fix(verification): keep passed uat results across verifier re-runs

A phase whose human UAT passed could loop forever between execute-phase
and verify-work. A gap-closure plan, or a later phase editing a covered
file, made the report stale; verify-work only recorded a passed UAT
against human_needed; the re-run verifier could not see the UAT file and
re-emitted human_needed; and execute-phase's human_needed branch then
rewrote *-UAT.md with every row back to [pending].

- verification.uat-evidence: recorded UAT rows plus the covered
  implementation files changed since the UAT. The verifier (Step 8b)
  treats a row that passed on unchanged code as verified and re-lists
  only affected rows, each with a retest_reason.
- verification.seed-uat: merges the report's human items into *-UAT.md.
  Existing rows are kept byte-for-byte; a pass is reset only with a
  recorded reason.
- verification.canonicalize-uat: the single human_needed -> passed flip,
  gated on the uat-only row predicate; refuses a stale report.
- verification.status reports stale_reason; init.progress lists every
  executed-but-stale phase in reverify_phases.
- verify-work and progress re-run the verifier themselves for a stale
  report instead of routing to execute-phase; execute-phase records a
  gap-closure checkpoint's UAT answers before dispatching the verifier.

Fail-closed properties are unchanged: a malformed fingerprint and a real
change to covered code still read stale.

Emitted-Drift-Ack-Growth: execute-phase.md — verify_phase_goal gains the gap-closure uat-record pointer and the merge-not-overwrite human_needed branch; the uat template it replaced moved into verification.seed-uat
Emitted-Drift-Ack-Growth: msd-verifier.md — new step 8b pointer to the lazily loaded verifier-uat-evidence reference plus the human_verified frontmatter key
Emitted-Drift-Ack-Growth: progress.md — route v.stale now re-verifies every stale executed phase in place instead of naming one command

docs/INVENTORY-MANIFEST.json

@@ -323,6 +323,7 @@
       "sketch-variant-patterns.md",
       "specless-probe-fallback.md",
       "spidr-splitting.md",
+      "stale-reverification.md",
       "tdd.md",
       "thinking-models-debug.md",
       "thinking-models-execution.md",
@@ -340,6 +341,7 @@
       "verification-patterns.md",
       "verifier-evidence-gate.md",
       "verifier-phase-gates.md",
+      "verifier-uat-evidence.md",
       "verifier-wiring-patterns.md",
       "verify-command-path-resolvability.md",
       "verify-mvp-mode.md",
@@ -565,6 +567,7 @@
       "template.cjs",
       "text-lines.cjs",
       "token-scanner.cjs",
+      "uat-evidence.cjs",
       "uat-predicate.cjs",
       "uat.cjs",
       "ui-consideration-probe.cjs",
@@ -652,6 +655,7 @@
       "execute-phase/steps/executor-isolation-dispatch.md",
       "execute-phase/steps/executor-progress-policy.md",
       "execute-phase/steps/gap-closure-artifacts.md",
+      "execute-phase/steps/gap-closure-uat-record.md",
       "execute-phase/steps/partial-wave.md",
       "execute-phase/steps/per-plan-executor-routing.md",
       "execute-phase/steps/per-plan-worktree-gate.md",

docs/INVENTORY.md

@@ -347,6 +347,8 @@ Full roster at `msd-core/references/*.md`. References are shared knowledge docum
 | `verification-overrides.md` | Per-artifact verification override rules. |
 | `verifier-phase-gates.md` | Verifier-time gates eagerly imported by `msd-verifier` (migrated from the retired `verify-phase` workflow, #1892): decision-coverage validation (#2492), test-quality audit, and infrastructure-phase human-verification scoping (#2504). |
 | `verifier-evidence-gate.md` | Re-verification convergence gate loaded by `msd-verifier` (#3304): a Step 7 anti-pattern blocker that is neither a carried-forward gap nor a regression needs deterministic evidence to stay blocking, else it downgrades to advisory. |
+| `verifier-uat-evidence.md` | UAT-evidence gate loaded by `msd-verifier` at Step 8b when the phase has a `*-UAT.md`: a human item whose UAT row passed on unchanged code is verified by that row; a row whose tested code changed is re-listed with a `retest_reason`. |
+| `stale-reverification.md` | The single procedure for refreshing a `stale` VERIFICATION.md on a fully summarized phase (verifier re-run, `verification.seed-uat` merge, fresh-status routing); shared by `execute-phase`, `verify-work` and `progress`. |
 | `planning-config.md` | Full config schema and behavior. |
 | `phase-id-convention.md` | Canonical bracket phase-ID grammar card and display/disk translation reference (ADR-612). |
 | `security-asvs-levels.md` | OWASP ASVS level definitions for MSD threat modeling — per-level planner disposition rigor and auditor verification depth (L1 opportunistic, L2 standard, L3 comprehensive). |
@@ -709,6 +711,7 @@ Full listing: `msd-core/bin/lib/*.cjs`.
 | `normalize-test-command.cjs` | Normalizes a resolved test command to a one-shot form so a watch-mode runner (vitest/jest) cannot hang a verification gate (#1857); shared by all three live test-command gates (regression, post-merge, audit-fix) |
 | `uat.cjs` | UAT file parsing, verification debt tracking, audit-uat support |
 | `uat-predicate.cjs` | UAT-passed predicate — markdown-aware evaluation of HUMAN-UAT results; returns pass only when all required checks pass; ignores false-positive contexts (frontmatter, fenced code, blockquotes, HTML comments) |
+| `uat-evidence.cjs` | UAT-evidence seam — `verification.uat-evidence` (recorded UAT rows plus covered files changed since), `verification.seed-uat` (merge the report's human items into `*-UAT.md` without overwriting results) and `verification.canonicalize-uat` (the single `human_needed` → `passed` flip, gated on the UAT-row predicate) |
 | `ui-consideration-probe.cjs` | Spec-completeness UI-consideration probe (compiled from `src/ui-consideration-probe.cts`, gitignored) — the third adapter of the `probe-core` resolution model (ADR-550 Decision 7): element-kind classification, applicable-category relevance filter, consideration proposal, `proposeElements`/`autoResolve` (propose-then-confirm + the `--auto` never-dismiss floor), and the `{explicit, backstop}` validators; delegates merge/rollup/CLI to `probe-core`; exports `classifyElement`, `applicableCategories`, `proposeConsiderations`, `proposeElements`, `autoResolve`, `analyzeCoverage`, `UI_TAXONOMY` (#1867) |
 | `ui-safety-gate.cjs` | Shell-free word-boundary UI token detector (#3706, #3718); reads phase-section text from stdin, exits 0 (UI found), 1 (no UI — real input, examined), NO_INPUT (empty/whitespace-only stdin) or UNAVAILABLE (stdin read failed) — the latter two are registry codes (ADR-3889 Phase 3, #3907); also deployed to `msd-core/bin/lib/` so the MSD installer ships it to `$RUNTIME_DIR` (#448) |
 | `ui-frontend-evidence.cjs` | Static frontend-evidence detector (compiled from `src/ui-frontend-evidence.cts`, gitignored) — plan-time structural corroboration for `computeUiPlanGate` (#3312): a `package.json` UI-framework dependency or a component-framework file (`*.tsx/*.jsx/*.vue/*.svelte`) in the tree, so a UI-token match on a hyphenated proper noun (e.g. repo `dashboard-financeiro`) cannot block planning in a repo with no frontend; mirrors the post-wave `computeUiSafetyGate` git-diff corroboration |