muse-crew 0.4.3 → 0.4.5

package/workflows/crew-init.js

@@ -145,39 +145,6 @@ try {
 }
 log("Project: " + (projectResult.registered ? "registered" : "failed"));
 
-// ── Phase 3b: Set the dashboard's project as the default ─────────────
-// The CLI takes the project implicitly from the dashboard's configured
-// default (config.default_project). Idempotent: setdefaultproject upserts.
-phase("default-project");
-var defaultProjectResult;
-try {
-  defaultProjectResult = await agent(
-    "Set the dashboard's default project to the dashboard itself.\\n\\n" +
-    "Dashboard slug: " + dashboardSlug + "\\n\\n" +
-    "Steps:\\n" +
-    "1. Call artifact_invoke_action with:\\n" +
-    "   slug: '" + dashboardSlug + "'\\n" +
-    "   action_name: 'setdefaultproject'\\n" +
-    "   args: { project_id: '" + dashboardSlug + "' }\\n" +
-    "2. Return { defaulted: true } on success.\\n\\n" +
-    "Return JSON with defaulted (boolean).",
-    {
-      key: "project-2",
-      label: "Set default project",
-      schema: {
-        type: "object",
-        properties: {
-          defaulted: { type: "boolean" }
-        },
-        required: ["defaulted"]
-      }
-    }
-  );
-} catch (e) {
-  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Default project could not be set", message: String(e.message || e) } };
-}
-log("Default project: " + (defaultProjectResult.defaulted ? "set" : "failed"));
-
 // ── Phase 4: Polling cron ─────────────────────────────────────────────
 // The cron body template lives in the repo at seed/cron-body-template.md.
 // Placeholders: {crewHome}, {dashboardSlug} are replaced with actual values.
@@ -252,8 +219,10 @@ try {
     "---\n" +
     "## Muse Crew Orphan Sweep\n\n" +
     "1. Call artifact_invoke_action on slug \"" + dashboardSlug + "\", action \"getdispatchstate\", args {}.\n" +
-    "2. Collect the task IDs of every entry in ready_tasks whose latest_session.status is \"running\".\n" +
-    "   (Sessions older than 1h are already reclassified as timed_out by the dashboard — no extra math.)\n" +
+    "2. From the response, extract the `id` field of each `ready_tasks` entry whose\n" +
+    "   latest_session.status is \"running\", verbatim — copy the full ID exactly\n" +
+    "   as it appears; do not shorten, truncate, or reformat it. Return them as a\n" +
+    "   JSON array of strings. Do NOT reproduce any other part of the response.\n" +
     "3. Run: CREW_ACTIVE_TASKS=\"<space-separated ids>\" " + crewHome + "/lib/orphan-sweep.sh clean\n" +
     "   If the list is empty, pass an empty string — do NOT omit the variable (the sweep fails closed without it).\n" +
     "4. Report the output. If it says CLEAN, no action was needed.\n" +

package/workflows/docs.js

@@ -14,7 +14,6 @@ const inputs = args ?? {};
 const taskId = inputs.task_id;
 const taskTitle = inputs.task_title || "";
 const taskDescription = inputs.task_description || "";
-const firstSessionId = inputs.session_id || null;
 const startStepIndex = inputs.start_step_index || 0;
 
 // Config from args — backward-compatible fallbacks for manual launches
@@ -46,6 +45,33 @@ const REWORK_STEP = STEPS[WRITE_INDEX].name;
 const MAX_REWORK = 2;
 let reworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
+// Park the task for human attention and end the run. "blocked" is never
+// manually authored — the dashboard derives it mechanically from unmet
+// dependencies — so a workflow outcome that needs a human parks the task
+// instead. Parking is one atomic dashboard action (parktask): the parked
+// state and the explanatory note land in one transaction, never half.
+// The dispatcher skips parked tasks; a human moving parked→todo
+// mechanically resets the retry counters. Returns the workflow result
+// envelope the launcher sees. If the park call itself fails, the run
+// reports "failed" (retryable) so the next tick re-attempts the park —
+// a lost park is never reported as parked.
+async function parkTask(reason) {
+  log("Parking task " + taskId + " for human attention: " + reason);
+  var parkMessage = ("Parked: " + reason).slice(0, 1000);
+  try {
+    await agent(
+      "Park this task for human attention.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"parktask\", args: " +
+      JSON.stringify({ task_id: taskId, message: parkMessage }) + ".\n" +
+      "The parked state is the human-attention signal — the dispatcher skips parked tasks.",
+      { key: "park-task", label: "Parking task for human attention", schema: { type: "object" } }
+    );
+  } catch (parkErr) {
+    log("PARK FAILED for task " + taskId + ": " + (parkErr && parkErr.message ? parkErr.message : parkErr) + " — park did not land, reporting failed so the next tick retries");
+    return { status: "failed", task_id: taskId, reason: "park failed: " + reason, park_failed: true };
+  }
+  return { status: "parked", task_id: taskId, reason: reason };
+}
 let i = startStepIndex;
 
 while (i < STEPS.length) {
@@ -77,11 +103,10 @@ while (i < STEPS.length) {
     if (currentProject !== LAUNCH_PROJECT_ID) {
       const abortMessage = "Task project changed mid-run from '" + LAUNCH_PROJECT_ID + "' to '" + currentProject + "' — aborting stale run. The dispatcher will re-launch from " + REWORK_STEP + " with the new project context.";
       log(abortMessage);
-      const abortSessionPatch = (isFirstClaim && firstSessionId) ? "\"id\": \"" + firstSessionId + "\", " : "";
       await agent(
         "Abort the stale run.\n" +
         "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
-        "{ \"task_id\": \"" + taskId + "\", " + abortSessionPatch + "\"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
+        "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
         "\"notes\": " + JSON.stringify(abortMessage) + " }.\n" +
         "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
         "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"identity\": \"" + step.identity + "\", \"message\": " + JSON.stringify(abortMessage) + " }.",
@@ -91,9 +116,35 @@ while (i < STEPS.length) {
     }
   }
 
+  // Self-claim — the dispatcher only recommends; the launched workflow claims
+  // the task as its first action, so a claim can never exist without a launched
+  // agent behind it. If another run claimed the task first (two poll ticks
+  // raced in the window before this run's claim), claimtask returns
+  // claimed:false and this run stands down as a duplicate.
   let activeSessionId;
-  if (isFirstClaim && firstSessionId) {
-    activeSessionId = firstSessionId;
+  if (isFirstClaim) {
+    const claimResult = await agent(
+      "Claim this task for the " + step.name + " step.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\" }.\n" +
+      "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"claimtask\", args:\n" +
+      "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"notes\": \"" + step.name + " step started\" }.\n" +
+      "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
+      "Return { claimed: <verbatim>, session_id: \"<...>\" }. If claimed is false there is no session_id; return { claimed: false, session_id: \"\" }.",
+      {
+        key: "claim-" + step.name,
+        label: "Claiming " + step.name,
+        schema: {
+          type: "object",
+          properties: { claimed: { type: "boolean" }, session_id: { type: "string" } },
+          required: ["claimed", "session_id"]
+        }
+      }
+    );
+    if (!claimResult.claimed) {
+      log("Standing down — task " + taskId + " was already claimed by another run");
+      return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
+    }
+    activeSessionId = claimResult.session_id;
   } else {
     const claimResult = await agent(
       "Claim a session for this task step.\n" +
@@ -113,36 +164,305 @@ while (i < STEPS.length) {
     activeSessionId = claimResult.session_id;
   }
 
+  // Closeout is deterministic: the work agent returns the runtime's native
+  // transport envelope {"status": "ok", "result": "<prose report>"} with no
+  // schema, so the workflow receives the report as a plain string. There is
+  // no {"report"} wrapper: that invented shape invited agents to improvise
+  // sibling keys (notably "status"), which the runtime duck-types as its own
+  // envelope and fatally misparses. The envelope is the runtime's own
+  // documented shape — not a demand for machine-structured reasoning.
+  // The verdict is extracted mechanically by extractVerdict — never by an
+  // agent. The summary is the worker's report truncated. No formatter agent:
+  // it added a failure mode while contributing nothing the workflow doesn't
+  // compute itself.
+  const VERDICT_STEPS = ["Review"];
+  // The Review verdict is extracted DETERMINISTICALLY by workflow code —
+  // never by an agent. A missing, malformed, or contradictory VERDICT line
+  // first gets a bounded mechanical re-ask (reaskVerdict); only if that is
+  // exhausted does the phase fail closed (blocked): an ambiguous verdict
+  // must never pass.
+  function extractVerdict(workerText) {
+    // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
+    // your report with the verdict). This ignores literal VERDICT strings echoed
+    // from the worker's instructions (which contain quoted examples). Fail
+    // closed if: no verdict found, the last verdict is not in the trailing 100
+    // chars (verdict must be at the end), or conflicting verdicts appear in the
+    // trailing 200 chars. Word boundary prevents "PASSING" matching as PASS.
+    var text = workerText || "";
+    var regex = /VERDICT:\s*(PASS|FAIL)\b/gi;
+    var matches = [];
+    var m;
+    while ((m = regex.exec(text)) !== null) {
+      matches.push({ value: /FAIL/i.test(m[0]) ? "FAIL" : "PASS", index: m.index });
+    }
+    if (matches.length === 0) return { ok: false, count: 0 };
+    var last = matches[matches.length - 1];
+    if (last.index < text.length - 100) return { ok: false, count: matches.length };
+    var trailing = matches.filter(function (x) { return x.index >= text.length - 200; });
+    var uniq = trailing.map(function (x) { return x.value; }).filter(function (v, i, a) { return a.indexOf(v) === i; });
+    if (uniq.length !== 1) return { ok: false, count: matches.length };
+    return { ok: true, passed: last.value === "PASS" };
+  }
+  // Verdict re-ask (bug cd18ccc2): a verdict-step report that fails
+  // extractVerdict is not failed immediately. Stochastic verdict-line
+  // non-compliance (the agent did the work but omitted or garbled the VERDICT
+  // line) gets up to two bounded follow-up agent() calls whose only job is to
+  // read the preserved report and emit exactly one VERDICT line. The verdict
+  // is still extracted mechanically by extractVerdict — the re-ask agent
+  // transcribes, never decides the phase outcome. Each attempt uses a fresh
+  // stable-key suffix so a cached failure can never replay deterministically.
+  // Exhaustion keeps the existing fail-closed behavior. This is structure, not
+  // prompt hardening: no instruction text was stern-ified to get here.
+  function verdictReaskKey(stepName, reworkSuffix, attempt) {
+    return "verdict-reask-" + stepName + reworkSuffix + "-a" + attempt;
+  }
+  function buildVerdictReaskPrompt(stepName, workerText) {
+    return "Mechanical transcription task. Read the work report below and emit its verdict.\n\n" +
+      "WORK REPORT (verbatim):\n" + workerText + "\n\n" +
+      "Decide from the report's own content whether the " + stepName + " step clearly describes successful completion: " +
+      "if it does, the verdict is PASS; otherwise — failure, error, unfinished work, or unclear — the verdict is FAIL. " +
+      "Do NOT copy any VERDICT line from the report — decide from the content.\n\n" +
+      "Return your work as JSON in exactly this shape: {\"status\": \"ok\", \"result\": \"your verdict line here\"}. " +
+      "The result must be exactly one line and nothing else: VERDICT: PASS or VERDICT: FAIL.";
+  }
+  async function reaskVerdict(stepName, reworkSuffix, workerText) {
+    var verdict = { ok: false, count: 0 };
+    for (var attempt = 1; attempt <= 2; attempt++) {
+      var reaskResult = null;
+      try {
+        reaskResult = await agent(buildVerdictReaskPrompt(stepName, workerText), {
+          key: verdictReaskKey(stepName, reworkSuffix, attempt),
+          label: "Verdict re-ask: " + stepName + " (attempt " + attempt + " of 2)",
+          timeoutMs: 180000
+        });
+      } catch (e) {
+        log(stepName + " verdict re-ask attempt " + attempt + " errored: " + ((e && e.message ? e.message : String(e)) || "").slice(0, 200));
+        continue;
+      }
+      var reaskText = (typeof reaskResult === "string") ? reaskResult : "";
+      verdict = extractVerdict(reaskText);
+      if (verdict.ok) {
+        log(stepName + " verdict re-ask attempt " + attempt + " recovered verdict: " + (verdict.passed ? "PASS" : "FAIL"));
+        return verdict;
+      }
+      log(stepName + " verdict re-ask attempt " + attempt + " produced no readable verdict (" + verdict.count + " trailing-window matches)");
+    }
+    return verdict;
+  }
+  // Transport retry: the work-agent agent() call can throw even when the agent
+  // did the work. Stochastic envelope non-compliance (bare prose instead of
+  // the native {"status":"ok","result":"..."} envelope) trips the runtime's
+  // JSON-candidate heuristic when the prose contains a {...}-looking
+  // substring — canary 39457ee9's QA report quoted the change's own
+  // {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
+  // and the workflow discarded a complete VERDICT: PASS report as "no output".
+  // The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
+  // this covers the report never arriving. The assignment is retried boundedly
+  // with fresh keys (never a cached replay) before failing closed. Re-entry is
+  // safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
+  // retry trailer tells the agent to check existing state first and report
+  // rather than duplicate completed side effects, and the rework path already
+  // re-runs Build after rejection — Build re-entry is an established pattern.
+  function workRetryKey(stepName, reworkSuffix, attempt) {
+    return "work-" + stepName + reworkSuffix + "-t" + attempt;
+  }
+  function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
+    // reason: "discarded" (the runtime threw the output away — it could not be
+    // machine-read) or "empty" (agent() returned without throwing but produced
+    // nothing usable). The trailer tells the retry what to expect, not just to
+    // try again.
+    var why = reason === "empty"
+      ? "your previous attempt returned no usable output"
+      : "your previous attempt's output could not be machine-read as JSON and was discarded";
+    return "\n\nTRANSPORT RETRY (attempt " + attempt + " of 2): " + why + ". " +
+      "First check existing state (worktree/branch at " + repoPath + "/.worktrees/" + taskId + ", the task branch, dashboard sessions for this task) — " +
+      "if the " + stepName + " work is already complete, report on what was done rather than duplicating side effects. " +
+      "Then return your report as JSON in exactly the shape specified above.";
+  }
+  function describeWorkAgentFailure(stepName, identity, attempts) {
+    // Honest classification of a work-agent call that yielded no usable
+    // report, with the per-attempt evidence preserved in the session notes.
+    // Two distinct cases:
+    // - agent() THREW: the runtime discarded output it could not machine-read
+    //   (e.g. prose tripping the JSON-candidate heuristic). The raw output is
+    //   gone — the workflow never received it — so the surviving error text is
+    //   recorded here instead. (An earlier comment claimed the raw output was
+    //   "preserved in the run record"; that was false — nothing preserved it —
+    //   and the claim is removed.)
+    // - agent() RETURNED EMPTY without throwing: the child produced nothing
+    //   usable. Each attempt's outcome is the evidence.
+    // attempts: [{threw, error, outcome}, ...], in order.
+    var parts = [];
+    for (var i = 0; i < attempts.length; i++) {
+      var a = attempts[i];
+      parts.push("attempt " + (i + 1) + "/" + attempts.length + ": " +
+        (a.threw ? "threw '" + a.error + "'" : "returned " + a.outcome));
+    }
+    var detail = parts.join("; ").replace(/"/g, "'").slice(0, 400);
+    var anyThrow = false;
+    for (var j = 0; j < attempts.length; j++) {
+      if (attempts[j].threw) { anyThrow = true; break; }
+    }
+    if (anyThrow) {
+      return {
+        notes: "Work agent produced no machine-readable report after " + attempts.length + " attempts; runtime discarded the output (" + detail + ")",
+        eventMessage: stepName + " work agent produced no machine-readable report after " + attempts.length + " attempts — phase failed, dispatcher will retry",
+        blockedReason: stepName + " work agent produced no machine-readable report after " + attempts.length + " attempts",
+        message: "The " + identity + " agent's output could not be machine-read (" + attempts.length + " attempts exhausted); the runtime discarded the raw output before the workflow could see it. Surviving evidence: " + detail
+      };
+    }
+    return {
+      notes: "Work agent returned no usable output after " + attempts.length + " attempts (" + detail + ")",
+      eventMessage: stepName + " work agent returned no usable output after " + attempts.length + " attempts — phase failed, dispatcher will retry",
+      blockedReason: stepName + " work agent returned no usable output",
+      message: "The " + identity + " agent returned no usable output after " + attempts.length + " attempts (" + detail + ")."
+    };
+  }
+
+  // Marker line preservation: machine-readable VERDICT: lines are extracted
+  // from the full worker report and appended after the summary slice.
+  function extractMarkerLines(workerText) {
+    var lines = (workerText || "").split("\n");
+    var markers = [];
+    for (var i = 0; i < lines.length; i++) {
+      var line = lines[i].trim();
+      if (/^VERDICT:/i.test(line)) {
+        markers.push(line);
+      }
+    }
+    return markers.join("\n");
+  }
+
   var instructions = "";
   if (step.name === "Triage") {
-    instructions = "Validate the task, check clarity, confirm the docs workflow assignment.\nYour final response MUST be valid JSON and nothing else: { \"summary\": \"your assessment\", \"passed\": true }. No prose, no markdown, just the JSON object.";
+    instructions = "Validate the task, check clarity, confirm the docs workflow assignment.\nReport back in plain prose — your assessment.";
   } else if (step.name === "Write") {
     instructions = "Write or revise the documentation the task asks for.\nFollow Tate's voice — clear, conversational, no jargon unless it earns its place.\nDo your work in the project repository at " + REPO_PATH + " — all doc files go there, not under the crew home." +
       (rejectionNotes ? "\n\nREWORK after review rejection. Address:\n" + rejectionNotes : "") +
-      "\nYour final response MUST be valid JSON and nothing else: { \"summary\": \"what you wrote and where\", \"passed\": true }. No prose, no markdown, just the JSON object.";
+      "\nReport back in plain prose — what you wrote and where.";
   } else if (step.name === "Review") {
-    instructions = "Review the docs independently and cold — clarity, accuracy, completeness.\nNo prior context from the writer.\nIf it passes, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"approval notes\" }.\nIf it fails, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"rejection notes\" }.\nNo prose, no markdown, just the JSON object.";
+    instructions = "Review the docs independently and cold — clarity, accuracy, completeness.\nNo prior context from the writer.\nWrite your review as plain prose — findings, then decision. End your report with exactly one line: VERDICT: PASS if it passes, VERDICT: FAIL if it fails.";
   }
 
-  const stepResult = await agent(
+  // Work agent returns the runtime's native envelope {"status": "ok",
+  // "result": "<prose>"} with no schema. The runtime requires JSON output;
+  // the envelope is its own documented shape, so there is nothing for the
+  // agent to improvise. The workflow receives the prose report as a plain
+  // string. The verdict is still extracted deterministically from the report
+  // text by extractVerdict below — never by an agent.
+  var workPromptBase =
     "Read the identity file at " + ORCH_PATH + "/identities/" + step.identity + ".md using the read tool, and embody that character fully.\n\n" +
     "## Your Assignment\n\n" +
     "Task: " + taskTitle + "\nTask ID: " + taskId + "\nDescription: " + taskDescription + "\nStep: " + step.name + "\nDashboard slug: " + DASHBOARD_SLUG + "\n\n" +
-    "## Instructions\n\n" + instructions + "\n\nCONSTRAINT: Do NOT call logevent or upsertagentsession — the workflow handles all phase tracking after your step completes.\n\nStay in character. All file work under " + REPO_PATH + "/.",
-    {
-      key: "work-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : ""),
-      label: step.identity + ": " + step.name + " on \"" + taskTitle + "\"",
-      timeoutMs: 3600000,
-      schema: {
-        type: "object",
-        properties: { passed: { type: "boolean" }, summary: { type: "string" } },
-        required: ["summary"]
+    "## Instructions\n\n" + instructions + "\n\nCONSTRAINT: Do NOT call logevent or upsertagentsession — the workflow handles all phase tracking after your step completes.\n\nStay in character. All file work under " + REPO_PATH + "/.\n\n" +
+    "Return your work as JSON in exactly this shape: {\"status\": \"ok\", \"result\": \"your report here\"}. " +
+    "The result is plain prose describing what you did and found. For verdict steps, end the report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
+  var workKeyBase = "work-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "");
+  var workerResult = null;
+  var workAttempts = [];
+  for (var workAttempt = 0; workAttempt <= 2; workAttempt++) {
+    var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workAttempt);
+    var retryReason = workAttempt === 0 ? null : (workAttempts[workAttempt - 1].threw ? "discarded" : "empty");
+    try {
+      workerResult = await agent(
+        workPromptBase + (workAttempt === 0 ? "" : buildTransportRetryTrailer(step.name, REPO_PATH, taskId, workAttempt, retryReason)),
+        {
+          key: workKey,
+          label: step.identity + ": " + step.name + " on \"" + taskTitle + "\"" + (workAttempt === 0 ? "" : " (transport retry " + workAttempt + " of 2)"),
+          timeoutMs: 3600000
+        }
+      );
+      // Success path: a non-blank string report is usable — keep it and stop
+      // retrying. Without this branch every attempt is discarded and the phase
+      // always fails (regression shipped in ecef136 when Date.now() was
+      // removed from this loop).
+      if (typeof workerResult === "string" && workerResult.trim()) {
+        if (workAttempt > 0) log(step.name + " work agent transport retry " + workAttempt + " returned a machine-readable report");
+        break;
       }
+      var emptyOutcome = workerResult === null ? "null" : (typeof workerResult === "string" ? "blank string" : typeof workerResult);
+      workAttempts.push({ threw: false, error: "", outcome: emptyOutcome });
+      log(step.name + " work agent attempt " + (workAttempt + 1) + " of 3 returned no usable output (" + emptyOutcome + ") — retrying with a fresh key");
+      workerResult = null;
+    } catch (e) {
+      var attemptErr = (e && e.message ? e.message : String(e)).replace(/"/g, "'").slice(0, 160);
+      workAttempts.push({ threw: true, error: attemptErr, outcome: "" });
+      log(step.name + " work agent attempt " + (workAttempt + 1) + " of 3 threw: " + attemptErr);
+      workerResult = null;
     }
-  );
+  }
+  // The report arrives as a plain string — the runtime unwraps the envelope.
+  var workerText = (typeof workerResult === "string") ? workerResult : null;
+
+  if (typeof workerText !== "string" || !workerText.trim()) {
+    var workFailure = describeWorkAgentFailure(step.name, step.identity, workAttempts);
+    log(step.name + " " + workFailure.notes + " — marking failed for retry");
+    await agent(
+      "Record work failure.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+      "{ \"id\": \"" + activeSessionId + "\", \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"status\": \"failed\", \"notes\": \"" + workFailure.notes + "\" }.\n" +
+      "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+      "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"message\": \"" + workFailure.eventMessage + "\" }.",
+      { key: "record-block-" + step.name, label: "Recording work failure", schema: { type: "object" } }
+    );
+    return {
+      __hatchWorkflowControl: "blocked",
+      result: {
+        blocked_reason: workFailure.blockedReason,
+        message: workFailure.message,
+        task_id: taskId
+      }
+    };
+  }
+  // Verdict derivation (deterministic): for Review the workflow owns the
+  // verdict — extracted by regex from the trailing window from the worker's own report.
+  // A missing, malformed, or contradictory VERDICT line fails the phase (never silently passes).
+  // The session is marked "failed", NOT "blocked": the dispatcher retries
+  // failed sessions at the same step, while a "blocked" session is never
+  // picked up again (blocked is reserved for unmet dependencies).
+  var verdictPassed = null;
+  if (VERDICT_STEPS.indexOf(step.name) >= 0) {
+    var verdict = extractVerdict(workerText);
+    if (!verdict.ok) {
+      // Bounded mechanical re-ask before failing the phase: the report may
+      // be valid with a stochastically omitted or garbled verdict line.
+      log(step.name + " verdict line missing or ambiguous (" + verdict.count + " trailing-window matches) — attempting bounded re-ask");
+      verdict = await reaskVerdict(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workerText);
+    }
+    if (!verdict.ok) {
+      log(step.name + " verdict re-ask exhausted — marking failed for retry");
+      await agent(
+        "Record verdict failure.\n" +
+        "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+        "{ \"id\": \"" + activeSessionId + "\", \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"status\": \"failed\", \"notes\": \"Worker report had no single unambiguous VERDICT: PASS/FAIL line (bounded re-ask exhausted)\" }.\n" +
+        "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"message\": \"" + step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry\" }.",
+        { key: "record-block-" + step.name, label: "Recording verdict failure", schema: { type: "object" } }
+      );
+      return {
+        __hatchWorkflowControl: "blocked",
+        result: {
+          blocked_reason: step.name + " worker report had no single unambiguous VERDICT: PASS/FAIL line (bounded re-ask exhausted)",
+          message: "The " + step.identity + " agent's work may be valid — its report did not declare a verdict the workflow could read, and two bounded re-ask attempts could not transcribe one. The report is preserved in the workflow log.",
+          task_id: taskId
+        }
+      };
+    }
+    verdictPassed = verdict.passed;
+  }
+
+  // Deterministic closeout: no formatter agent. The verdict is mechanical
+  // (extractVerdict above); the summary is the worker's report truncated.
+  // For verdict steps passed comes from the verdict; for non-verdict steps
+  // the worker producing output means the step passed.
+  var stepResult = {
+    passed: verdictPassed !== null ? verdictPassed : true,
+    summary: workerText
+  };
 
-  const summary = (stepResult.summary || "Step completed").slice(0, 2000);
-  const passed = stepResult.passed !== false;
+  var workerMarkers = extractMarkerLines(workerText);
+  const summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");
+  const passed = stepResult.passed === true;
   const status = passed ? "completed" : "rejected";
 
   await agent(
@@ -163,7 +483,7 @@ while (i < STEPS.length) {
     reworkCount++;
     if (reworkCount > MAX_REWORK) {
       log("Max rework attempts reached for task " + taskId);
-      return { status: "blocked", task_id: taskId, reason: "Exceeded " + MAX_REWORK + " rework attempts after Review rejection" };
+      return await parkTask("Exceeded " + MAX_REWORK + " rework attempts after Review rejection");
     }
     rejectionNotes = summary;
     i = WRITE_INDEX;