@ai-dev-methodologies/rlp-desk 0.17.0 → 0.18.1

package/src/scripts/run_ralph_desk.zsh

@@ -164,6 +164,34 @@ _check_consecutive_blocks() {
   return 0
 }
 
+# F-22: bump the consecutive-failure counter for a soft-fail (request_info,
+# unknown verdict/status). Returns 0 if the circuit breaker is now tripped
+# (caller writes a sentinel + returns 1), 1 if still under threshold (continue).
+# Closes the "silently loop to MAX_ITER without ever firing the CB" gap for
+# verdict/status values the case-statement did not previously account for.
+_bump_consecutive_failure() {
+  (( CONSECUTIVE_FAILURES++ ))
+  (( CONSECUTIVE_FAILURES >= EFFECTIVE_CB_THRESHOLD )) && return 0
+  return 1
+}
+
+# F-22: decide a worker/verifier BLOCK with grace. This is the call site that
+# was MISSING — _check_consecutive_blocks was dead code (defined, never invoked),
+# so the consecutive-blocks circuit breaker (governance §8) never ran and a
+# SINGLE transient "blocked" (a fresh-context LLM mis-emitting the status, a
+# formatting slip) terminated the whole campaign. Returns 0 = TERMINATE (caller
+# writes the sentinel + returns 1); 1 = ABSORB as a soft-fail (loop continues,
+# Worker retries). Forced terminal when: the category is a genuine infra_failure,
+# the same canonical reason repeats >= BLOCK_CB_THRESHOLD, or the consecutive-
+# failures CB trips. Otherwise a recoverable first/transient block is absorbed.
+_block_with_grace() {
+  local reason="$1" category="${2:-metric_failure}"
+  _check_consecutive_blocks "$reason" "$category" "${ITERATION:-0}" || return 0
+  [[ "$category" == "infra_failure" ]] && return 0
+  _bump_consecutive_failure && return 0
+  return 1
+}
+
 # --- Engine Selection (auto-detect from model format) ---
 # claude models (haiku/sonnet/opus) with :effort → claude engine + effort
 # codex models (gpt-*/spark) with :reasoning → codex engine + reasoning
@@ -205,11 +233,17 @@ FINAL_VERIFIER_EFFORT="${FINAL_VERIFIER_EFFORT:-}"
 # Auto-detect engine from model format for env var path (CLI path uses parse_model_flag)
 _auto_detect_engine WORKER_MODEL WORKER_ENGINE WORKER_CODEX_MODEL WORKER_CODEX_REASONING WORKER_EFFORT
 _auto_detect_engine VERIFIER_MODEL VERIFIER_ENGINE VERIFIER_CODEX_MODEL VERIFIER_CODEX_REASONING VERIFIER_EFFORT
-_auto_detect_engine FINAL_VERIFIER_MODEL FINAL_VERIFIER_ENGINE "" "" FINAL_VERIFIER_EFFORT
+_auto_detect_engine FINAL_VERIFIER_MODEL FINAL_VERIFIER_ENGINE FINAL_VERIFIER_CODEX_MODEL FINAL_VERIFIER_CODEX_REASONING FINAL_VERIFIER_EFFORT
 WORKER_CODEX_MODEL="${WORKER_CODEX_MODEL:-gpt-5.5}"
 WORKER_CODEX_REASONING="${WORKER_CODEX_REASONING:-high}"   # low|medium|high
 VERIFIER_CODEX_MODEL="${VERIFIER_CODEX_MODEL:-gpt-5.5}"
 VERIFIER_CODEX_REASONING="${VERIFIER_CODEX_REASONING:-high}"   # low|medium|high
+# D-1: FINAL verifier codex sub-vars (auto-detected above from FINAL_VERIFIER_MODEL,
+# default here when not codex). Wired so the FINAL (ALL) verify can run a stronger
+# model than the per-US verifier — the "final 엄격" knob (FINAL_VERIFIER_MODEL
+# defaults to opus). Distinct from the removed per-iteration verifier auto-upgrade.
+FINAL_VERIFIER_CODEX_MODEL="${FINAL_VERIFIER_CODEX_MODEL:-gpt-5.5}"
+FINAL_VERIFIER_CODEX_REASONING="${FINAL_VERIFIER_CODEX_REASONING:-high}"   # low|medium|high
 CODEX_BIN=""  # resolved by check_dependencies when engine=codex
 
 # --- Verify Mode ---
@@ -274,6 +308,10 @@ MEMORY_FILE="$MEMOS_DIR/${SLUG}-memory.md"
 SIGNAL_FILE="$MEMOS_DIR/${SLUG}-iter-signal.json"
 DONE_CLAIM_FILE="$MEMOS_DIR/${SLUG}-done-claim.json"
 VERDICT_FILE="$MEMOS_DIR/${SLUG}-verify-verdict.json"
+# F-14: durable, structured append-only ledger of verified-pass US — the
+# drift-proof source-of-truth for VERIFIED_US restore (vs the Worker's prose
+# "## Completed Stories", which is fresh-context LLM output that can drift).
+VERIFIED_LEDGER="$MEMOS_DIR/${SLUG}-verified.jsonl"
 # v0.14.2 Bug Report #4: codex sometimes writes the verdict file to the
 # pre-v0.13.0 legacy path despite the prompt instructing otherwise (CWD
 # heuristics inside the codex CLI). Track the legacy path so the no-progress
@@ -312,6 +350,9 @@ BASELINE_COMMIT=""       # git HEAD at campaign start (captured before loop)
 CAMPAIGN_REPORT_GENERATED=0  # guard against double-generation in cleanup trap
 SV_REPORT_GENERATED=0       # guard against double-generation in generate_sv_report
 VERIFIED_US=""           # comma-separated list of verified US IDs (per-us mode)
+_FINALIZE_PENDING=0      # D-16: armed when the last per-US pass completes coverage;
+                         # the next loop top synthesizes an ALL verify signal and
+                         # skips the (fragile) worker round-trip to emit it.
 CONSENSUS_ROUND=0        # current consensus round for current US
 US_LIST=""               # comma-separated US IDs from PRD (per-us mode)
 LOCKFILE_ACQUIRED=0
@@ -389,6 +430,33 @@ launch_worker_codex() {
     sleep 1
     local _pane_text
     _pane_text=$(tmux capture-pane -t "$pane_id" -p 2>/dev/null || true)
+    # F-1: on launch codex may show "✨ Update available!" — an arrow-menu whose
+    # DEFAULT highlighted option is "1. Update now" (runs `npm install -g
+    # @openai/codex`) with "Press enter to continue". Our subsequent Enter would
+    # confirm option 1 and the update REPLACES the Worker session (hijack). This
+    # check MUST precede the '›' ready check below because the update menu also
+    # renders '›'. Move the selection to "2. Skip" (Down) then confirm (Enter).
+    # (Guarded: only fires when the update banner is present, so it is harmless
+    # in any normal pane state. Key sequence pending live-codex confirmation.)
+    if echo "$_pane_text" | grep -qiE 'Update available|1\. Update now' 2>/dev/null; then
+      log "  Worker codex: update prompt detected — selecting '2. Skip' (F-1)."
+      log_debug "[GOV] iter=$iter codex_update_prompt=skipped role=worker"
+      tmux send-keys -t "$pane_id" Down 2>/dev/null; sleep 0.3
+      tmux send-keys -t "$pane_id" C-m 2>/dev/null; sleep 1
+      (( _codex_wait++ )); continue
+    fi
+    # F-16: codex 0.141 shows a "Do you trust the contents of this directory?
+    # 1. Yes, continue / 2. No, quit" prompt at startup (project-local config/
+    # hooks loading). Its '›' is otherwise mis-read as "ready" below, and the
+    # worker instruction sent into that menu can land on "No, quit" → codex exits
+    # → "worker not active" BLOCK. Accept it (Enter = default "1. Yes, continue")
+    # before the ready check. Validated end-to-end: codex then runs the task.
+    if echo "$_pane_text" | grep -qiE 'Do you trust|1\. Yes, continue' 2>/dev/null; then
+      log "  Worker codex: directory-trust prompt — accepting (F-16)."
+      log_debug "[GOV] iter=$iter codex_trust_prompt=accepted role=worker"
+      tmux send-keys -t "$pane_id" C-m 2>/dev/null; sleep 1
+      (( _codex_wait++ )); continue
+    fi
     if echo "$_pane_text" | grep -q '›' 2>/dev/null; then
       _codex_ready=1
       log_debug "Worker codex TUI ready after ${_codex_wait}s"
@@ -543,6 +611,25 @@ launch_verifier_codex() {
     sleep 1
     local _pane_text
     _pane_text=$(tmux capture-pane -t "$pane_id" -p 2>/dev/null || true)
+    # F-1: dismiss codex's "✨ Update available!" launch menu before it hijacks the
+    # pane (default option is "1. Update now"). See launch_worker_codex for detail.
+    if echo "$_pane_text" | grep -qiE 'Update available|1\. Update now' 2>/dev/null; then
+      log "  Verifier codex: update prompt detected — selecting '2. Skip' (F-1)."
+      log_debug "[GOV] iter=$iter codex_update_prompt=skipped role=verifier"
+      tmux send-keys -t "$pane_id" Down 2>/dev/null; sleep 0.3
+      tmux send-keys -t "$pane_id" C-m 2>/dev/null; sleep 1
+      (( _codex_wait++ )); continue
+    fi
+    # F-16: accept codex 0.141's "Do you trust this directory?" startup prompt
+    # (Enter = default "1. Yes, continue") before the ready check — see
+    # launch_worker_codex for detail. Otherwise the instruction lands in the menu
+    # and can select "No, quit" → codex exits → "verifier not active".
+    if echo "$_pane_text" | grep -qiE 'Do you trust|1\. Yes, continue' 2>/dev/null; then
+      log "  Verifier codex: directory-trust prompt — accepting (F-16)."
+      log_debug "[GOV] iter=$iter codex_trust_prompt=accepted role=verifier"
+      tmux send-keys -t "$pane_id" C-m 2>/dev/null; sleep 1
+      (( _codex_wait++ )); continue
+    fi
     if echo "$_pane_text" | grep -q '›' 2>/dev/null; then
       _codex_ready=1
       log_debug "Verifier codex TUI ready after ${_codex_wait}s"
@@ -639,6 +726,16 @@ launch_verifier_claude() {
 # On exit: check done-claim, auto-generate iter-signal.
 # Args: $1=iteration  $2=signal_file
 # Returns: 0 (signal generated), 1 (error)
+# F-14: append a verified-pass US to the durable ledger (the leader's structured,
+# drift-proof record of progress). Skips ALL/empty; append-only, readers dedup.
+_append_verified_ledger() {
+  local us="$1"
+  [[ -z "$us" || "$us" == "ALL" ]] && return 0
+  mkdir -p "${VERIFIED_LEDGER:h}" 2>/dev/null
+  printf '{"us_id":"%s","iter":%s,"verified_at":"%s"}\n' \
+    "$us" "${ITERATION:-0}" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$VERIFIED_LEDGER"
+}
+
 # Bug #8 PR-B (codex critic P1.2 fix): shared 4-way gate used by both
 # handle_worker_exit_codex and the inline-polling A4 path. Returns:
 #   0 = synthesize allowed (caller writes signal_file + emits audit)
@@ -662,6 +759,37 @@ _bug8_check_synth_allowed() {
     return 1
   fi
 
+  # Gate 1b (D-2): done-claim FRESHNESS. A done-claim that lingered from a PRIOR
+  # run/iteration (e.g. a relaunch where the inter-iteration cleanup did not run)
+  # must NOT be synthesized into a verify signal for THIS iteration — it would
+  # credit a stale/wrong US into the durable ledger. The Worker writes its
+  # done-claim DURING this iteration, so a fresh claim is strictly NEWER than this
+  # iteration's worker-prompt; an older claim is stale. mtime-based on purpose:
+  # done-claim carries no reliable .iteration field (workers omit it), so an
+  # iteration match would false-reject every claim and break the A4 synth path.
+  local _dc_wp_file="$LOGS_DIR/iter-$(printf '%03d' "$iter").worker-prompt.md"
+  if [[ -f "$_dc_wp_file" ]]; then
+    # mtime, cross-platform: GNU `stat -c %Y` FIRST (on Linux `stat -f %m` means
+    # --file-system + %m=mount-point, returns a non-numeric path with exit 0 so a
+    # `-f`-first order would silently mis-read); macOS BSD `stat -c` errors → falls
+    # through to `stat -f %m` (the BSD mtime). Correct on both; `echo 0` = unknown.
+    local _dc_mt _wp_mt
+    _dc_mt=$(stat -c %Y "$DONE_CLAIM_FILE" 2>/dev/null || stat -f %m "$DONE_CLAIM_FILE" 2>/dev/null || echo 0)
+    _wp_mt=$(stat -c %Y "$_dc_wp_file" 2>/dev/null || stat -f %m "$_dc_wp_file" 2>/dev/null || echo 0)
+    [[ "$_dc_mt" == <-> ]] || _dc_mt=0   # guard: ignore any non-numeric stat output
+    [[ "$_wp_mt" == <-> ]] || _wp_mt=0
+    if (( _dc_mt > 0 && _wp_mt > 0 && _dc_mt < _wp_mt )); then
+      log_error "  Bug #8: done-claim is STALE (mtime $_dc_mt < this iteration's worker-prompt $_wp_mt) — refusing to synthesize from a prior-run claim."
+      log_debug "[GOV] iter=$iter bug8=block_stale_done_claim dc_mt=$_dc_mt wp_mt=$_wp_mt"
+      write_blocked_sentinel \
+        "done-claim is stale (older than this iteration's worker dispatch) — refusing to synthesize a verify signal from a prior-run claim" \
+        "$us_id" \
+        "infra_failure"
+      _emit_a4_fallback_audit "$us_id" "$iter" "blocked_stale_done_claim"
+      return 1
+    fi
+  fi
+
   # Gate 2: git toplevel must equal $ROOT (canonicalized — macOS resolves
   # /var → /private/var, NTFS may have 8.3 short paths; compare realpaths).
   local _bug8_top _bug8_top_canon _bug8_root_canon
@@ -679,20 +807,59 @@ _bug8_check_synth_allowed() {
     return 1
   fi
 
-  # Gate 3: tree must be clean.
+  # Gate 3: no UNCOMMITTED changes to TRACKED files (F-6 fix). We compare against
+  # HEAD with `git diff --name-only HEAD`, which lists ONLY tracked files modified
+  # vs HEAD — untracked cruft (logs, .DS_Store, local config, build/coverage
+  # output) the Worker never touched is never listed. Blocking on such cruft
+  # false-BLOCKed the campaign at iter 1 on ANY non-pristine repo — the single
+  # largest "never completes" cause found in large-campaign dogfood. The Verifier
+  # (test-spec) is the real correctness gate for the Worker's committed work; this
+  # gate only guards against a Worker that left TRACKED edits uncommitted.
   local _bug8_dirty
-  _bug8_dirty=$(git -C "$ROOT" status --porcelain 2>/dev/null)
+  _bug8_dirty=$(git -C "$ROOT" diff --name-only HEAD 2>/dev/null)
   if [[ -n "$_bug8_dirty" ]]; then
-    local _bug8_first5
-    _bug8_first5=$(printf '%s\n' "$_bug8_dirty" | head -n 5 | tr '\n' '|' | sed 's/|$//')
-    log_error "  Bug #8: done-claim present but tree dirty. Refusing synthesis. dirty: $_bug8_first5"
-    log_debug "[GOV] iter=$iter bug8=block_dirty_tree us_id=$us_id dirty='$_bug8_first5'"
-    write_blocked_sentinel \
-      "worker_incomplete_uncommitted: done-claim present but tree dirty ($_bug8_first5)" \
-      "$us_id" \
-      "metric_failure"
-    _emit_a4_fallback_audit "$us_id" "$iter" "blocked_dirty_tree"
-    return 1
+    # F-8 recovery (F-19 scoped): by Gate 1 a done-claim exists, so uncommitted
+    # TRACKED changes are most likely the Worker's own US work it failed to commit
+    # — a frequent weak-model slip (the default haiku Worker reports "Committed ..."
+    # in its done-claim while the git commit never landed). Historically this
+    # TERMINATED the campaign, stranding completed work — the #1 weak-model "never
+    # completes" cause. Instead auto-commit the Worker's edits and proceed — but
+    # scope the commit to the Worker's OWN files: exclude any tracked file ALREADY
+    # dirty before the campaign (CAMPAIGN_PREEXISTING_DIRTY) so an operator's
+    # pre-existing uncommitted work is NEVER swept into a Worker-recovery commit.
+    # The Verifier (test-spec) is the real correctness gate, so a genuine mid-write
+    # bail still FAILs verify → fix loop; Bug #8's "no false PASS" intent is
+    # preserved by the Verifier, not by abort.
+    local _bug8_worker_files
+    _bug8_worker_files=$(comm -23 \
+      <(printf '%s\n' "$_bug8_dirty" | sort -u) \
+      <(printf '%s\n' "${CAMPAIGN_PREEXISTING_DIRTY:-}" | sort -u) \
+      | grep -v '^[[:space:]]*$')
+    if [[ -z "$_bug8_worker_files" ]]; then
+      # Every dirty tracked file was already dirty BEFORE the campaign — the Worker
+      # committed its own work (or made no tracked change). Nothing to recover; do
+      # NOT commit the operator's pre-existing edits. Allow synthesis to proceed.
+      log "  Bug #8 F-8: only operator's pre-existing edits are dirty — Worker work already committed; proceeding without auto-commit."
+      log_debug "[GOV] iter=$iter bug8=preexisting_only_no_commit us_id=$us_id"
+    else
+      local _bug8_first5
+      _bug8_first5=$(printf '%s\n' "$_bug8_worker_files" | head -n 5 | tr '\n' '|' | sed 's/|$//')
+      log "  Bug #8 F-8 recovery: done-claim + Worker's uncommitted tracked changes — auto-committing $us_id work (files: $_bug8_first5)."
+      log_debug "[GOV] iter=$iter bug8=recover_autocommit us_id=$us_id files='$_bug8_first5'"
+      local -a _bug8_add=("${(@f)_bug8_worker_files}")
+      if git -C "$ROOT" add -- "${_bug8_add[@]}" && git -C "$ROOT" commit -q -m "chore(leader-recovery): commit Worker's uncommitted $us_id changes (Bug #8 F-8)"; then
+        log "  Leader-recovery auto-commit OK (Worker files only) — Verifier will gate correctness."
+      else
+        log_error "  Bug #8: leader-recovery auto-commit failed. Refusing synthesis. files: $_bug8_first5"
+        log_debug "[GOV] iter=$iter bug8=block_autocommit_failed us_id=$us_id files='$_bug8_first5'"
+        write_blocked_sentinel \
+          "worker_incomplete_uncommitted: leader-recovery auto-commit failed ($_bug8_first5)" \
+          "$us_id" \
+          "metric_failure"
+        _emit_a4_fallback_audit "$us_id" "$iter" "blocked_autocommit_failed"
+        return 1
+      fi
+    fi
   fi
 
   # All gates passed — synthesize allowed.
@@ -1016,10 +1183,15 @@ check_copy_mode() {
 paste_to_pane() {
   local pane_id="$1"
   local text="$2"
+  # D-8/D-13: per-leader+pane tmux buffer name (was a server-GLOBAL "rlp-paste").
+  # Two leaders sharing one tmux server (different ROOTs) would ABA the single
+  # global buffer — load-A / load-B / paste-A pastes B's text into A's pane. A
+  # name keyed by leader pid + pane closes that.
+  local _buf="rlp-paste-$$-${pane_id//[^0-9A-Za-z]/}"
   local tmpbuf="/tmp/.rlp-desk-paste-$$.tmp"
   echo -n "$text" > "$tmpbuf"
-  tmux load-buffer -b rlp-paste "$tmpbuf" 2>/dev/null
-  tmux paste-buffer -b rlp-paste -d -t "$pane_id" 2>/dev/null
+  tmux load-buffer -b "$_buf" "$tmpbuf" 2>/dev/null
+  tmux paste-buffer -b "$_buf" -d -t "$pane_id" 2>/dev/null   # -d deletes the buffer after paste
   rm -f "$tmpbuf"
 }
 
@@ -1757,7 +1929,7 @@ restart_worker() {
 
   # Re-launch worker (tmux interactive pattern)
   if [[ "$WORKER_ENGINE" = "codex" ]]; then
-    safe_send_keys "$pane_id" "${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" --disable plugins --dangerously-bypass-approvals-and-sandbox"
+    safe_send_keys "$pane_id" "${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" -c mcp_servers='{}' --disable plugins --dangerously-bypass-approvals-and-sandbox"
   else
     safe_send_keys "$pane_id" "$(build_claude_cmd tui "$WORKER_MODEL" "" "" "$WORKER_EFFORT")"
   fi
@@ -1815,6 +1987,12 @@ write_worker_trigger() {
       fi
     done
   fi
+  # D-11: publish the in-flight US GLOBALLY so the lifecycle-path sentinels
+  # (no-progress, prompt-stall, R12 watchdog) tag their BLOCKED sidecar with the
+  # real us_id (they default to ${CURRENT_US:-ALL}, which was always ALL because
+  # CURRENT_US was never assigned). The verify phase overwrites it with the US
+  # actually under verification.
+  [[ -n "$next_us" ]] && CURRENT_US="$next_us" || CURRENT_US="ALL"
 
   {
     # Per-US PRD injection: substitute full PRD path with per-US split path when available
@@ -2057,6 +2235,12 @@ TRIGGER_EOF
 # =============================================================================
 
 cleanup() {
+  # D-8: re-entrancy guard. The trap is armed on EXIT INT TERM, so a TERM (cleanup
+  # runs) immediately followed by process exit (EXIT fires cleanup AGAIN) would
+  # double-run the non-idempotent steps — a double runner-lock release can rm a
+  # relaunched leader's lock dir (ABA). Run the body at most once.
+  (( ${CLEANUP_DONE:-0} )) && return 0
+  CLEANUP_DONE=1
   log "Cleaning up..."
 
   # Remove lockfile
@@ -2066,12 +2250,15 @@ cleanup() {
     log_debug "cleanup: lockfile not owned by this process, skipping removal"
   fi
 
-  # US-026 R14 P0: remove project-scoped runner lockfile if owned by this slug
+  # US-026 R14 P0 / D-9: remove the project-scoped runner lock if WE own it. The
+  # lock file now holds our bare PID (acquire_slug_lock), so ownership is an exact
+  # pid match — remove the lock file, the metadata sidecar, and the recovery mutex.
   if [[ -f "$RUNNER_LOCKFILE_PATH" ]]; then
-    local own_slug
-    own_slug=$(jq -r '.slug' "$RUNNER_LOCKFILE_PATH" 2>/dev/null)
-    if [[ "$own_slug" == "$SLUG" ]]; then
-      rm -rf "$RUNNER_LOCKDIR" "$RUNNER_LOCKFILE_PATH" 2>/dev/null
+    local own_pid
+    own_pid=$(cat "$RUNNER_LOCKFILE_PATH" 2>/dev/null)
+    if [[ "$own_pid" == "$$" ]]; then
+      rm -f "$RUNNER_LOCKFILE_PATH" "${RUNNER_LOCKFILE_PATH}.meta" 2>/dev/null
+      rm -rf "${RUNNER_LOCKFILE_PATH}.recovery.d" 2>/dev/null
     fi
   fi
 
@@ -2423,8 +2610,19 @@ poll_for_signal() {
     # Dead pane detection during poll: check if claude/codex process died
     local poll_cmd
     poll_cmd=$(tmux display-message -p -t "$pane_id" '#{pane_current_command}' 2>/dev/null)
-    # Dead pane detection — delegates to check_dead_pane() for engine-aware logic
-    if check_dead_pane "$poll_cmd" "$WORKER_ENGINE" "$role"; then
+    # Dead pane detection — delegates to check_dead_pane() for engine-aware logic.
+    # D-10: pick the engine for the pane being polled, NOT always WORKER_ENGINE. In
+    # a mixed-engine campaign (e.g. claude worker + codex verifier) the old code
+    # judged the codex verifier's "bash" (codex's trigger shell) as DEAD using the
+    # claude rule → false dead-pane → 3-strike → spurious BLOCK on a live verifier.
+    # Derive from the role string (covers per-US, final, and consensus per-engine).
+    local _dead_engine="$WORKER_ENGINE"
+    if [[ "$role" == *codex* ]]; then _dead_engine="codex"
+    elif [[ "$role" == *claude* ]]; then _dead_engine="claude"
+    elif [[ "$role" == *inal* ]]; then _dead_engine="$FINAL_VERIFIER_ENGINE"
+    elif [[ "$role" == *erifier* ]]; then _dead_engine="$VERIFIER_ENGINE"
+    fi
+    if check_dead_pane "$poll_cmd" "$_dead_engine" "$role"; then
       log "  WARNING: $role pane $pane_id has bare shell ($poll_cmd) — process died during execution"
       log_debug "[GOV] iter=$ITERATION pane_dead_during_poll=true pane=$pane_id cmd=$poll_cmd role=$role"
       # Return failure so caller can handle recovery
@@ -2472,6 +2670,13 @@ run_single_verifier() {
   local model="$3"        # model for this verifier
   local suffix="$4"       # "-claude" or "-codex"
   local verdict_dest="$5" # where to copy the verdict file
+  # D-1c (codex MEDIUM): claude reasoning effort for this verifier. Final
+  # consensus passes FINAL_VERIFIER_EFFORT; per-US passes VERIFIER_EFFORT.
+  # Defaults to VERIFIER_EFFORT so existing 5-arg callers are unchanged.
+  # Single-dash (${6-...}, not ${6:-...}) so an explicitly-passed EMPTY effort
+  # (e.g. final consensus with FINAL_VERIFIER_EFFORT unset) is preserved rather
+  # than collapsing back to VERIFIER_EFFORT.
+  local effort="${6-$VERIFIER_EFFORT}"
 
   # Write trigger for this engine
   write_verifier_trigger "$iter" "$engine" "$model" "$suffix"
@@ -2512,11 +2717,29 @@ run_single_verifier() {
   # Launch verifier — dispatch to engine-specific function
   local verifier_launch
   if [[ "$engine" = "codex" ]]; then
-    verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --disable plugins --dangerously-bypass-approvals-and-sandbox"
+    # D-1c: honor the passed-in model arg (consensus passes CONSENSUS_MODEL /
+    # FINAL_CONSENSUS_MODEL as "model:reasoning") instead of always using the
+    # global VERIFIER_CODEX_*; fall back to the globals when no model is given.
+    local _cx_model="$VERIFIER_CODEX_MODEL" _cx_reason="$VERIFIER_CODEX_REASONING"
+    if [[ -n "$model" && "$model" == *:* ]]; then
+      # D-1c (codex LOW): validate "model:reasoning" before splitting. Reject an
+      # empty model, an empty/unknown reasoning, or >1 colon (e.g. "gpt-5.5:",
+      # ":medium", "foo:bar:baz") and fall back to the globals instead of
+      # emitting a bad -m or empty reasoning_effort.
+      local _m="${model%%:*}" _r="${model##*:}"
+      if [[ -n "$_m" && "$model" != *:*:* && "$_r" == (minimal|low|medium|high|xhigh) ]]; then
+        _cx_model="$_m"; _cx_reason="$_r"
+      else
+        log "  WARNING: malformed consensus codex model '$model' — falling back to $_cx_model:$_cx_reason"
+      fi
+    elif [[ -n "$model" ]]; then
+      _cx_model="$model"
+    fi
+    verifier_launch="${CODEX_BIN:-codex} -m $_cx_model -c model_reasoning_effort=\"$_cx_reason\" -c mcp_servers='{}' --disable plugins --dangerously-bypass-approvals-and-sandbox"
     launch_verifier_codex "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"
-    log_debug "Verifier$suffix codex TUI dispatched"
+    log_debug "Verifier$suffix codex TUI dispatched (model=$_cx_model reasoning=$_cx_reason)"
   else
-    verifier_launch="$(build_claude_cmd tui "$model" "" "" "$VERIFIER_EFFORT")"
+    verifier_launch="$(build_claude_cmd tui "$model" "" "" "$effort")"
     if ! launch_verifier_claude "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"; then
       log_error "Verifier$suffix failed to start"
       return 1
@@ -2566,12 +2789,17 @@ run_single_verifier() {
   else
     # Claude: use full poll_for_signal with heartbeat/nudge
     log "  Polling for verify-verdict.json ($suffix)..."
-    if ! poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "Verifier$suffix"; then
-      local verifier_poll_rc=$?
+    # F-25: capture rc DIRECTLY (not inside `if ! cmd; then … $?`, which yields the
+    # if-statement status, not poll's rc — the same latent bug fixed at the main
+    # verifier poll site). Keeps the rc==2 "sentinel already written" branch live.
+    poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "Verifier$suffix"
+    local verifier_poll_rc=$?
+    if (( verifier_poll_rc != 0 )); then
       if (( verifier_poll_rc == 2 )); then
+        log_debug "[GOV] run_single_verifier poll hard-fail (rc=2, sentinel already written)"
         return 1
       fi
-      log_error "Verifier$suffix poll failed"
+      log_error "Verifier$suffix poll failed (rc=$verifier_poll_rc)"
       return 1
     fi
   fi
@@ -2593,6 +2821,17 @@ run_single_verifier() {
 # --- Sequential final verify: run per-US scoped verifiers instead of one big ALL verify ---
 # Returns 0 if all US pass + integration check pass, 1 if any US fails, 2 if integration fails.
 # Sets FAILED_US global on failure.
+# D-16: true when every US in US_LIST is already present in VERIFIED_US.
+# Used to arm leader-driven finalize after the last per-US pass.
+_all_us_verified() {
+  [[ -n "$US_LIST" ]] || return 1
+  local _us
+  for _us in $(echo "$US_LIST" | tr ',' ' '); do
+    echo ",$VERIFIED_US," | grep -q ",$_us," || return 1
+  done
+  return 0
+}
+
 run_sequential_final_verify() {
   local iter="$1"
   FAILED_US=""
@@ -2621,29 +2860,54 @@ run_sequential_final_verify() {
     fi
     wait_for_pane_ready "$VERIFIER_PANE" 10 2>/dev/null || true
 
-    # Launch verifier
+    # Launch verifier. D-1: the FINAL (ALL) verify uses FINAL_VERIFIER_* (the
+    # "final 엄격" knob — a configured stronger model, e.g. opus, for the final
+    # gate), NOT the lighter per-US VERIFIER_*. This is the configured-final-model
+    # distinction, distinct from the removed per-iteration verifier auto-upgrade.
     local verifier_launch
-    if [[ "$VERIFIER_ENGINE" = "codex" ]]; then
-      verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --disable plugins --dangerously-bypass-approvals-and-sandbox"
+    if [[ "$FINAL_VERIFIER_ENGINE" = "codex" ]]; then
+      verifier_launch="${CODEX_BIN:-codex} -m $FINAL_VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$FINAL_VERIFIER_CODEX_REASONING\" -c mcp_servers='{}' --disable plugins --dangerously-bypass-approvals-and-sandbox"
       launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch"
     else
-      verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL" "" "" "$VERIFIER_EFFORT")"
+      verifier_launch="$(build_claude_cmd tui "$FINAL_VERIFIER_MODEL" "" "" "$FINAL_VERIFIER_EFFORT")"
       launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch" || {
-        log_error "Failed to launch verifier for $us"
+        log_error "Failed to launch final verifier for $us"
         FAILED_US="$us"
         return 1
       }
     fi
 
-    # Poll for verdict
+    # Poll for verdict. D-4: distinguish rc==2 (hard-fail, sentinel already
+    # written → terminal) from rc==1 (transient pane race/timeout) and give ONE
+    # replace-pane + re-dispatch retry before failing the US — the F-10 retry
+    # parity the per-US main verifier site has but this final-verify path lacked
+    # (a single transient poll miss falsely failed a US at the most expensive
+    # end-of-campaign moment, charging a bogus consecutive failure).
     rm -f "$VERDICT_FILE"
     local poll_rc=0
     poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "Verifier-final" || poll_rc=$?
-    if (( poll_rc != 0 )); then
-      log_error "Verifier poll failed for $us (rc=$poll_rc)"
+    if (( poll_rc == 2 )); then
+      log_error "Verifier hard-fail (rc=2, sentinel written) for $us in final verify"
       FAILED_US="$us"
       return 1
     fi
+    if (( poll_rc == 1 )); then
+      log "  Verifier-final transient poll fail for $us — replacing pane + retrying once (D-4)"
+      replace_worker_pane "$VERIFIER_PANE" "verifier"
+      VERIFIER_PANE=$(jq -r '.panes.verifier' "$SESSION_CONFIG")
+      if [[ "$FINAL_VERIFIER_ENGINE" = "codex" ]]; then
+        launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch"
+      else
+        launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch" || { FAILED_US="$us"; return 1; }
+      fi
+      rm -f "$VERDICT_FILE"; poll_rc=0
+      poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "Verifier-final" || poll_rc=$?
+      if (( poll_rc != 0 )); then
+        log_error "Verifier poll failed for $us after replace+retry (rc=$poll_rc)"
+        FAILED_US="$us"
+        return 1
+      fi
+    fi
 
     # Bug #7 Fix-Q/R: reap verifier pane between per-US final verifications so
     # the previous codex/claude TUI cannot continue running while the next per-
@@ -2699,6 +2963,26 @@ _should_use_consensus() {
 # --- US-004: Run consensus verification (claude + codex sequentially) ---
 run_consensus_verification() {
   local iter="$1"
+  # D-15: the US under consensus (for the merged verdict's us_id, so the D-3
+  # cross-check applies to consensus too). Falls back to the caller's local
+  # signal_us_id (zsh dynamic scope) then ALL.
+  local cons_us_id="${2:-${signal_us_id:-ALL}}"
+  # D-15 fix: us_id is interpolated into the merged-verdict JSON via echo, so make it
+  # JSON-safe. It is always "ALL" or "US-<digits>"; anything else → ALL (a value
+  # with a quote/backslash/control char would otherwise produce invalid JSON).
+  [[ "$cons_us_id" == (ALL|US-<->) ]] || cons_us_id="ALL"
+  # D-1c: wire the documented consensus cross-verifier model knobs. Primary
+  # (claude) uses VERIFIER_MODEL/FINAL_VERIFIER_MODEL; cross (codex) uses
+  # CONSENSUS_MODEL/FINAL_CONSENSUS_MODEL ("model:reasoning"). Final (ALL)
+  # picks the stricter pair; per-US picks the lighter pair.
+  local _cons_claude_model _cons_codex_model _cons_claude_effort
+  if [[ "$cons_us_id" == "ALL" ]]; then
+    _cons_claude_model="$FINAL_VERIFIER_MODEL"; _cons_codex_model="$FINAL_CONSENSUS_MODEL"
+    _cons_claude_effort="$FINAL_VERIFIER_EFFORT"   # codex MEDIUM: final claude effort
+  else
+    _cons_claude_model="$VERIFIER_MODEL"; _cons_codex_model="$CONSENSUS_MODEL"
+    _cons_claude_effort="$VERIFIER_EFFORT"
+  fi
   local claude_verdict_file="$LOGS_DIR/iter-$(printf '%03d' $iter).verify-verdict-claude.json"
   local codex_verdict_file="$LOGS_DIR/iter-$(printf '%03d' $iter).verify-verdict-codex.json"
 
@@ -2712,7 +2996,7 @@ run_consensus_verification() {
 
     # Run claude verifier first
     local _claude_t0=$(date +%s)
-    if ! run_single_verifier "$iter" "claude" "$VERIFIER_MODEL" "-claude" "$claude_verdict_file"; then
+    if ! run_single_verifier "$iter" "claude" "$_cons_claude_model" "-claude" "$claude_verdict_file" "$_cons_claude_effort"; then
       log_error "Claude verifier failed in consensus round $CONSENSUS_ROUND"
       return 1
     fi
@@ -2723,7 +3007,7 @@ run_consensus_verification() {
       log "  WARNING: Claude verdict is '$CLAUDE_VERDICT' — likely interrupted. Retrying claude verifier..."
       log_debug "[GOV] iter=$iter phase=consensus_claude_retry reason=null_verdict"
       rm -f "$claude_verdict_file" 2>/dev/null
-      if ! run_single_verifier "$iter" "claude" "$VERIFIER_MODEL" "-claude" "$claude_verdict_file"; then
+      if ! run_single_verifier "$iter" "claude" "$_cons_claude_model" "-claude" "$claude_verdict_file" "$_cons_claude_effort"; then
         log_error "Claude verifier retry also failed"
         return 1
       fi
@@ -2733,19 +3017,36 @@ run_consensus_verification() {
         return 1
       fi
     fi
-    log_debug "[GOV] iter=$iter phase=consensus_claude verdict=$CLAUDE_VERDICT model=$VERIFIER_MODEL"
+    log_debug "[GOV] iter=$iter phase=consensus_claude verdict=$CLAUDE_VERDICT model=$_cons_claude_model"
 
     # consensus-fail-fast removed (complexity vs value too low)
 
     # Run codex verifier second
     local _codex_t0=$(date +%s)
-    if ! run_single_verifier "$iter" "codex" "$VERIFIER_CODEX_MODEL" "-codex" "$codex_verdict_file"; then
+    if ! run_single_verifier "$iter" "codex" "$_cons_codex_model" "-codex" "$codex_verdict_file"; then
       log_error "Codex verifier failed in consensus round $CONSENSUS_ROUND"
       return 1
     fi
     ITER_VERIFIER_CODEX_DURATION_S=$(( $(date +%s) - _codex_t0 ))
     CODEX_VERDICT=$(jq -r '.verdict' "$codex_verdict_file" 2>/dev/null)
-    log_debug "[GOV] iter=$iter phase=consensus_codex verdict=$CODEX_VERDICT model=$VERIFIER_CODEX_MODEL reasoning=$VERIFIER_CODEX_REASONING"
+    # D-14: validate codex verdict is not null/empty — retry once (symmetry with the
+    # claude null-retry above). A transient codex interruption otherwise counts as a
+    # non-pass, burns a consensus round, and can BLOCK after 6 rounds.
+    if [[ -z "$CODEX_VERDICT" || "$CODEX_VERDICT" == "null" ]]; then
+      log "  WARNING: Codex verdict is '$CODEX_VERDICT' — likely interrupted. Retrying codex verifier..."
+      log_debug "[GOV] iter=$iter phase=consensus_codex_retry reason=null_verdict"
+      rm -f "$codex_verdict_file" 2>/dev/null
+      if ! run_single_verifier "$iter" "codex" "$_cons_codex_model" "-codex" "$codex_verdict_file"; then
+        log_error "Codex verifier retry also failed"
+        return 1
+      fi
+      CODEX_VERDICT=$(jq -r '.verdict' "$codex_verdict_file" 2>/dev/null)
+      if [[ -z "$CODEX_VERDICT" || "$CODEX_VERDICT" == "null" ]]; then
+        log_error "Codex verdict still null after retry — consensus cannot proceed"
+        return 1
+      fi
+    fi
+    log_debug "[GOV] iter=$iter phase=consensus_codex verdict=$CODEX_VERDICT model=$_cons_codex_model"
 
     log "  Consensus: claude=$CLAUDE_VERDICT codex=$CODEX_VERDICT"
     local _combined_action="retry"
@@ -2760,6 +3061,7 @@ run_consensus_verification() {
       {
         echo '{'
         echo '  "verdict": "pass",'
+        echo '  "us_id": "'"$cons_us_id"'",'
         echo '  "verified_at_utc": "'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'",'
         echo '  "summary": "Consensus PASS: both claude and codex verified independently",'
         echo '  "recommended_state_transition": "complete",'
@@ -2852,51 +3154,38 @@ run_consensus_verification() {
 # =============================================================================
 
 main() {
-  # --- US-026 R14 P0: project-scoped runner lockfile (mkdir atomic) ---
-  # Prevents duplicate runners on the same project root regardless of slug.
-  # Different ROOT_HASH allows independent parallel runners across projects.
+  # --- US-026 R14 P0: project-scoped runner lock (per-ROOT, regardless of slug) ---
+  # D-9: delegate to acquire_slug_lock — the F-20-proven, race-safe primitive where
+  # the PID *is* the lock (`set -C` atomic create writes the pid in one redirect),
+  # so there is NO acquire/pid-write gap. The previous dir-based design (mkdir a dir
+  # + a separate pid file) had a fundamental gap between acquiring the dir and
+  # writing the pid that a recovery mutex alone could not close (codex D-9 R2).
+  # Metadata (slug/root) goes to a sidecar for the duplicate message + audit.
+  # Different ROOT_HASH → independent parallel runners across projects.
   mkdir -p "$(dirname "$RUNNER_LOCKFILE_PATH")" 2>/dev/null
-  if ! mkdir "$RUNNER_LOCKDIR" 2>/dev/null; then
+  if acquire_slug_lock "$RUNNER_LOCKFILE_PATH"; then
+    printf '{"pid":%s,"slug":"%s","root":"%s","started_at":"%s"}\n' \
+      "$$" "$SLUG" "$ROOT" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "${RUNNER_LOCKFILE_PATH}.meta" 2>/dev/null
+  else
     local existing existing_slug
-    existing=$(jq -r '.pid' "$RUNNER_LOCKFILE_PATH" 2>/dev/null || echo 0)
-    existing_slug=$(jq -r '.slug // "unknown"' "$RUNNER_LOCKFILE_PATH" 2>/dev/null || echo unknown)
-    if [[ "$existing" -gt 0 ]] && kill -0 "$existing" 2>/dev/null; then
-      echo "duplicate rlp-desk runner detected on this project root. existing pid=$existing slug=$existing_slug, this attempt slug=$SLUG. exiting." >&2
-      echo "  Recover with: rm -rf '$RUNNER_LOCKDIR' '$RUNNER_LOCKFILE_PATH' (only if pid $existing is confirmed dead)" >&2
-      exit 1
-    fi
-    rm -rf "$RUNNER_LOCKDIR"
-    mkdir "$RUNNER_LOCKDIR" 2>/dev/null || {
-      echo "failed to acquire runner lock after stale cleanup; another wrapper raced ahead. exit 1" >&2
-      exit 1
-    }
-    echo "stale runner lockfile cleaned (pid $existing dead) — acquired" >&2
+    existing=$(cat "$RUNNER_LOCKFILE_PATH" 2>/dev/null)
+    existing_slug=$(jq -r '.slug // "unknown"' "${RUNNER_LOCKFILE_PATH}.meta" 2>/dev/null || echo unknown)
+    echo "duplicate rlp-desk runner detected on this project root. existing pid=${existing:-unknown} slug=$existing_slug, this attempt slug=$SLUG. exiting." >&2
+    echo "  Recover with: rm -f '$RUNNER_LOCKFILE_PATH' '${RUNNER_LOCKFILE_PATH}.meta' && rm -rf '${RUNNER_LOCKFILE_PATH}.recovery.d' (only if pid ${existing:-?} is confirmed dead)" >&2
+    exit 1
   fi
-  printf '{"pid":%s,"slug":"%s","root":"%s","started_at":"%s"}\n' \
-    "$$" "$SLUG" "$ROOT" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$RUNNER_LOCKFILE_PATH"
 
-  # --- Lockfile: prevent duplicate execution ---
-  local lockfile="$LOCKFILE_PATH"
-  mkdir -p "$(dirname "$lockfile")" 2>/dev/null
-  if ! (set -C; echo $$ > "$lockfile") 2>/dev/null; then
-    local lock_pid
-    lock_pid=$(cat "$lockfile" 2>/dev/null)
-    if kill -0 "$lock_pid" 2>/dev/null; then
-      log_error "Another instance is already running (PID $lock_pid). Kill $lock_pid or rm $lockfile"
-      exit 1
-    fi
-    # Stale lock — overwrite.
-    # NOTE (ZSH-4, deferred): a fully race-safe stale-lock recovery is a separate
-    # distributed-lock redesign (codex review found subtle rm/create + mutex-leak
-    # races in patch attempts). This finding is LOW: the outer RUNNER_LOCKDIR mkdir
-    # lock (keyed on the same $ROOT) already serializes runners before this inner
-    # path is reached, so the inner race is unreachable in practice. Left at the
-    # tested baseline pending a dedicated redesign.
-    log "Stale lock detected (PID ${lock_pid:-unknown} not running), recovering"
-    echo $$ > "$lockfile"
+  # --- Lockfile: prevent duplicate execution (ZSH-4 race-safe, v0.17.1) ---
+  # Delegates to acquire_slug_lock (lib_ralph_desk.zsh): atomic set -C fast path +
+  # mkdir-mutex-serialized, PID-reaped stale recovery. Race-safe vs concurrent
+  # recoverers, gap-starters, and a crashed-recoverer mutex leak.
+  if acquire_slug_lock "$LOCKFILE_PATH"; then
     LOCKFILE_ACQUIRED=1
   else
-    LOCKFILE_ACQUIRED=1
+    local lock_pid
+    lock_pid=$(cat "$LOCKFILE_PATH" 2>/dev/null)
+    log_error "Another instance is already running or won the lock race (PID ${lock_pid:-unknown}). Kill it or rm $LOCKFILE_PATH"
+    exit 1
   fi
   # US-023 R11 P2-K: chain `_emit_final_cost_log` so cost-log.jsonl is never silently empty on exit.
   trap '_emit_final_cost_log; cleanup' EXIT INT TERM
@@ -2994,19 +3283,25 @@ main() {
       US_LIST=$(grep -oE 'US-[0-9]+' "$prd_file" | sort -u | tr '\n' ',' | sed 's/,$//')
     fi
 
-  # Initialize VERIFIED_US from memory's Completed Stories (carry over previous runs)
-  local memory_file="$DESK/memos/${SLUG}-memory.md"
-  if [[ -f "$memory_file" ]]; then
-      local completed_us
-      completed_us=$(sed -n '/^## Completed Stories$/,/^## /p' "$memory_file" 2>/dev/null | grep '^- US-' | sed 's/^- \(US-[0-9]*\):.*/\1/' | sort -u | tr '\n' ',' | sed 's/,$//')
-      if [[ -n "$completed_us" ]]; then
-        VERIFIED_US="$completed_us"
-        log "  Loaded completed stories from memory: $VERIFIED_US"
-        log_debug "[FLOW] loaded_verified_us_from_memory=$VERIFIED_US"
-      fi
+  # F-14 + status.json promotion (Item-4): VERIFIED_US restore precedence,
+  # most-durable first —
+  #   1. durable append-only ledger (leader-written, structured)
+  #   2. status.json verified_us (leader serialization written EVERY phase by
+  #      update_status — structured, reliable; promoted ABOVE the prose parse)
+  #   3. the Worker's prose "## Completed Stories" — LAST resort (fresh-context
+  #      LLM output that can drift; only legacy campaigns without 1 or 2 use it).
+  if [[ -f "$VERIFIED_LEDGER" ]]; then
+    local ledger_verified
+    ledger_verified=$(jq -rR 'fromjson? | .us_id // empty' "$VERIFIED_LEDGER" 2>/dev/null | grep -E '^US-[0-9]+$' | sort -u | tr '\n' ',' | sed 's/,$//')
+    if [[ -n "$ledger_verified" ]]; then
+      VERIFIED_US="$ledger_verified"
+      log "  Restored verified_us from durable ledger: $VERIFIED_US"
+      log_debug "[FLOW] restored_verified_us_from_ledger=$VERIFIED_US"
     fi
+  fi
 
-    # D1: Fallback — restore verified_us from status.json if memory had none
+    # 2nd source: status.json verified_us — structured leader serialization,
+    # more reliable than the prose parse below (Item-4: promoted above prose).
     if [[ -z "$VERIFIED_US" && -f "$STATUS_FILE" ]]; then
       local status_verified
       status_verified=$(jq -r '.verified_us // [] | join(",")' "$STATUS_FILE" 2>/dev/null)
@@ -3016,6 +3311,82 @@ main() {
         log_debug "[FLOW] restored_verified_us_from_status=$VERIFIED_US"
       fi
     fi
+
+  # LAST resort: the Worker's prose "## Completed Stories" (drift-prone; legacy).
+  local memory_file="$DESK/memos/${SLUG}-memory.md"
+  if [[ -z "$VERIFIED_US" && -f "$memory_file" ]]; then
+      local completed_us
+      completed_us=$(sed -n '/^## Completed Stories$/,/^## /p' "$memory_file" 2>/dev/null | grep '^- US-' | sed 's/^- \(US-[0-9]*\):.*/\1/' | sort -u | tr '\n' ',' | sed 's/,$//')
+      if [[ -n "$completed_us" ]]; then
+        VERIFIED_US="$completed_us"
+        log "  Loaded completed stories from memory (last-resort prose): $VERIFIED_US"
+        log_debug "[FLOW] loaded_verified_us_from_memory=$VERIFIED_US"
+      fi
+    fi
+
+  fi
+
+  # F-13 (batch-safe): restore the circuit-breaker counter on relaunch. This runs
+  # OUTSIDE the per-us block above because consecutive_failures is meaningful in
+  # EVERY verify mode — a batch-mode campaign crash-loops the same way, so nesting
+  # the restore under `per-us` let a batch relaunch reset its CB to 0 and evade the
+  # breaker. status.json persists the counter (lib_ralph_desk.zsh) every phase;
+  # only verified_us was ever read back. (verified_us restore stays per-us: batch
+  # mode has no per-US progress to rehydrate.) Normal reset-on-progress applies.
+  if [[ -f "$STATUS_FILE" ]]; then
+    local _status_cf
+    _status_cf=$(jq -r '.consecutive_failures // 0' "$STATUS_FILE" 2>/dev/null)
+    if [[ "$_status_cf" == <-> && "$_status_cf" -gt 0 ]]; then
+      CONSECUTIVE_FAILURES="$_status_cf"
+      log "  Restored consecutive_failures from status.json: $CONSECUTIVE_FAILURES"
+      log_debug "[FLOW] restored_consecutive_failures_from_status=$CONSECUTIVE_FAILURES"
+    fi
+    # D-5: also restore the consecutive-BLOCKS state so the now-live block CB
+    # (F-22) survives a relaunch — otherwise a crash-loop resets it to 0 every
+    # relaunch and the block breaker is evadable (the same durability hole F-13
+    # closed for consecutive_failures). Restore last_block_reason too, else a
+    # restored count is immediately reset on the next block (reason wouldn't match).
+    local _status_cb _status_lbr
+    _status_cb=$(jq -r '.consecutive_blocks // 0' "$STATUS_FILE" 2>/dev/null)
+    _status_lbr=$(jq -r '.last_block_reason // ""' "$STATUS_FILE" 2>/dev/null)
+    # D-5 fix: restore ATOMICALLY — both the count AND the reason, or neither. A
+    # count without its reason is a useless half-state (the next block's reason
+    # wouldn't match the empty LAST_BLOCK_REASON and would reset the count to 1
+    # anyway), so require both to be present before applying.
+    if [[ "$_status_cb" == <-> && "$_status_cb" -gt 0 && -n "$_status_lbr" ]]; then
+      CONSECUTIVE_BLOCKS="$_status_cb"
+      LAST_BLOCK_REASON="$_status_lbr"
+      log "  Restored consecutive_blocks from status.json: $CONSECUTIVE_BLOCKS"
+      log_debug "[FLOW] restored_consecutive_blocks_from_status=$CONSECUTIVE_BLOCKS"
+    fi
+    # D-5b (restore-priority, user-chosen): if the Worker was AUTO-upgraded during a
+    # prior segment (model_upgraded==1), restore the upgraded model + its engine
+    # triple + the upgrade bookkeeping, so a crash-relaunch resumes at the upgraded
+    # model (and the architecture-escalation trigger survives) instead of silently
+    # reverting to the base model and re-spending iterations to re-upgrade. Gated on
+    # model_upgraded==1 so it ONLY overrides for the auto-upgrade case (a fresh
+    # campaign that never upgraded keeps the env/CLI model).
+    local _status_mu
+    _status_mu=$(jq -r '.model_upgraded // 0' "$STATUS_FILE" 2>/dev/null)
+    if [[ "$_status_mu" == "1" ]]; then
+      local _s_wm _s_we _s_wcm _s_wcr _s_owm _s_sufc
+      _s_wm=$(jq -r '.worker_model // empty' "$STATUS_FILE" 2>/dev/null)
+      _s_we=$(jq -r '.worker_engine // empty' "$STATUS_FILE" 2>/dev/null)
+      _s_wcm=$(jq -r '.worker_codex_model // empty' "$STATUS_FILE" 2>/dev/null)
+      _s_wcr=$(jq -r '.worker_codex_reasoning // empty' "$STATUS_FILE" 2>/dev/null)
+      _s_owm=$(jq -r '.original_worker_model // empty' "$STATUS_FILE" 2>/dev/null)
+      _s_sufc=$(jq -r '.same_us_fail_count // 0' "$STATUS_FILE" 2>/dev/null)
+      if [[ -n "$_s_wm" && -n "$_s_we" ]]; then
+        _MODEL_UPGRADED=1
+        WORKER_MODEL="$_s_wm"; WORKER_ENGINE="$_s_we"
+        [[ -n "$_s_wcm" ]] && WORKER_CODEX_MODEL="$_s_wcm"
+        [[ -n "$_s_wcr" ]] && WORKER_CODEX_REASONING="$_s_wcr"
+        [[ -n "$_s_owm" ]] && _ORIGINAL_WORKER_MODEL="$_s_owm"
+        [[ "$_s_sufc" == <-> ]] && _SAME_US_FAIL_COUNT="$_s_sufc"
+        log "  Restored auto-upgraded Worker model: $WORKER_MODEL ($WORKER_ENGINE), orig=${_ORIGINAL_WORKER_MODEL:-?}, same_us_fails=$_SAME_US_FAIL_COUNT (D-5b restore-priority)"
+        log_debug "[FLOW] restored_model_upgrade=true worker_model=$WORKER_MODEL engine=$WORKER_ENGINE same_us_fail=$_SAME_US_FAIL_COUNT"
+      fi
+    fi
   fi
 
   # Initialize PRD snapshot state for live update detection
@@ -3028,6 +3399,16 @@ main() {
   # Print security warning (governance.md s7: --dangerously-skip-permissions)
   print_security_warning
 
+  # F-8 scope guard (F-19): snapshot the tracked files that are ALREADY dirty
+  # before the campaign touches anything. The F-8 leader-recovery auto-commit
+  # (Bug #8 Gate 3) must commit only the Worker's OWN edits and never sweep an
+  # operator's pre-existing uncommitted work into a Worker-recovery commit.
+  # `git diff --name-only HEAD` lists tracked files modified vs HEAD (staged or
+  # not); untracked cruft is excluded and is never auto-committed. Empty when the
+  # tree starts clean. Recorded once; excluded at recovery time in Gate 3.
+  typeset -g CAMPAIGN_PREEXISTING_DIRTY
+  CAMPAIGN_PREEXISTING_DIRTY=$(git -C "$ROOT" diff --name-only HEAD 2>/dev/null)
+
   # Validate scaffold
   validate_scaffold
 
@@ -3120,6 +3501,28 @@ main() {
       fi
     fi
 
+    # D-16: leader-driven finalize. The previous iteration's last per-US pass
+    # completed coverage and armed _FINALIZE_PENDING instead of dispatching a
+    # worker round-trip to emit an ALL signal. Synthesize that ALL verify signal
+    # ourselves and skip the worker; the existing verify path (signal_us_id=ALL →
+    # run_sequential_final_verify) handles completion AND the fix-loop on failure.
+    # Operator recovery (PR-A) takes precedence — only finalize if it did not claim
+    # this iteration. A crash before this point loses the flag and safely falls
+    # back to the worker round-trip (the pre-D-16 path).
+    if (( _FINALIZE_PENDING )) && [[ "$SKIP_NEXT_WORKER" -eq 0 ]]; then
+      _FINALIZE_PENDING=0
+      log "  Leader finalize (D-16): all US verified ($VERIFIED_US) — synthesizing ALL verify signal, skipping worker round-trip."
+      log_debug "[FLOW] iter=$ITERATION d16_finalize=true verified_us=$VERIFIED_US"
+      printf '{"iteration": %d, "status": "verify", "us_id": "ALL", "summary": "leader finalize (D-16: all per-US verified)", "timestamp": "%s"}\n' \
+        "$ITERATION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" | atomic_write "$SIGNAL_FILE"
+      update_status "verify" "running"
+      SKIP_NEXT_WORKER=1
+    else
+      # Any normally-dispatched iteration clears a stale arm (defensive; the flag
+      # is consumed above on the immediately-following iteration in practice).
+      _FINALIZE_PENDING=0
+    fi
+
     if (( ! SKIP_NEXT_WORKER )); then
       # --- governance.md s7 step 8 (cleanup): Clean previous iteration signals ---
       # Bug #7 Fix-R cleanup: unlock 0o444 sentinels written by the previous
@@ -3166,19 +3569,34 @@ main() {
       # --- governance.md s7 step 5: Execute Worker (dispatched to engine-specific function) ---
       log_debug "[FLOW] iter=$ITERATION phase=worker engine=$WORKER_ENGINE model=$WORKER_MODEL dispatched=true"
 
+      # F-11: a pane-start failure is usually the transient F6.1 spawn race
+      # (send-keys before the pane's shell is ready). Replace the pane and retry
+      # ONCE before BLOCKing, instead of terminating the campaign on a transient.
       if [[ "$WORKER_ENGINE" = "codex" ]]; then
-        worker_launch="${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" --disable plugins --dangerously-bypass-approvals-and-sandbox"
+        worker_launch="${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" -c mcp_servers='{}' --disable plugins --dangerously-bypass-approvals-and-sandbox"
         if ! launch_worker_codex "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
-          write_blocked_sentinel "Worker codex failed to start in pane" "" "infra_failure"
-          update_status "blocked" "worker_start_failed"
-          return 1
+          log "  Worker codex failed to start — replacing pane and retrying once (F-11)."
+          log_debug "[GOV] iter=$ITERATION worker_start_failed=true action=replace_retry engine=codex"
+          replace_worker_pane "$WORKER_PANE" "worker"
+          WORKER_PANE=$(jq -r '.panes.worker' "$SESSION_CONFIG")
+          if ! launch_worker_codex "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
+            write_blocked_sentinel "Worker codex failed to start in pane after replace+retry" "" "infra_failure"
+            update_status "blocked" "worker_start_failed"
+            return 1
+          fi
         fi
       else
         worker_launch="$(build_claude_cmd tui "$WORKER_MODEL" "" "" "$WORKER_EFFORT")"
         if ! launch_worker_claude "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
-          write_blocked_sentinel "Worker claude failed to start in pane" "" "infra_failure"
-          update_status "blocked" "worker_start_failed"
-          return 1
+          log "  Worker claude failed to start — replacing pane and retrying once (F-11)."
+          log_debug "[GOV] iter=$ITERATION worker_start_failed=true action=replace_retry engine=claude"
+          replace_worker_pane "$WORKER_PANE" "worker"
+          WORKER_PANE=$(jq -r '.panes.worker' "$SESSION_CONFIG")
+          if ! launch_worker_claude "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
+            write_blocked_sentinel "Worker claude failed to start in pane after replace+retry" "" "infra_failure"
+            update_status "blocked" "worker_start_failed"
+            return 1
+          fi
         fi
       fi
     else
@@ -3299,12 +3717,25 @@ main() {
         local vp_count
         vp_count=$(jq -r '.verified_acs // [] | length' "$SIGNAL_FILE" 2>/dev/null || echo 0)
         if [[ "$vp_count" -eq 0 ]]; then
-          log "  Worker signal verify_partial but verified_acs is empty — downgrading to blocked (verify_partial_malformed)."
+          # F-12: a Worker formatting slip (verify_partial with empty verified_acs)
+          # is recoverable — route it back to the Worker as a soft-fail BOUNDED by
+          # the consecutive-failure circuit breaker, instead of a terminal
+          # mission_abort that ends the whole campaign on a single malformed signal.
+          # A fresh-context Worker that keeps malforming still trips the CB and
+          # blocks; one slip just costs an iteration.
           local vp_us_id
           vp_us_id=$(jq -r '.us_id // empty' "$SIGNAL_FILE" 2>/dev/null)
-          write_blocked_sentinel "verify_partial_malformed: empty verified_acs" "${vp_us_id:-${CURRENT_US:-ALL}}" "mission_abort"
-          update_status "blocked" "verify_partial_malformed"
-          break
+          (( CONSECUTIVE_FAILURES++ ))
+          log "  Worker verify_partial malformed (empty verified_acs) — soft-fail retry $CONSECUTIVE_FAILURES/$EFFECTIVE_CB_THRESHOLD (bounded by CB)."
+          log_debug "[GOV] iter=$ITERATION verify_partial_malformed=soft_fail consecutive_failures=$CONSECUTIVE_FAILURES threshold=$EFFECTIVE_CB_THRESHOLD"
+          update_status "worker" "verify_partial_malformed_retry"
+          if (( CONSECUTIVE_FAILURES >= EFFECTIVE_CB_THRESHOLD )); then
+            log_error "  verify_partial_malformed repeated $CONSECUTIVE_FAILURES times (>= $EFFECTIVE_CB_THRESHOLD) — blocking."
+            write_blocked_sentinel "verify_partial_malformed repeated $CONSECUTIVE_FAILURES times" "${vp_us_id:-${CURRENT_US:-ALL}}" "repeat_axis"
+            update_status "blocked" "verify_partial_malformed_cb"
+            break
+          fi
+          continue
         fi
         log "  Worker signal verify_partial (verified_acs count=$vp_count). Routing to verify path."
         signal_status="verify"
@@ -3314,6 +3745,13 @@ main() {
         # Read us_id from signal for per-US scoping
         local signal_us_id=""
         signal_us_id=$(jq -r '.us_id // empty' "$SIGNAL_FILE" 2>/dev/null)
+        # F-23: normalize case so a Worker emitting "all"/"All" still triggers the
+        # final/ALL verify + completion paths (which match "ALL" exactly). US ids
+        # are already uppercase ("US-001"), so this is a no-op for well-formed ids.
+        signal_us_id="${signal_us_id:u}"
+        # D-11: the US under verification is the in-flight US for lifecycle sentinels
+        # fired during the verify poll (no-progress / stall / R12).
+        [[ -n "$signal_us_id" ]] && CURRENT_US="$signal_us_id"
         log "  Worker claims done (us_id=${signal_us_id:-all}). Dispatching Verifier..."
 
         # AC1: capture verifier start timestamp
@@ -3348,7 +3786,7 @@ main() {
         if (( use_consensus )); then
           # US-004: Run consensus verification (claude + codex sequentially)
           local consensus_rc=0
-          run_consensus_verification "$ITERATION" || consensus_rc=$?
+          run_consensus_verification "$ITERATION" "$signal_us_id" || consensus_rc=$?
 
           if (( consensus_rc == 2 )); then
             # Consensus disagreement — treat as fail, fix loop will handle
@@ -3389,15 +3827,35 @@ main() {
           fi
           wait_for_pane_ready "$VERIFIER_PANE" 10 2>/dev/null || true
 
+          # D-1: a final/ALL verify reaching the single-engine path (batch mode, or
+          # any ALL verify not handled by the per-us sequential path) uses the
+          # stronger FINAL_VERIFIER_*; per-US verifies keep the lighter VERIFIER_*.
+          # For signal_us_id != ALL, _v_* alias VERIFIER_* EXACTLY — no behavior
+          # change on the per-US hot path.
+          local _v_eng _v_model _v_cxm _v_cxr _v_eff _v_role
+          if [[ "$signal_us_id" == "ALL" ]]; then
+            _v_eng="$FINAL_VERIFIER_ENGINE"; _v_model="$FINAL_VERIFIER_MODEL"
+            _v_cxm="$FINAL_VERIFIER_CODEX_MODEL"; _v_cxr="$FINAL_VERIFIER_CODEX_REASONING"; _v_eff="$FINAL_VERIFIER_EFFORT"
+            # D-10 fix: an ALL verify here runs FINAL_VERIFIER_ENGINE, so the poll's
+            # dead-pane check must derive FINAL_VERIFIER_ENGINE too — use the
+            # "*inal*" role so poll_for_signal's engine derivation matches _v_eng
+            # (else a codex final verifier's "bash" is misjudged with VERIFIER_ENGINE).
+            _v_role="Verifier-final"
+          else
+            _v_eng="$VERIFIER_ENGINE"; _v_model="$VERIFIER_MODEL"
+            _v_cxm="$VERIFIER_CODEX_MODEL"; _v_cxr="$VERIFIER_CODEX_REASONING"; _v_eff="$VERIFIER_EFFORT"
+            _v_role="Verifier"
+          fi
+
           local verifier_launch
-          if [[ "$VERIFIER_ENGINE" = "codex" ]]; then
-            verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --disable plugins --dangerously-bypass-approvals-and-sandbox"
+          if [[ "$_v_eng" = "codex" ]]; then
+            verifier_launch="${CODEX_BIN:-codex} -m $_v_cxm -c model_reasoning_effort=\"$_v_cxr\" -c mcp_servers='{}' --disable plugins --dangerously-bypass-approvals-and-sandbox"
           else
-            verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL" "" "" "$VERIFIER_EFFORT")"
+            verifier_launch="$(build_claude_cmd tui "$_v_model" "" "" "$_v_eff")"
           fi
-          log_debug "[FLOW] iter=$ITERATION phase=verifier engine=$VERIFIER_ENGINE model=$VERIFIER_MODEL scope=${signal_us_id:-all} dispatched=true"
+          log_debug "[FLOW] iter=$ITERATION phase=verifier engine=$_v_eng model=$_v_model scope=${signal_us_id:-all} dispatched=true"
 
-          if [[ "$VERIFIER_ENGINE" = "codex" ]]; then
+          if [[ "$_v_eng" = "codex" ]]; then
             launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$ITERATION" "$verifier_launch"
           else
             if ! launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$ITERATION" "$verifier_launch"; then
@@ -3406,16 +3864,45 @@ main() {
             fi
           fi
 
-          # Poll for verify-verdict.json
+          # Poll for verify-verdict.json — F-10: 3-strike replace+re-dispatch
+          # parity with the Worker's MONITOR_FAILURE_COUNT breaker. "Bug Report #5"
+          # hardened the Worker poll-fail path (retry-3-then-block) but left the
+          # Verifier path as an immediate terminal BLOCK, so a single transient
+          # verifier death (API blip / pane-spawn race, also F-11) ended a campaign
+          # the Worker path would have survived. rc==2 keeps its original meaning
+          # (already-handled → return). Only 3 consecutive failures BLOCK.
           log "  Polling for verify-verdict.json..."
-          if ! poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "Verifier"; then
+          local _vpoll_strike=0 _vpoll_ok=0
+          while (( _vpoll_strike < 3 )); do
+            # Capture poll rc DIRECTLY — `$?` after `if cmd; then…fi` is the
+            # if-statement's status (0), not cmd's rc (the original `if ! poll;
+            # then local rc=$?` had this latent bug, so its `rc==2` branch was
+            # dead and a hard-fail double-wrote a sentinel). rc: 0=verdict,
+            # 1=timeout (retryable), 2=hard-failed + infra_failure already recorded.
+            poll_for_signal "$VERDICT_FILE" "$VERIFIER_HEARTBEAT" "$VERIFIER_PANE" "$verifier_launch" "$_v_role"
             local verifier_poll_rc=$?
+            if (( verifier_poll_rc == 0 )); then
+              _vpoll_ok=1; break
+            fi
             if (( verifier_poll_rc == 2 )); then
-              return 1
+              return 1   # hard-failed; poll already recorded infra_failure — do not retry
+            fi
+            (( _vpoll_strike++ ))
+            log "  WARNING: Verifier poll failed (strike $_vpoll_strike/3) — replacing pane and re-dispatching"
+            log_debug "[GOV] iter=$ITERATION verifier_monitor_failure=$_vpoll_strike/3"
+            update_status "verifier" "poll_failed"
+            (( _vpoll_strike >= 3 )) && break
+            replace_worker_pane "$VERIFIER_PANE" "verifier"
+            VERIFIER_PANE=$(jq -r '.panes.verifier' "$SESSION_CONFIG")
+            if [[ "$_v_eng" = "codex" ]]; then
+              launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$ITERATION" "$verifier_launch"
+            else
+              launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$ITERATION" "$verifier_launch" || true
             fi
-            log_error "Verifier poll failed"
-            # Verifier is dead/stuck — BLOCK and let user decide
-            write_blocked_sentinel "Verifier process dead/stuck (poll failed). Pane preserved for inspection." "" "infra_failure"
+          done
+          if (( ! _vpoll_ok )); then
+            log_error "Verifier poll failed 3× (dead/stuck after retries)"
+            write_blocked_sentinel "Verifier process dead/stuck after 3 retries. Pane preserved for inspection." "" "infra_failure"
             update_status "blocked" "verifier_dead"
             return 1
           fi
@@ -3435,6 +3922,10 @@ main() {
         verdict=$(jq -r '.verdict' "$VERDICT_FILE" 2>/dev/null)
         local recommended
         recommended=$(jq -r '.recommended_state_transition' "$VERDICT_FILE" 2>/dev/null)
+        # F-23: normalize so a verifier's phrasing variant doesn't strand a
+        # genuinely-complete campaign at MAX_ITER. "Complete"/"completed"/"done"
+        # all mean complete; comparison below is lowercase-exact.
+        recommended="${recommended:l}"
         local verdict_summary
         verdict_summary=$(jq -r '.summary // "no summary"' "$VERDICT_FILE" 2>/dev/null)
 
@@ -3445,10 +3936,20 @@ main() {
 
         case "$verdict" in
           pass)
+            # D-3 fix: snapshot the CB BEFORE the pass-success reset so a wrong-US
+            # "pass" (us_id mismatch, handled below) accumulates the CB across
+            # iterations instead of restarting from 0 each time (the reset on the
+            # next line would otherwise defeat the mismatch soft-fail's CB bound).
+            local _cf_before_pass=$CONSECUTIVE_FAILURES
             CONSECUTIVE_FAILURES=0
             CONSENSUS_ROUND=0
             _SAME_US_FAIL_COUNT=0
             _LAST_FAILED_US=""
+            # F-22b: a pass is real progress — reset the consecutive-BLOCKS state
+            # too so the now-live block CB counts only blocks with NO intervening
+            # success ("consecutive" in the true sense, not cumulative).
+            CONSECUTIVE_BLOCKS=0
+            LAST_BLOCK_REASON=""
             if (( _MODEL_UPGRADED )); then
               log "  Worker model restored: ${WORKER_MODEL} → ${_ORIGINAL_WORKER_MODEL} (pass verdict)"
               log_debug "[DECIDE] iter=$ITERATION phase=model_select model_restore=true from=${WORKER_MODEL} to=${_ORIGINAL_WORKER_MODEL}"
@@ -3462,17 +3963,60 @@ main() {
 
             # --- Verified US tracking (both per-us and batch modes) ---
             if [[ -n "$signal_us_id" && "$signal_us_id" != "ALL" ]]; then
-              # Add this US to verified list
-              if [[ -n "$VERIFIED_US" ]]; then
-                VERIFIED_US="${VERIFIED_US},${signal_us_id}"
+              # D-3: cross-check the verdict's OWN us_id against the US the leader
+              # scoped this verify to. If the verifier graded a DIFFERENT US, do
+              # NOT credit signal_us_id (it was not actually verified) — soft-fail
+              # so the Worker re-runs the contracted US. Acts ONLY on a PRESENT
+              # mismatch (absent verdict us_id = trust the scope), so a correctly-
+              # scoped verifier is never affected.
+              local _verdict_us_id
+              _verdict_us_id=$(jq -r '.us_id // empty' "$VERDICT_FILE" 2>/dev/null)
+              _verdict_us_id="${_verdict_us_id:u}"
+              if [[ -n "$_verdict_us_id" && "$_verdict_us_id" != "$signal_us_id" ]]; then
+                log_error "  Verdict us_id mismatch: verifier graded $_verdict_us_id but leader scoped $signal_us_id — NOT crediting (soft-fail)."
+                log_debug "[GOV] iter=$ITERATION verdict_us_id_mismatch verdict_us=$_verdict_us_id signal_us=$signal_us_id"
+                update_status "verifier" "us_id_mismatch"
+                # D-3 fix: undo the pass-entry CB reset so consecutive mismatches
+                # actually accumulate toward the breaker (else each restarts at 0).
+                CONSECUTIVE_FAILURES=$_cf_before_pass
+                if _bump_consecutive_failure; then
+                  write_blocked_sentinel "${EFFECTIVE_CB_THRESHOLD} consecutive verdict us_id mismatches" "" "repeat_axis"
+                  update_status "blocked" "consecutive_failures"
+                  return 1
+                fi
               else
-                VERIFIED_US="$signal_us_id"
+                # Add this US to verified list. D-12: dedup — a fresh-context Worker
+                # can re-submit an already-verified US (memory drift); don't
+                # double-credit it (mirrors the fail/partial-progress guard, and
+                # keeps VERIFIED_US + the ledger + the coverage count honest).
+                if echo ",$VERIFIED_US," | grep -q ",$signal_us_id,"; then
+                  log "  US $signal_us_id already verified — not re-crediting (dedup)."
+                  log_debug "[FLOW] iter=$ITERATION verified_us_dedup=$signal_us_id"
+                else
+                  if [[ -n "$VERIFIED_US" ]]; then
+                    VERIFIED_US="${VERIFIED_US},${signal_us_id}"
+                  else
+                    VERIFIED_US="$signal_us_id"
+                  fi
+                  log "  US $signal_us_id verified. Verified so far: $VERIFIED_US"
+                  log_debug "[FLOW] iter=$ITERATION verified_us_update=$signal_us_id verified_us_total=$VERIFIED_US"
+                  _append_verified_ledger "$signal_us_id"   # F-14: durable source-of-truth
+                fi
+                update_status "verifier" "pass_us"
+                # D-16: if this pass completed coverage (every US in US_LIST is now
+                # verified), arm leader-driven finalize so the NEXT loop top runs the
+                # sequential final verify DIRECTLY — instead of a worker round-trip
+                # whose only job is to emit an ALL signal (a fragile extra LLM
+                # iteration, observed hanging on an API rate-limit in SV CRITICAL).
+                if [[ "$VERIFY_MODE" == "per-us" && -n "$US_LIST" ]] && _all_us_verified; then
+                  _FINALIZE_PENDING=1
+                  log "  Coverage complete ($VERIFIED_US) — arming leader finalize (D-16, no worker round-trip)."
+                  log_debug "[FLOW] iter=$ITERATION d16_arm_finalize=true verified_us=$VERIFIED_US"
+                else
+                  : # more US remain → Worker will do next US on next iteration
+                fi
               fi
-              log "  US $signal_us_id verified. Verified so far: $VERIFIED_US"
-              log_debug "[FLOW] iter=$ITERATION verified_us_update=$signal_us_id verified_us_total=$VERIFIED_US"
-              update_status "verifier" "pass_us"
-              # Worker will do next US on next iteration
-            elif [[ "$recommended" == "complete" || "$signal_us_id" == "ALL" ]]; then
+            elif [[ "$recommended" == (complete|completed|done) || "$signal_us_id" == "ALL" ]]; then
               # Final full verify passed or complete recommended
               write_complete_sentinel "$verdict_summary"
               update_status "complete" "pass"
@@ -3499,6 +4043,7 @@ main() {
                     VERIFIED_US="$_pus"
                   fi
                   log "  Partial progress: $_pus passed (overall FAIL). Verified so far: $VERIFIED_US"
+                  _append_verified_ledger "$_pus"   # F-14: durable source-of-truth
                 fi
               done
               log_debug "[FLOW] iter=$ITERATION partial_progress prev=$_prev_verified now=$VERIFIED_US"
@@ -3507,6 +4052,9 @@ main() {
             # Partial progress resets consecutive failures (progress was made)
             if [[ "$VERIFIED_US" != "$_prev_verified" ]]; then
               CONSECUTIVE_FAILURES=0
+              # F-22b: partial progress also resets the consecutive-blocks state.
+              CONSECUTIVE_BLOCKS=0
+              LAST_BLOCK_REASON=""
               log "  Progress detected — consecutive_failures reset to 0"
               log_debug "[GOV] iter=$ITERATION consecutive_failures_reset=partial_progress"
             fi
@@ -3575,31 +4123,66 @@ main() {
             log "  Questions: \"$verdict_summary_ri\""
             log "  Treating as soft fail — Worker will see verdict in next iteration."
             update_status "verifier" "request_info"
+            # F-22: count request_info toward the CB so a verifier looping on
+            # request_info trips the breaker instead of spinning to MAX_ITER.
+            if _bump_consecutive_failure; then
+              write_blocked_sentinel "${EFFECTIVE_CB_THRESHOLD} consecutive non-advancing verdicts (request_info)" "" "repeat_axis"
+              update_status "blocked" "consecutive_failures"
+              return 1
+            fi
             ;;
           blocked)
             local _verdict_cat
             _verdict_cat=$(_classify_cross_us_or_metric "$verdict_summary")
-            write_blocked_sentinel "Verifier verdict: blocked - $verdict_summary" "" "$_verdict_cat"
-            update_status "blocked" "verifier_blocked"
-            return 1
+            # F-22: a transient/first "blocked" no longer kills the campaign —
+            # absorb as a soft-fail with grace; terminate only on a genuine infra
+            # block, the same reason repeated >= BLOCK_CB_THRESHOLD, or the CB.
+            if _block_with_grace "Verifier verdict: blocked - $verdict_summary" "$_verdict_cat"; then
+              write_blocked_sentinel "Verifier verdict: blocked - $verdict_summary" "" "$_verdict_cat"
+              update_status "blocked" "verifier_blocked"
+              return 1
+            fi
+            log "  Verifier verdict=blocked absorbed as soft-fail (consecutive_failures=$CONSECUTIVE_FAILURES; reason not yet repeated ${BLOCK_CB_THRESHOLD}×) — Worker will retry."
+            update_status "verifier" "blocked_softfail"
             ;;
           *)
             log_error "Unknown verdict: $verdict"
             update_status "verifier" "unknown_verdict"
+            # F-22: unknown verdict is a soft-fail that counts toward the CB
+            # (was: silent continue to MAX_ITER with no diagnostic BLOCK).
+            if _bump_consecutive_failure; then
+              write_blocked_sentinel "${EFFECTIVE_CB_THRESHOLD} consecutive unrecognized verifier verdicts" "" "repeat_axis"
+              update_status "blocked" "consecutive_failures"
+              return 1
+            fi
             ;;
         esac
         ;;
       blocked)
-        # --- governance.md s7 step 6: blocked -> write sentinel ---
+        # --- governance.md s7 step 6: blocked -> write sentinel (with grace) ---
         local _signal_cat
         _signal_cat=$(_classify_cross_us_or_metric "$signal_summary")
-        write_blocked_sentinel "Worker reported blocked: $signal_summary" "" "$_signal_cat"
-        update_status "blocked" "worker_blocked"
-        return 1
+        # F-22: a transient/first Worker-reported "blocked" no longer kills the
+        # campaign — absorb as a soft-fail with grace (same gate as the verifier
+        # blocked path); terminate only on infra, repeated reason, or the CB.
+        if _block_with_grace "Worker reported blocked: $signal_summary" "$_signal_cat"; then
+          write_blocked_sentinel "Worker reported blocked: $signal_summary" "" "$_signal_cat"
+          update_status "blocked" "worker_blocked"
+          return 1
+        fi
+        log "  Worker status=blocked absorbed as soft-fail (consecutive_failures=$CONSECUTIVE_FAILURES) — re-dispatching Worker."
+        update_status "worker" "blocked_softfail"
         ;;
       *)
         log_error "Unknown signal status: $signal_status"
         update_status "worker" "unknown_status"
+        # F-22: unknown signal status is a soft-fail that counts toward the CB
+        # (was: silent continue to MAX_ITER).
+        if _bump_consecutive_failure; then
+          write_blocked_sentinel "${EFFECTIVE_CB_THRESHOLD} consecutive unrecognized worker signals" "" "repeat_axis"
+          update_status "blocked" "consecutive_failures"
+          return 1
+        fi
         ;;
     esac