Closes #334

The livelock

The orchestrator — not the dev session — advances sprint-status to done at dev time (engine.py:2080, its sole sprint_advance site; verify_dev then asserts the write landed, and advance never regresses). A review session that judges the story unfinished and writes the board back to an earlier stage is doing the right thing, but nothing in the review loop re-advances it. So verify_review's sprint != "done" check returned a non-fixable retry, the loop continued, and every remaining cycle re-read the identical failure — until max_review_cycles ran out and the story deferred with its work rolled back.

Reported by Wojtek Diset against 0.9.0: three review passes burned on a structural disagreement, then a rollback onto an attempt-preserve ref.

The fix

verify_review gains a kw-only sprint_reached_done: bool = False. Only Engine._verify_review passes it (not self._dev_review_enabled() — exactly the case where _post_dev_state_sync targeted done); the sweep and stories gates are separate functions and are untouched. When the flag is set, the knob is escalate, and the fresh sprint status is in STATUS_ORDER at an index below done, the gate returns VerifyOutcome.escalate(..., contradiction=True) — a reason naming both sides, both ways out, and the opt-out knob. That flows into the existing not outcome.retryable → self._escalate routing at both call sites, so the run pauses and paused_reason carries the text to bmad-loop resolve.

One site needed an edit: the budget-exhaustion rescue (engine.py:1528) tested self._verify_review(task).ok inline. When every cycle recommends its own follow-up the in-loop verify never runs, so the rescue is the first read of the board — a contradiction there would have fallen through to the did not converge defer that rolls the work back naming neither side. It now captures the outcome and escalates on contradiction.

New knob [review] on_status_contradiction = "escalate" (default) | "retry", following the #271 on_timeout template (constant, ReviewPolicy field, parse + validation, POLICY_TEMPLATE, core.toml, OPTIONS_ENUM). Default escalate because the released behavior is the defect — it burns cycles and then discards the work; retry reproduces it verbatim for anyone who wants it back.

Deliberate scope boundaries

• Sprint-status only, never spec status. The spec's frontmatter legitimately cycles (in-review / in-progress) while a review patches; the board is orchestrator-owned truth. status: blocked remains the sanctioned reviewer hand-back channel and pauses before this gate — no overlap.
• No review-prompt change. Prohibiting the revert would make a correct reviewer comply, and the story would commit without sign-off. The contradiction would become invisible rather than resolved — strictly worse than the livelock.
• Conservative on every uncertainty. No launch flag, a missing board entry (None), or a token outside STATUS_ORDER (hand-edited or future board) all fall back to the legacy retry. A wrong escalation halts an otherwise healthy run.
• No changes to escalation.py, resolve.py, sweep.py, stories_engine.py, or the TUI. The journal keeps the review-verify-failed kind and only gains a contradiction= field, so the TUI's substring colorizer is unaffected.

Known limitation (documented, out of scope)

A review that regresses both the spec status and the sprint board never reaches _verify_review — the loop's status == "done" gate at engine.py:1462 short-circuits first — so it still lands in the non-terminal-status exhaustion defer.

Tests

test_policy.py (default / parse / invalid / template), test_verify.py ×4 (escalates · retry-mode legacy · no launch flag · missing-or-unknown token), test_engine.py ×4 (sign-off regression escalates in 2 scripted sessions · retry-mode 3-cycle legacy defer + rollback · a non-regression verify failure keeps its fixable-retry routing · rescue-site contradiction with max_followup_reviews=5 escalates instead of deferring).

Three ablations run before trusting them (repo rule):

Full suite 3363 passed, 24 skipped; trunk check clean; pyright@1.1.411 0 errors.