에만 이 인용이 실제 `accept-risk` 답인지
+    알 수 있으므로 조립과 `validate-run.py` 가 이 함수를 따로 부른다.
+    """
+    selection = report_data.get("implementationOptionSelection")
+    if not isinstance(selection, Mapping):
+        return []
+    rows = {
+        row.get("id"): row
+        for row in (report_data.get("clarificationItems") or ())
+        if isinstance(row, Mapping)
+    }
+    errors: list[str] = []
+    for candidate in (
+        row for key in ("rankedOptions", "candidateAudit")
+        for row in (selection.get(key) or ()) if isinstance(row, Mapping)
+    ):
+        ref = split_acceptance_ref(candidate)
+        if not ref and "splitAcceptance" not in candidate:
+            continue
+        row = rows.get(ref)
+        if (
+            row is None
+            or str(row.get("blocks") or "").strip().lower() != "approval"
+            or str(row.get("status") or "").strip().lower() == "obsolete"
+            or clarification_disposition(row) != SPLIT_ACCEPTANCE_DISPOSITION
+        ):
+            errors.append(
+                f"{candidate.get('id')} splitAcceptance {ref!r} must name a "
+                "`blocks: approval` clarification the user answered with "
+                f"`{SPLIT_ACCEPTANCE_DISPOSITION}`; open it with `okstra "
+                "approval-decision open --ledger <approvalDecisionsPath>`, record "
+                "the answer with `okstra approval-decision resolve`, then reassemble"
+            )
+    return errors
+
+
 def _validate_candidate_audit(
     data: Mapping[str, object],
     options: Sequence[Mapping[str, object]],
@@ -630,18 +728,29 @@ def _validate_mode(
         if options and data.get("routing") != CANDIDATE_COMPARISON_ROUTING:
             errors.append("candidate-comparison with options must await direction selection")
         return
-    if len(options) != 1:
-        errors.append("preselected-validation must contain exactly one validated option")
-    if audit:
-        errors.append("preselected-validation candidateAudit must be empty")
+    # A direction that failed validation cannot be displayed (displayed options must be
+    # valid), so it is the one audit row; `_validate_option_count_and_routing` then
+    # requires `blocked` or `technical-verification`.
+    validated = bool(options)
+    if validated:
+        if len(options) != 1:
+            errors.append("preselected-validation must contain exactly one validated option")
+        if audit:
+            errors.append("preselected-validation candidateAudit must be empty")
+    elif len(audit) != 1:
+        errors.append(
+            "preselected-validation must contain exactly one validated option, "
+            "or the one unvalidated direction as its only candidateAudit row"
+        )
     if not isinstance(direction, Mapping):
         errors.append("preselected-validation requires preselectedDirection")
         return
-    if options and direction.get("optionId") != options[0].get("id"):
-        errors.append("preselectedDirection optionId must name the validated option")
+    target = options[0] if validated else (audit[0] if len(audit) == 1 else None)
+    if target is not None and direction.get("optionId") != target.get("id"):
+        errors.append("preselectedDirection optionId must name the preselected direction")
     if not _CITATION_RE.search(str(direction.get("citation") or "")):
         errors.append("preselectedDirection citation must be citable")
-    if data.get("routing") != "implementation-planning":
+    if validated and data.get("routing") != "implementation-planning":
         errors.append("validated preselected direction must route to implementation-planning")
 
 

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -19,6 +19,7 @@ Plan for the actual worktree layout before approval. Shared documentation direct
   - **Selected-direction planning procedure** — perform these steps in order and no others:
     1. Read `selected-direction.json` and the original requirements ledger end-to-end. The ledger is not a separate file: it is the brief's `Expected Behavior` / `Preserved Behavior` / `Expected Outcome` sections (`EB-` / `PB-` / `EO-` ids), carried verbatim in the analysis packet's `## Task-Specific Brief Extract`.
     1a. Fill `selectedDirectionRef` from that snapshot: copy `sourceReport`, `sourceDataSha256`, and `optionId` verbatim from the file; write `snapshotPath` as the snapshot's path relative to the **task root** (`instruction-set/selected-direction.json`, never project-relative and never absolute) and `snapshotSha256` as the SHA-256 of its exact bytes. Those last two are the only ref fields the snapshot does not carry.
+    1b. When the snapshot carries `deferredFeasibilityFacts`, the direction was validated with those facts still open. A `deferred-gate` fact names the `gate` that closes it; carry it into the plan as that gate (an `External Gates` dependency or final-verification user-owned external QA), not as a stage validation row, because a stage row the implementation run cannot execute blocks the stage. When the snapshot also carries `splitAcceptance`, the user accepted the direction over a split feasibility vote; the remaining facts are that accepted risk, so record each in `dependencyMigrationRisk` or the validation that would expose it, and do not reopen the direction choice.
     2. Concretize the selected direction into files, interfaces, stages, validation, and rollback without changing its mechanism or boundaries.
     3. Link every planned file and stage bidirectionally to the original requirements.
     4. If current evidence requires changing the selected direction, emit `direction-invalidated` and stop planning.
@@ -147,7 +148,7 @@ Plan for the actual worktree layout before approval. Shared documentation direct
       **Pick the cases by distinct outcome, not by line coverage.** When the stage writes or reconciles state, its meaningfully different outcomes are usually more than three — normal success, target already in the desired state (resume), existing data reused rather than created, a conflicting concurrent state, target absent, and mid-way failure with rollback. Enumerate the ones this stage actually implements and route them across the three lines (the `boundary` line is where resume / already-done / reuse belongs; `failure` carries conflict, absence, and rollback), naming each in the cell rather than collapsing them into "edge input". An implemented outcome with no declared case is a coverage gap the executor will not backfill.
   - **Per-stage subsections** (`## 5.5.<i> Stage <i>: <title>` for each `i`), each containing the four required subsections:
     - `### Carry-In` — for `depends-on (none)`: task-brief only. Otherwise: each depended-on stage's static exit contract + runtime sidecar path `runs/<impl-key>/carry/stage-<i>.json` placeholder.
-    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** **File size:** the implementation run aims for 300 physical lines per source and test file and enforces 400 — a new file over 400, an existing file taken past 400, and a file already over 400 that grows are blocking findings the executor must split in a correction round; the same conditions at 300 are advisory. When a step would add code or tests to a file near or over 300 lines (`wc -l`), plan a new module or test file for that responsibility in `plannedPaths` instead of appending to the existing one. **Enforced at implementation, not here:** `okstra correction file-size` (`scripts/okstra_ctl/file_size_cap.py`), re-run by `okstra stage-done`. `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
+    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** **File size:** the implementation run aims for 300 physical lines per source and test file and enforces 400 — a new file over 400, an existing file taken past 400, and a file already over 400 that grows are blocking findings the executor must split in a correction round; the same conditions at 300 are advisory. When a step would add code or tests to a file near or over 300 lines (`wc -l`), plan a new module or test file for that responsibility in `plannedPaths` instead of appending to the existing one. **Enforced at implementation, not here:** `okstra correction file-size` (`scripts/okstra_ctl/file_size_cap.py`), re-run by `okstra stage-done`. `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. The design-surface detector maps every selected-option `fileStructure` path to the stage whose `files` or `plannedPaths` names it; a path neither names fails the draft check that correction preflight and `plan-items prepare` share (`scripts/okstra_ctl/report_assembly.py` `validate_plan_draft`). When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
     - **Real-IO tests stay out of the plan's committed steps (BLOCKING).** A step never creates, edits, or runs a test that opens a real database connection, makes a real network call, or talks to a real external service inside the project source test tree (`src/**`, `test/**`, `tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, `*.e2e-spec.*`), and no step's `PASS` depends on a reachable database or service. The implementation executor refuses such a step before its first edit (`_implementation-executor.md` "Real-IO test isolation"), so a plan that contains one stops the stage with zero changes (observed 2026-10-18, dev-11374: a live-MySQL `test/font-pairing.e2e-spec.ts` planned in steps 1, 4 and 5). The committed RED/GREEN steps test the adapter with its injected collaborator stubbed — the exact query text, its replacements, and the returned rows — and run without any backend. Real-backend verification is declared only as this stage's `Conformance tests:` line below (`requires=[db|http|external]`): the implementation run writes that script under `<task_root>/qa/scripts/`, runs it against a local or replica backend when one is reachable, never commits it, and records a non-PASS or unreachable backend as advisory. Read a brief line such as `verify: integration test against a test database` as that conformance declaration, not as a committed test. Do not plan a shared real-DB guard, a test DDL fixture, or an edit to an existing real-IO suite in source to support it. **Enforced:** every `P-Step-*` item of the §5.5.9 plan-body round carries this rule to its verifiers (`okstra_ctl.phases.implementation_planning.authoring._REAL_IO_STEP_NOTE`), which vote `DISAGREE(b)` on a step that breaks it; no path pattern tells a mocked test from a live one, so no validator checks it.
     - **The `command` cell runs inside an okstra task worktree, not a bare checkout (BLOCKING).** okstra provisions `.okstra`, the configured sync entries (`.project-docs`, `.claude`, …), and — for `implementation` — a nested `stage-<N>/` worktree into the tree the step executes in. Two consequences bind every command you write:
       - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step. Stage completion records the commit in the consumer ledger without creating or moving git tags.

package/runtime/python/okstra_ctl/phases/technical_verification/profile.md

@@ -8,8 +8,8 @@
 1. Read the frozen technical input linked in the analysis packet. Preserve the source hash, candidate IDs and fact identities. `resolve_technical_verification_input` enforces same-task source ownership, schema validity, eligible technical facts and unresolved user-decision gates.
 2. Before executing a probe, write its plan under `experiments/<seq>/<worker-id>/`: hypothesis, procedure, commands, confirming and rejecting signals, environment, and inconclusive criteria. Retain the plan with the evidence.
 3. Create a separate source copy in that directory. Record the source commit and any uncommitted input differences. Read the project and task worktree as inputs; perform source edits, installations and builds only in your own copy. Do not share writable dependency directories or use real credentials. Use synthetic local accounts for request-boundary experiments.
-4. Phase 7 removes every `node_modules` and `.next` directory under the run directory, so evidence must not live inside them. Preserve the baseline lockfile. When the hypothesis needs a deliberate dependency change, retain the resulting lockfile and diff, then use a frozen install against that experimental lockfile. Record command, working directory, stdout/stderr and exit code in run-local logs. Distinguish infrastructure failure from a falsified compatibility claim.
-5. Classify each fact as `supported`, `refuted`, `inconclusive` or `not-run` using the declared signals. A zero exit code alone does not establish compatibility. Record limitations and all failed or unavailable probes.
+4. Phase 7 removes every `node_modules` and `.next` directory under the run directory, so evidence must not live inside them. Preserve the baseline lockfile. When the hypothesis needs a deliberate dependency change, retain the resulting lockfile and diff, then use a frozen install against that experimental lockfile. Record command, working directory, stdout/stderr and exit code in run-local logs. End every log with an `exit_code=<n>` line so a command that prints nothing on success, such as `tsc --noEmit`, still leaves a non-empty log; the report validator rejects an empty log. Record as `cwd` the project-relative directory the command ran in: when the command starts with `cd <dir> &&`, that is `<dir>`, not the shell's starting directory. Run every cited command inside `experiments/<seq>/`; a probe run from the project root is not admissible command evidence. Distinguish infrastructure failure from a falsified compatibility claim.
+5. Classify each fact as `supported`, `refuted`, `inconclusive` or `not-run` using the declared signals. A zero exit code alone does not establish compatibility. A `supported` check cites only commands that exited 0. When a command fails for a reason outside the hypothesis, such as a baseline failure that repeats identically on both sides of the comparison, do not cite it under a supported check: cite a command whose exit code expresses the confirming signal, such as `cmp` of the two logs, and name the failing logs in `limitations`. If no such command separates the outcomes, classify the fact `inconclusive`. Record limitations and all failed or unavailable probes.
 6. During convergence, inspect plans and logs; rerun disputed probes in a separate copy when feasible. An independent report is not a substitute for command evidence.
 
 Copy boundaries and pre-execution plans are worker instructions reviewed during convergence. The report validator checks fact completeness, run-local log files, experiment working directories and zero exit codes for supported results. It does not sandbox arbitrary shell commands or prove that a declared command produced its log.

package/runtime/python/okstra_ctl/report_assembly.py

@@ -27,12 +27,16 @@ from .report_synthesis_packet import (
 )
 from .conformance import strip_stage_declaration_label
 from .coverage_census import census_warning_rows, read_census_state
+from .design_surfaces import DesignSurfaceError, detect_design_surfaces
 from .design_prep import (
     DesignPrepError,
     canonicalize_request_paths,
     materialize_design_prep_requests,
 )
-from .phases.implementation_option_selection.validation import validate_blocked_answer_channel
+from .phases.implementation_option_selection.validation import (
+    validate_blocked_answer_channel,
+    validate_split_acceptance,
+)
 from .phases.discussion.report import discussion_report_block, discussion_report_errors
 from .phases.discussion.store import DiscussionStore, DiscussionStoreError
 from .phases.technical_verification.validation import validate_technical_verification_report
@@ -522,7 +526,7 @@ def _compose(
         data["crossVerification"]["correctionRounds"] = rounds
     data["clarificationItems"] = _clarifications(ledger, activities, inputs["approval-decisions"].path)
     # 작성자의 사실 분류와 리드 원장의 질문 연결은 양쪽 입력을 합친 뒤 검사한다.
-    for reason in validate_blocked_answer_channel(data):
+    for reason in [*validate_blocked_answer_channel(data), *validate_split_acceptance(data)]:
         _fail(
             "lead",
             inputs["approval-decisions"].path,
@@ -688,9 +692,26 @@ def validate_plan_draft(
             f"implementationPlanning: {error}"
             for error in selected_direction_plan_errors(draft, project_root, manifest)
         ],
+        *_design_surface_errors(draft),
     ]
 
 
+def _design_surface_errors(draft: Mapping[str, Any]) -> list[str]:
+    """`plan-items prepare` 가 돌릴 설계 표면 탐지기를 초안 단계에서 미리 돌린다.
+
+    탐지 실패는 서사를 고쳐야 풀리는데, 교정 원장 대조가 이를 몰라 ok 를 낸 뒤
+    prepare 에서야 드러났다.
+    """
+    planning = draft.get("implementationPlanning")
+    if not isinstance(planning, Mapping) or not planning.get("stages"):
+        return []
+    try:
+        detect_design_surfaces(planning)
+    except (DesignSurfaceError, TypeError, AttributeError) as exc:
+        return [f"implementationPlanning: design-surface detection failed: {exc}"]
+    return []
+
+
 def _identity(manifest: Mapping[str, Any]) -> tuple[str, str, str]:
     task_key = str(manifest.get("taskKey") or "")
     parts = task_key.split(":")

package/runtime/python/okstra_ctl/report_views.py

@@ -87,6 +87,7 @@ from .clarification_items import (
     section_1_present_but_unparsed,
 )
 from .md_table import is_separator_row as _is_separator_row
+from .phases.implementation_option_selection.validation import blocking_feasibility_facts
 
 
 # --------------------------------------------------------------------------- #
@@ -1175,7 +1176,7 @@ def direction_candidate_ineligibility(option: Mapping[str, Any]) -> str:
     coverage = option.get("coverageSummary")
     if not isinstance(coverage, Mapping) or coverage.get("coverageVerdict") != "exact":
         return "selected candidate must have exact coverage"
-    if option.get("safetyBlockers") or option.get("unresolvedFeasibilityFacts"):
+    if option.get("safetyBlockers") or blocking_feasibility_facts(option):
         return "selected candidate has a safety blocker"
     return ""