feat(merge): verify once per batch via skipVerify + verify_merges

Per-merge verify made an N-task batch pay N x ~7 min, each run testing
the same moving main. review_task/merge_task/continue_merge now take
skipVerify: the merge lands but the gate AND the Done transition are
deferred (status merged_verify_pending, task stays WaitingForReview).
The new verify_merges tool runs the list verify command once for the
explicitly listed tasks and promotes them to Done on success - explicit
ids so the handler own submitted task and parked verify_failed tasks
are never swept up; an Active worktree is refused per entry.

PlanningMergeOrchestrator threads the flag through the unit merge (no
more per-child verify) and skips FinalizeParentDoneAsync when verifies
were deferred. The merge-helper Merge prompt approves with
skipVerify=true and calls verify_merges once after the last merge. UI
approve is unchanged; the no-Done-without-green-verify invariant stays
server-enforced.

src/ClaudeDo.Data/PromptFiles.cs

@@ -508,9 +508,8 @@ public static class PromptFiles
         1. Never read a task's diff yourself. Instead start a sonnet subagent (Task tool) per task to inspect get_task_diff and sanity-check it against the task's title and description; only its short verdict (clean / risky + reason) comes back into your own context. If preview_merge_set flagged this task in an overlap, tell the subagent to also skim the diff of the other task(s) sharing that file.
         2. Before approving, cross-check changedFileCount from preview_merge_set (or the length of get_task_diff's files list — the diff tool has no changedFileCount field). 0 changed files means an empty branch, not a clean success — do not approve it; treat it like a risky diff instead.
         3. If the subagent's verdict is risky, or the change looks wrong or incomplete, STOP and ask the user before merging — offer reject_rerun (with feedback) or skip.
-        4. Otherwise merge with review_task(taskId, decision="approve", leaveConflictsInTree=true).
-           - Clean merge, verify gate passes (or no verify command is set) → the task is Done; move on.
-           - Clean merge, verify gate fails → the merge stands, but the Done transition is deliberately withheld. Report this task as merged-but-not-Done and move on — do NOT try to fix the verify failure yourself; that is separate follow-up work.
+        4. Otherwise merge with review_task(taskId, decision="approve", leaveConflictsInTree=true, skipVerify=true). skipVerify defers the list's verify command to ONE verify_merges call after the last merge (below) instead of paying it per merge.
+           - Clean merge → mergeStatus "merged_verify_pending" (expected: the task deliberately stays WaitingForReview until verify_merges passes) or "merged" (list has no verify command; the task is Done). Either way, move on.
            - Conflict (markers left in the working tree, repoPath returned) → resolve it below.
 
         After each merge, main has moved — a clean preview_merge_set result from before this merge is now stale for the remaining tasks. If you are unsure whether an earlier overlap warning still matters, call preview_merge for the next task again before merging it.
@@ -518,12 +517,19 @@ public static class PromptFiles
         Every branch in this run forked from the same base, so conflicts between them are the NORMAL case, not a failure. Resolve them and keep going; do not abandon the run because a merge conflicted.
 
         Resolving a conflict — do this yourself, never via a subagent, since every subagent would share this session's same main checkout:
-        - Open each conflicted file under repoPath (Read/Edit) and resolve the <<<<<<< ======= >>>>>>> markers, guided by BOTH sides' intent. Then call continue_merge(taskId). If markers remain it tells you — fix and call again. Use abort_merge(taskId) to cancel a merge you cannot safely resolve.
+        - Open each conflicted file under repoPath (Read/Edit) and resolve the <<<<<<< ======= >>>>>>> markers, guided by BOTH sides' intent. Then call continue_merge(taskId, skipVerify=true). If markers remain it tells you — fix and call again. Use abort_merge(taskId) to cancel a merge you cannot safely resolve.
         - For a task WITH children (a unit merge), pass the PARENT task id to continue_merge / abort_merge.
         - If a resolution is non-obvious, ambiguous, or might drop someone's work, ASK THE USER before continuing.
         - Prefer the MCP tools whenever they apply. Only if the MCP tools cannot reach an in-progress merge may you finish it by hand: resolve the markers, then `git add -- <the resolved paths>` and `git commit` — NEVER `git add -A` or a bare commit, because the checkout is shared with other sessions.
         - Never use raw `git merge`, `git reset`, or `git checkout` to force a merge. Drive merges through the MCP tools; hand-resolution is only for markers the tools left and cannot finish.
 
+        ## Verify once — after the last merge
+
+        When every merge above is done (including conflict resolutions), call verify_merges with the ids of ALL tasks that reported merged_verify_pending. It runs the list's verify command a single time and promotes them all to Done on success — that is the per-merge gate you skipped, paid once.
+        - verify_passed → check each entry's promoted flag; report any skipped entry with its reason.
+        - verify_failed → the merges stay in place, but every task deliberately stays out of Done. Report them as merged-but-not-Done together with the output tail — do NOT try to fix the verify failure yourself; that is separate follow-up work.
+        Skip the call only when nothing reported merged_verify_pending.
+
         ## Failed tasks — only after every merge above is done
 
         For each task that landed in Failed, read failureReason (returned by get_task/batch_get_tasks) before deciding anything — Failed is a catch-all covering an account/usage limit, a max-turns cutoff, and a genuine crash, and each deserves a different response. Never restart one blind:

src/ClaudeDo.Worker/External/ExternalMcpService.cs

@@ -674,6 +674,12 @@ public sealed class ExternalMcpService
                      "in the working tree (repoPath in the result) so you can resolve them and call continue_merge, " +
                      "or abort_merge to cancel.")]
         bool leaveConflictsInTree = false,
+        [Description("Batch mode for an approve: merge normally but defer the list's verify command instead of " +
+                     "running it after this one merge. The task then stays WaitingForReview with mergeStatus " +
+                     "merged_verify_pending; after the LAST merge of the batch call verify_merges once with every " +
+                     "pending task id — it runs the verify command a single time and promotes them all to Done. " +
+                     "No-op when the list has no verify command.")]
+        bool skipVerify = false,
         CancellationToken cancellationToken = default,
         IProgress<ProgressNotificationValue>? progress = null)
     {
@@ -710,7 +716,7 @@ public sealed class ExternalMcpService
                 // externallyDriven: true — this call came from an MCP session, not the UI's
                 // Approve button. A unit-merge conflict must not auto-open the in-app resolver;
                 // the driving session resolves it via continue_merge/abort_merge instead.
-                var startResult = await _planningMerge.StartAsync(taskId, targetBranch ?? "", cancellationToken, externallyDriven: true, progress);
+                var startResult = await _planningMerge.StartAsync(taskId, targetBranch ?? "", cancellationToken, externallyDriven: true, progress, skipVerify);
                 if (startResult.Status == TaskMergeService.StatusBlocked)
                     throw new InvalidOperationException(startResult.Reason ?? "approve failed");
                 mergeStatus = startResult.Status;
@@ -721,6 +727,11 @@ public sealed class ExternalMcpService
                     mergeMessage = "unit merge paused on a conflict — markers left in the working tree; " +
                         "resolve them then call continue_merge with the parent task id, or abort_merge to cancel";
                 }
+                else if (startResult.Status == TaskMergeService.StatusMergedVerifyPending)
+                {
+                    mergeMessage = "unit merged; verify deferred — the parent stays WaitingForReview until " +
+                        "verify_merges (with this parent's id) passes";
+                }
                 else if (startResult.Status != TaskMergeService.StatusMerged)
                 {
                     mergeMessage = startResult.Reason;
@@ -728,12 +739,17 @@ public sealed class ExternalMcpService
             }
             else
             {
-                var r = await _merge.ApproveAndMergeAsync(taskId, targetBranch ?? "", leaveConflictsInTree, cancellationToken, progress);
+                var r = await _merge.ApproveAndMergeAsync(taskId, targetBranch ?? "", leaveConflictsInTree, cancellationToken, progress, skipVerify);
                 if (r.Status == TaskMergeService.StatusBlocked)
                     throw new InvalidOperationException(r.ErrorMessage ?? "approve failed");
                 mergeStatus = r.Status;
                 mergeConflicts = r.ConflictFiles;
-                if (r.Status == TaskMergeService.StatusConflict)
+                if (r.Status == TaskMergeService.StatusMergedVerifyPending)
+                {
+                    mergeMessage = "merged; verify deferred — the task stays WaitingForReview until " +
+                        "verify_merges (with its id) passes";
+                }
+                else if (r.Status == TaskMergeService.StatusConflict)
                 {
                     if (leaveConflictsInTree)
                     {
@@ -992,6 +1008,9 @@ public sealed class ExternalMcpService
                      "leave the conflict markers in the working tree at repoPath (conflictsInTree=true) so you can " +
                      "resolve them there and call continue_merge, or abort_merge to cancel.")]
         bool leaveConflictsInTree = false,
+        [Description("Batch mode: defer the list's verify command instead of running it after this one merge " +
+                     "(see review_task's skipVerify). Call verify_merges once after the batch.")]
+        bool skipVerify = false,
         CancellationToken cancellationToken = default,
         IProgress<ProgressNotificationValue>? progress = null)
     {
@@ -1022,9 +1041,11 @@ public sealed class ExternalMcpService
 
         // Blank on purpose: TaskMergeService builds the conventional default message.
         var result = await _merge.MergeAsync(
-            taskId, targetBranch, removeWorktree: false, commitMessage: "", leaveConflictsInTree, cancellationToken, progress);
+            taskId, targetBranch, removeWorktree: false, commitMessage: "", leaveConflictsInTree, cancellationToken, progress, skipVerify);
 
-        if (result.Status == TaskMergeService.StatusMerged)
+        // merged_verify_pending: the branch IS merged (that's what this tool reports on) — only
+        // the task's own Done transition is deferred to verify_merges.
+        if (result.Status is TaskMergeService.StatusMerged or TaskMergeService.StatusMergedVerifyPending)
         {
             string? mergeCommit = null;
             try
@@ -1053,6 +1074,9 @@ public sealed class ExternalMcpService
         McpToolDocs.ProgressHint)]
     public async Task<MergeContinuationResultDto> ContinueMerge(
         string taskId,
+        [Description("Batch mode: defer the list's verify command (see review_task's skipVerify). Pass the same " +
+                     "value you approved with — a unit merge remembers its own flag and ignores this one.")]
+        bool skipVerify = false,
         CancellationToken cancellationToken = default,
         IProgress<ProgressNotificationValue>? progress = null)
     {
@@ -1069,9 +1093,15 @@ public sealed class ExternalMcpService
 
         if (_planningMerge.HasActiveMerge(taskId))
         {
-            await _planningMerge.ContinueAsync(taskId, cancellationToken, progress);
+            var unitResult = await _planningMerge.ContinueAsync(taskId, cancellationToken, progress);
             var parent = (await _tasks.GetByIdAsync(taskId, cancellationToken))!;
-            if (parent.Status == TaskStatus.Done)
+            if (unitResult.Status == TaskMergeService.StatusMergedVerifyPending)
+            {
+                merged = true;
+                message = "unit merged; verify deferred — the parent stays WaitingForReview until " +
+                    "verify_merges (with this parent's id) passes";
+            }
+            else if (parent.Status == TaskStatus.Done)
             {
                 merged = true;
             }
@@ -1096,11 +1126,17 @@ public sealed class ExternalMcpService
         }
         else
         {
-            var r = await _merge.ContinueMergeAsync(taskId, cancellationToken, progress);
+            var r = await _merge.ContinueMergeAsync(taskId, cancellationToken, progress, skipVerify);
             if (r.Status == TaskMergeService.StatusMerged)
             {
                 merged = true;
             }
+            else if (r.Status == TaskMergeService.StatusMergedVerifyPending)
+            {
+                merged = true;
+                message = "merged; verify deferred — the task stays WaitingForReview until " +
+                    "verify_merges (with its id) passes";
+            }
             else if (r.Status == TaskMergeService.StatusConflict)
             {
                 merged = false;
@@ -1119,6 +1155,46 @@ public sealed class ExternalMcpService
         return new MergeContinuationResultDto(merged, reloaded.Status.ToString(), conflicts, repoPath, message);
     }
 
+    [McpServerTool, Description(
+        "Run the list's verify command ONCE for a batch of merges made with skipVerify=true, then promote the " +
+        "listed tasks to Done. Call it a single time after the LAST merge of the batch instead of paying the " +
+        "verify per merge. All tasks must belong to the same list; each must be WaitingForReview with its merge " +
+        "already landed (mergeStatus merged_verify_pending). status verify_passed: check each entry's promoted " +
+        "flag (an ineligible task is skipped with a reason, the rest still promote). status verify_failed: the " +
+        "merges stay in place but NO task reaches Done; the command's output tail is in errorMessage — report it, " +
+        "don't fix it yourself. A list without a verify command promotes directly." + McpToolDocs.ProgressHint)]
+    public async Task<ListVerifyResult> VerifyMerges(
+        [Description("Every task merged with skipVerify=true in this batch (accepts #numbers or ids).")]
+        string[] taskIds,
+        CancellationToken cancellationToken = default,
+        IProgress<ProgressNotificationValue>? progress = null)
+    {
+        if (taskIds.Length == 0)
+            throw new InvalidOperationException("taskIds must not be empty.");
+        // Same rationale as review_task's first report: the verify itself reports periodically,
+        // but the wait on the per-repo merge gate before it would otherwise sit silent.
+        progress?.Report(new ProgressNotificationValue { Progress = 0, Message = "verify_merges started" });
+
+        string? listId = null;
+        var resolved = new List<string>(taskIds.Length);
+        foreach (var raw in taskIds)
+        {
+            var id = await TaskIdResolver.ResolveAsync(_tasks, raw, cancellationToken);
+            var task = await _tasks.GetByIdAsync(id, cancellationToken)
+                ?? throw new InvalidOperationException($"Task {raw} not found.");
+            listId ??= task.ListId;
+            if (task.ListId != listId)
+                throw new InvalidOperationException(
+                    "All tasks must belong to the same list — one verify command gates one repo.");
+            resolved.Add(id);
+        }
+
+        var result = await _merge.RunListVerifyAsync(listId!, resolved, cancellationToken, progress);
+        if (result.Status == TaskMergeService.StatusBlocked)
+            throw new InvalidOperationException(result.ErrorMessage ?? "verify blocked");
+        return result;
+    }
+
     [McpServerTool, Description(
         "Abort an in-progress conflicted merge, discarding the conflict markers and restoring a clean working tree. " +
         "Pass the PARENT task id to abort a parent/children unit merge. The task keeps its pre-merge status " +

src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs

@@ -49,6 +49,15 @@ public sealed record RevertResult(
     IReadOnlyList<string> ConflictFiles,
     string? ErrorMessage);
 
+// Per-task outcome of a batch verify (RunListVerifyAsync): Promoted=true means the task reached
+// Done; otherwise Reason says why it was left alone (invalid candidate, or the verify failed).
+public sealed record ListVerifyTaskOutcome(string TaskId, int Number, bool Promoted, string? Reason);
+
+public sealed record ListVerifyResult(
+    string Status,
+    IReadOnlyList<ListVerifyTaskOutcome> Tasks,
+    string? ErrorMessage);
+
 public sealed class TaskMergeService
 {
     public const string StatusMerged      = "merged";
@@ -56,6 +65,10 @@ public sealed class TaskMergeService
     public const string StatusBlocked     = "blocked";
     public const string StatusAborted     = "aborted";
     public const string StatusVerifyFailed = "verify_failed";
+    // Batch mode (skipVerify): the merge landed but the verify gate was deliberately deferred --
+    // the task stays out of Done until RunListVerifyAsync passes and promotes it.
+    public const string StatusMergedVerifyPending = "merged_verify_pending";
+    public const string StatusVerifyPassed = "verify_passed";
     public const string StatusUntrackedCollision = "untracked_collision";
 
     public const string StatusReverted       = "reverted";
@@ -361,7 +374,8 @@ public sealed class TaskMergeService
         string commitMessage,
         bool leaveConflictsInTree,
         CancellationToken ct,
-        IProgress<ProgressNotificationValue>? progress = null)
+        IProgress<ProgressNotificationValue>? progress = null,
+        bool skipVerify = false)
     {
         var (task, list, wt, verifyCommand) = await LoadMergeContextAsync(taskId, ct);
 
@@ -463,6 +477,16 @@ public sealed class TaskMergeService
             // silence here is what makes a working merge look like a dead button.
             if (!string.IsNullOrWhiteSpace(verifyCommand))
             {
+                if (skipVerify)
+                {
+                    // Batch mode: the caller defers the gate to one RunListVerifyAsync at the end.
+                    // The Done transition is withheld with it — same invariant as verify_failed.
+                    await _broadcaster.WorkerLog(
+                        $"Merged #{task.Number} \"{task.Title}\" into {targetBranch} — verify deferred to batch",
+                        WorkerLogLevel.Info, DateTime.UtcNow);
+                    return new MergeResult(StatusMergedVerifyPending, Array.Empty<string>(), cleanupWarning);
+                }
+
                 await _broadcaster.OperationProgress(taskId, PhaseVerifying, 0, 0);
                 await _broadcaster.WorkerLog(
                     $"Verify command running after merging #{task.Number} \"{task.Title}\" into {targetBranch}",
@@ -500,7 +524,8 @@ public sealed class TaskMergeService
         => MergeAsync(taskId, targetBranch, removeWorktree, commitMessage, leaveConflictsInTree: false, ct);
 
     public async Task<MergeResult> ContinueMergeAsync(
-        string taskId, CancellationToken ct, IProgress<ProgressNotificationValue>? progress = null)
+        string taskId, CancellationToken ct, IProgress<ProgressNotificationValue>? progress = null,
+        bool skipVerify = false)
     {
         var (task, list, wt, verifyCommand) = await LoadMergeContextAsync(taskId, ct);
 
@@ -566,6 +591,14 @@ public sealed class TaskMergeService
             var targetBranch = await _git.GetCurrentBranchAsync(list.WorkingDir, ct);
             await RebaseOthersAfterMergeAsync(task, list, targetBranch, oldTargetTip, mergeSha, ct);
 
+            if (!string.IsNullOrWhiteSpace(verifyCommand) && skipVerify)
+            {
+                await _broadcaster.WorkerLog(
+                    $"Merged #{task.Number} \"{task.Title}\" (conflict resolved) — verify deferred to batch",
+                    WorkerLogLevel.Info, DateTime.UtcNow);
+                return new MergeResult(StatusMergedVerifyPending, Array.Empty<string>(), null);
+            }
+
             var verifyFailure = await RunVerifyGateAsync(verifyCommand, list.WorkingDir, ct, progress);
             if (verifyFailure is not null)
             {
@@ -865,7 +898,8 @@ public sealed class TaskMergeService
 
     public async Task<MergeResult> ApproveAndMergeAsync(
         string taskId, string targetBranch, bool leaveConflictsInTree, CancellationToken ct,
-        IProgress<ProgressNotificationValue>? progress = null)
+        IProgress<ProgressNotificationValue>? progress = null,
+        bool skipVerify = false)
     {
         var (task, list, wt, verifyCommand) = await LoadMergeContextAsync(taskId, ct);
 
@@ -881,6 +915,9 @@ public sealed class TaskMergeService
             // per-repo gate as the merge path, so a concurrent merge can't land mid-verify.
             if (!string.IsNullOrWhiteSpace(verifyCommand) && !string.IsNullOrWhiteSpace(list.WorkingDir))
             {
+                if (skipVerify)
+                    return new MergeResult(StatusMergedVerifyPending, Array.Empty<string>(), null);
+
                 var verifyGate = GetMergeGate(list.WorkingDir!);
                 await _broadcaster.OperationProgress(taskId, PhaseVerifying, 0, 0);
                 await verifyGate.WaitAsync(ct);
@@ -911,7 +948,102 @@ public sealed class TaskMergeService
         // MergeAsync transitions the task WaitingForReview -> Done on a successful merge.
         // Remove the worktree on approve (matching the unit-merge path) so merged
         // worktrees don't pile up; the merge commit on the target branch is the record.
-        return await MergeAsync(taskId, target, removeWorktree: true, commitMessage: "", leaveConflictsInTree, ct, progress);
+        return await MergeAsync(taskId, target, removeWorktree: true, commitMessage: "", leaveConflictsInTree, ct, progress, skipVerify);
+    }
+
+    /// <summary>
+    /// The batch counterpart to the per-merge verify gate: runs the list's verify command ONCE
+    /// (under the same per-repo gate) and, on success, promotes every listed task to Done via
+    /// ApproveReviewAsync. Tasks were merged with skipVerify=true and sit in WaitingForReview.
+    /// A task is only eligible when its work verifiably landed: worktree state Merged, or no
+    /// worktree at all (sandbox/list-handler run) -- an Active worktree means the branch was
+    /// never merged, and promoting it would produce a Done task with an unmerged branch.
+    /// No verify command configured = no gate (same rule as everywhere else): promote directly.
+    /// </summary>
+    public async Task<ListVerifyResult> RunListVerifyAsync(
+        string listId, IReadOnlyList<string> taskIds, CancellationToken ct,
+        IProgress<ProgressNotificationValue>? progress = null)
+    {
+        if (taskIds.Count == 0)
+            return new ListVerifyResult(StatusBlocked, Array.Empty<ListVerifyTaskOutcome>(), "no task ids given");
+
+        ListEntity? list;
+        string? verifyCommand;
+        var candidates = new List<(TaskEntity Task, string? IneligibleReason)>();
+        using (var ctx = _dbFactory.CreateDbContext())
+        {
+            var listRepo = new ListRepository(ctx);
+            list = await listRepo.GetByIdAsync(listId, ct);
+            if (list is null)
+                return new ListVerifyResult(StatusBlocked, Array.Empty<ListVerifyTaskOutcome>(), $"list '{listId}' not found");
+            verifyCommand = (await listRepo.GetConfigAsync(listId, ct))?.VerifyCommand;
+
+            var taskRepo = new TaskRepository(ctx);
+            var wtRepo = new WorktreeRepository(ctx);
+            foreach (var id in taskIds.Distinct(StringComparer.OrdinalIgnoreCase))
+            {
+                var task = await taskRepo.GetByIdAsync(id, ct);
+                if (task is null)
+                    return new ListVerifyResult(StatusBlocked, Array.Empty<ListVerifyTaskOutcome>(), $"task '{id}' not found");
+                var reason = task.ListId != list.Id ? "task belongs to a different list"
+                    : task.Status != TaskStatus.WaitingForReview ? $"task is {task.Status}, not WaitingForReview"
+                    : (await wtRepo.GetByTaskIdAsync(task.Id, ct)) is { } wt && wt.State != WorktreeState.Merged
+                        ? $"worktree state is {wt.State}, not Merged — its branch never landed"
+                        : null;
+                candidates.Add((task, reason));
+            }
+        }
+
+        if (string.IsNullOrWhiteSpace(list.WorkingDir))
+            return new ListVerifyResult(StatusBlocked, Array.Empty<ListVerifyTaskOutcome>(), "list has no working directory");
+
+        if (!string.IsNullOrWhiteSpace(verifyCommand))
+        {
+            var gate = GetMergeGate(list.WorkingDir);
+            await _broadcaster.OperationProgress(listId, PhaseVerifying, 0, 0);
+            await gate.WaitAsync(ct);
+            MergeResult? failure;
+            try
+            {
+                await _broadcaster.WorkerLog(
+                    $"Batch verify running for {candidates.Count} merged task(s) in \"{list.Name}\"",
+                    WorkerLogLevel.Info, DateTime.UtcNow);
+                failure = await RunVerifyGateAsync(
+                    verifyCommand, list.WorkingDir, ct, progress,
+                    elapsed => _ = _broadcaster.OperationProgress(listId, PhaseVerifying, (int)elapsed.TotalSeconds, 0));
+            }
+            finally { gate.Release(); }
+
+            if (failure is not null)
+            {
+                await _broadcaster.WorkerLog(
+                    $"Batch verify failed in \"{list.Name}\" — {candidates.Count} task(s) stay out of Done",
+                    WorkerLogLevel.Warn, DateTime.UtcNow);
+                var failed = candidates
+                    .Select(c => new ListVerifyTaskOutcome(c.Task.Id, c.Task.Number, false,
+                        c.IneligibleReason ?? "verify failed"))
+                    .ToList();
+                return new ListVerifyResult(StatusVerifyFailed, failed, failure.ErrorMessage);
+            }
+        }
+
+        var outcomes = new List<ListVerifyTaskOutcome>(candidates.Count);
+        foreach (var (task, ineligibleReason) in candidates)
+        {
+            if (ineligibleReason is not null)
+            {
+                outcomes.Add(new ListVerifyTaskOutcome(task.Id, task.Number, false, ineligibleReason));
+                continue;
+            }
+            var result = await _state.ApproveReviewAsync(task.Id, ct);
+            outcomes.Add(new ListVerifyTaskOutcome(task.Id, task.Number, result.Ok, result.Ok ? null : result.Reason));
+        }
+
+        var promoted = outcomes.Count(o => o.Promoted);
+        await _broadcaster.WorkerLog(
+            $"Batch verify passed in \"{list.Name}\" — {promoted} task(s) promoted to Done",
+            WorkerLogLevel.Success, DateTime.UtcNow);
+        return new ListVerifyResult(StatusVerifyPassed, outcomes, null);
     }
 
     private static MergeResult Blocked(string reason) =>

src/ClaudeDo.Worker/Planning/PlanningMergeOrchestrator.cs

@@ -44,6 +44,13 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
         /// from a running Claude session) rather than a direct UI action. Conflicts on such a
         /// merge must not auto-pop the in-app resolver — the driving session owns resolution.</summary>
         public required bool ExternallyDriven { get; init; }
+        /// <summary>Batch mode: every child merge defers the verify gate, and the parent is NOT
+        /// finalized to Done — a later RunListVerifyAsync (verify_merges) runs the gate once and
+        /// promotes it. Only meaningful when the list has a verify command at all.</summary>
+        public required bool SkipVerify { get; init; }
+        /// <summary>Set when any child merge came back merged_verify_pending — the drain must then
+        /// end without finalizing the parent.</summary>
+        public bool AnyVerifyPending { get; set; }
         public string? CurrentSubtaskId { get; set; }
         /// <summary>True from the moment the last child has merged until FinalizeParentDoneAsync
         /// returns. CurrentSubtaskId is already null in this window (no subtask left to merge),
@@ -75,7 +82,7 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
 
     public async Task<PlanningMergeResult> StartAsync(
         string parentTaskId, string targetBranch, CancellationToken ct, bool externallyDriven = false,
-        IProgress<ProgressNotificationValue>? progress = null)
+        IProgress<ProgressNotificationValue>? progress = null, bool skipVerify = false)
     {
         string workingDir;
         List<TaskEntity> children;
@@ -143,6 +150,7 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
             IsPlanning = isPlanning,
             WorkingDir = workingDir,
             ExternallyDriven = externallyDriven,
+            SkipVerify = skipVerify,
         };
         if (!_states.TryAdd(parentTaskId, state))
             throw new InvalidOperationException($"Merge already in progress for {parentTaskId}.");
@@ -181,7 +189,7 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
                 "no in-progress merge to continue; if the worker was restarted during a conflict, use AbortPlanningMerge to reset the repository");
 
         var current = state.CurrentSubtaskId;
-        var result = await _merge.ContinueMergeAsync(current, ct, progress);
+        var result = await _merge.ContinueMergeAsync(current, ct, progress, state.SkipVerify);
 
         if (result.Status == TaskMergeService.StatusConflict)
         {
@@ -189,7 +197,11 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
             return PlanningMergeResult.Conflict;
         }
 
-        if (result.Status != TaskMergeService.StatusMerged)
+        if (result.Status == TaskMergeService.StatusMergedVerifyPending)
+        {
+            state.AnyVerifyPending = true;
+        }
+        else if (result.Status != TaskMergeService.StatusMerged)
         {
             _logger.LogWarning(
                 "Planning continue blocked on subtask {Subtask}: {Msg}",
@@ -262,7 +274,8 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
                     commitMessage: "",   // blank -> TaskMergeService builds the conventional default
                     leaveConflictsInTree: true,
                     ct,
-                    progress);
+                    progress,
+                    state.SkipVerify);
 
                 if (result.Status == TaskMergeService.StatusConflict)
                 {
@@ -272,7 +285,11 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
                     return PlanningMergeResult.Conflict;
                 }
 
-                if (result.Status != TaskMergeService.StatusMerged)
+                if (result.Status == TaskMergeService.StatusMergedVerifyPending)
+                {
+                    state.AnyVerifyPending = true;
+                }
+                else if (result.Status != TaskMergeService.StatusMerged)
                 {
                     _logger.LogWarning(
                         "Planning merge blocked on subtask {Subtask}: {Msg}",
@@ -284,10 +301,21 @@ public sealed class PlanningMergeOrchestrator : IActiveMergeState
                 await _broadcaster.PlanningSubtaskMerged(planningTaskId, subtaskId);
             }
 
+            state.CurrentSubtaskId = null;
+
+            // Batch mode with deferred verifies: the parent must NOT be finalized to Done here --
+            // that would grant a Done no verify ever gated. It stays WaitingForReview until the
+            // caller's verify_merges passes and promotes it. PlanningCompleted still fires: the
+            // drain itself IS complete, and the UI needs its draining banner cleared.
+            if (state.AnyVerifyPending)
+            {
+                await _broadcaster.PlanningCompleted(planningTaskId);
+                return new PlanningMergeResult(TaskMergeService.StatusMergedVerifyPending, null);
+            }
+
             // No subtask left to merge, but the parent isn't Done yet -- HasActiveMerge must keep
             // reporting true through this window (CurrentSubtaskId is already null) so a Cancel
             // racing FinalizeParentDoneAsync's ApproveReviewAsync call is still refused.
-            state.CurrentSubtaskId = null;
             state.IsFinalizing = true;
             var (finalized, reason) = await FinalizeParentDoneAsync(planningTaskId, state.IsPlanning, ct);
             if (finalized)