agentic-workflow-manager 3.4.0 → 3.5.0

package/dist/src/commands/job/reap.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planReap = planReap;
+exports.executeReap = executeReap;
+const process_1 = require("../../core/journal/process");
+function planReap(state) {
+    return Object.values(state.jobs)
+        .filter((j) => j.processRef !== undefined)
+        .map((j) => ({ jobId: j.id, pid: j.processRef.pid, aliveWithIdentity: (0, process_1.refIsAlive)(j.processRef) }));
+}
+async function executeReap(state, jobIds) {
+    const killed = [];
+    for (const id of jobIds) {
+        const j = state.jobs[id];
+        if (j?.processRef === undefined)
+            continue;
+        if (!(0, process_1.refIsAlive)(j.processRef))
+            continue; // identidad no confirmada => ni una senial (R2.1)
+        const dead = await (0, process_1.terminateGroupConfirmed)(j.processRef, { termGraceMs: 3000, killGraceMs: 2000 });
+        if (dead)
+            killed.push(id);
+    }
+    return killed;
+}

package/dist/src/commands/job/reconcile.js

@@ -0,0 +1,112 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileJobs = reconcileJobs;
+exports.materializeRetry = materializeRetry;
+// LA UNICA matriz de recuperacion (design R3.3 = R1.8, sin excepciones).
+const fs_1 = __importDefault(require("fs"));
+const crypto_1 = __importDefault(require("crypto"));
+const process_1 = require("../../core/journal/process");
+const exec_wrapper_1 = require("./exec-wrapper");
+/** El sidecar de resultado lo escribe un proceso EXTERNO no coordinado
+ *  (exec-wrapper): existencia del archivo (`replayVerdict`) no es prueba de
+ *  contenido bien formado. Nunca fabricar un pass/fail de JSON invalido o de
+ *  forma incorrecta (R1.6) — un resultado no verificable cae al mismo
+ *  disposition que "unprovable": orphaned-authorization-required. */
+function isWellFormedJobResult(x) {
+    return typeof x === 'object' && x !== null && typeof x.exitCode === 'number'
+        && typeof x.endedAt === 'string'
+        && typeof x.resultPath === 'string';
+}
+function readCompletedResult(logsRoot, jobId, nonce) {
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync((0, exec_wrapper_1.resultPath)(logsRoot, jobId, nonce), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    return isWellFormedJobResult(parsed) ? parsed : null;
+}
+const NON_TERMINAL = ['spawn-intent', 'claimed', 'running', 'cancel-requested'];
+function reconcileJobs(state, logsRoot, opts = {}) {
+    const eligible = opts.eligible ?? (() => true);
+    const decisions = [];
+    for (const j of Object.values(state.jobs)) {
+        if (!NON_TERMINAL.includes(j.executionState))
+            continue;
+        if (!eligible(j))
+            continue;
+        const anyAlive = (j.processRef !== undefined && (0, process_1.refIsAlive)(j.processRef))
+            || (j.wrapperRef !== undefined && (0, process_1.refIsAlive)(j.wrapperRef));
+        if (anyAlive) {
+            decisions.push({ jobId: j.id, action: 'still-alive' });
+            continue;
+        }
+        const nonce = j.spawnNonce ?? j.processRef?.spawnNonce ?? 'sin-nonce';
+        const verdict = (0, exec_wrapper_1.replayVerdict)(logsRoot, j.id, nonce);
+        const result = verdict === 'completed' ? readCompletedResult(logsRoot, j.id, nonce) : null;
+        if (verdict === 'never-started') {
+            // Reemitir exactamente el mismo intent/nonce. El claim `wx` del
+            // wrapper hace que un spawn original demorado y este retry no
+            // puedan ejecutar ambos el comando.
+            decisions.push({ jobId: j.id, action: 'retry-same-intent' });
+        }
+        else if (result !== null) {
+            j.executionState = 'exited';
+            j.spawnNonce = nonce;
+            j.result = result;
+            j.verdict = result.exitCode === 0 ? 'pass' : 'fail';
+            j.phaseTimestamps.exited = j.phaseTimestamps.exited ?? new Date().toISOString();
+            decisions.push({ jobId: j.id, action: 'adopt-result' });
+        }
+        else {
+            // 'unprovable' O 'completed' con sidecar corrupto/mal formado:
+            // ambos son evidencia no verificable — jamas fabricar un pass/fail
+            // de JSON invalido, jamas relanzar solo (R1.6, R1.8).
+            j.executionState = 'orphaned';
+            decisions.push({ jobId: j.id, action: 'orphaned-authorization-required' });
+        }
+    }
+    return { decisions };
+}
+/** Re-reclamar = Attempt NUEVO enlazado, nunca reutilizar (R1.7). El job viejo
+ *  queda 'cancelled' (su intent se retira); el nuevo nace 'received' sin nonce
+ *  — el runner le asigna uno fresco en spawn-intent. */
+function materializeRetry(state, jobId) {
+    const old = state.jobs[jobId];
+    if (old === undefined)
+        throw new Error(`job desconocido: ${jobId}`);
+    old.executionState = 'cancelled';
+    const fresh = {
+        ...old,
+        id: `${old.id}-a${crypto_1.default.randomBytes(3).toString('hex')}`,
+        executionState: 'received',
+        observationState: 'progressing',
+        spawnNonce: undefined, processRef: undefined, wrapperRef: undefined,
+        verdict: undefined, result: undefined,
+        phaseTimestamps: { received: new Date().toISOString() },
+        attemptOf: old.id,
+    };
+    state.jobs[fresh.id] = fresh;
+    for (const task of state.tasks) {
+        for (const item of task.verificationPlan) {
+            if (item.satisfiedBy === old.id)
+                item.satisfiedBy = fresh.id;
+        }
+    }
+    for (const item of state.cycleVerificationPlan) {
+        if (item.satisfiedBy === old.id)
+            item.satisfiedBy = fresh.id;
+    }
+    return fresh;
+}

package/dist/src/commands/job/request.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestJob = requestJob;
+const crypto_1 = __importDefault(require("crypto"));
+const fingerprint_1 = require("../../core/journal/fingerprint");
+const requests_1 = require("../../core/journal/requests");
+/** El agente NO ejecuta: registra la intencion (design R3.1). La idempotencyKey
+ *  es hash(fingerprint + commandDigest) => get-or-create atomico (RNF-T.7).
+ *  El cwd relativo REAL es parte del fingerprint (R3.4). `satisfies` enlaza el
+ *  job con el item de VerificationPlan que pretende satisfacer (R1.4c). */
+function requestJob(repoRoot, branch, generationToken, argv, paths, cwdRel, opts = {}) {
+    const fp = (0, fingerprint_1.computeFingerprint)(repoRoot, argv, paths, cwdRel);
+    // La obligacion es parte de la identidad de la REQUEST, no de la ejecucion:
+    // apply.ts reutiliza el job mecanicamente equivalente y enlaza el nuevo item.
+    const idempotencyKey = crypto_1.default.createHash('sha256').update(`${fp.fingerprint}:${fp.commandDigest}:${opts.satisfies ?? ''}`).digest('hex');
+    return (0, requests_1.emitRequest)(repoRoot, branch, {
+        kind: 'job-request', generationToken, idempotencyKey,
+        payload: {
+            argv, paths, cwd: cwdRel,
+            fingerprint: fp.fingerprint, commandDigest: fp.commandDigest, expandedPaths: fp.expandedPaths,
+            ...(opts.satisfies !== undefined ? { satisfies: opts.satisfies } : {}),
+        },
+    });
+}

package/dist/src/commands/watch/apply.js

@@ -0,0 +1,352 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumePendingRequests = consumePendingRequests;
+// Consumo transaccional de requests (bloqueador 4): mutar estado ->
+// writeJournal -> RECIEN AHI borrar archivos. El replay es seguro por
+// requestId + idempotencyKey + digest.
+const fs_1 = __importDefault(require("fs"));
+const crypto_1 = __importDefault(require("crypto"));
+const store_1 = require("../../core/journal/store");
+const requests_1 = require("../../core/journal/requests");
+const paths_1 = require("../../core/journal/paths");
+const atomic_file_1 = require("../../core/atomic-file");
+const redact_1 = require("../../core/journal/redact");
+function now() { return new Date().toISOString(); }
+const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock'];
+function verificationItems(value, field) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === 'object' && item !== null
+        && typeof item.id === 'string'
+        && VERIFICATION_KINDS.includes(item.kind)
+        && (item.satisfiedBy === undefined || typeof item.satisfiedBy === 'string'))) {
+        throw new Error(`${field} requiere items de verificacion validos`);
+    }
+    return value;
+}
+function reviewObligations(value, taskId) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === 'object' && item !== null
+        && typeof item.id === 'string'
+        && (item.kind === 'spec' || item.kind === 'quality'))) {
+        throw new Error('reviewObligations requiere obligaciones spec|quality validas');
+    }
+    return value.map((item) => ({ ...item, taskId }));
+}
+function stringArray(value, field) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === 'string'))
+        throw new Error(`${field} requiere array de strings`);
+    return value;
+}
+function linkSatisfies(s, itemId, jobId) {
+    const items = [...s.tasks.flatMap((t) => t.verificationPlan), ...s.cycleVerificationPlan];
+    const item = items.find((i) => i.id === itemId);
+    if (item === undefined)
+        throw new Error(`VerificationItem desconocido: ${itemId}`);
+    item.satisfiedBy = jobId;
+}
+function applyRequestToState(s, env, digest) {
+    const base = { requestId: env.requestId, idempotencyKey: env.idempotencyKey, payloadDigest: digest };
+    if (env.kind === 'controller-heartbeat') {
+        s.controllerHeartbeatAt = now();
+        (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
+        return;
+    }
+    if (env.kind === 'job-request') {
+        // get-or-create por idempotencyKey (RNF-T.7); duplicado => applyOutcome
+        // registra el ALIAS con el mismo resultRef (Task 8).
+        const prior = Object.values(s.appliedRequests).find((a) => a.idempotencyKey === env.idempotencyKey && a.outcome === 'applied');
+        if (prior !== undefined) {
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
+            return;
+        }
+        const p = env.payload;
+        if (!Array.isArray(p.argv) || !p.argv.every((arg) => typeof arg === 'string') || p.argv.length === 0)
+            throw new Error('job-request requiere argv no vacio');
+        if (typeof p.fingerprint !== 'string' || typeof p.commandDigest !== 'string')
+            throw new Error('job-request requiere fingerprint y commandDigest');
+        // Un mismo resultado mecanico puede satisfacer mas de un item. La
+        // request sigue teniendo identidad propia, pero no duplica ejecucion.
+        const equivalent = Object.values(s.jobs).find((j) => j.fingerprint === p.fingerprint && j.commandDigest === p.commandDigest
+            && (['received', 'spawn-intent', 'claimed', 'running'].includes(j.executionState)
+                || (j.executionState === 'exited' && j.verdict === 'pass')));
+        if (equivalent !== undefined) {
+            if (typeof p.satisfies === 'string')
+                linkSatisfies(s, p.satisfies, equivalent.id);
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: equivalent.id });
+            return;
+        }
+        const jobId = `job-${Object.keys(s.jobs).length + 1}-${crypto_1.default.randomBytes(3).toString('hex')}`;
+        const job = {
+            id: jobId,
+            fingerprint: String(p.fingerprint), commandDigest: String(p.commandDigest),
+            argv: p.argv,
+            cwd: typeof p.cwd === 'string' ? p.cwd : '.',
+            paths: p.paths === undefined ? [] : stringArray(p.paths, 'job-request paths'),
+            expandedPaths: p.expandedPaths === undefined ? [] : stringArray(p.expandedPaths, 'job-request expandedPaths'),
+            executionState: 'received', observationState: 'progressing',
+            phaseTimestamps: { received: now() },
+            ...(typeof p.satisfies === 'string' ? { satisfies: p.satisfies } : {}),
+        };
+        s.jobs[jobId] = job;
+        if (typeof p.satisfies === 'string')
+            linkSatisfies(s, p.satisfies, jobId);
+        (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: jobId });
+        return;
+    }
+    if (env.kind === 'register-entity') {
+        const p = env.payload;
+        if (p.entity === 'task') {
+            if (typeof p.taskId !== 'string' || p.taskId.length === 0)
+                throw new Error('register --entity task requiere taskId (string no vacio)');
+            const taskId = p.taskId;
+            if (!s.tasks.some((t) => t.id === taskId)) {
+                const plan = p.verificationPlan === undefined ? [] : verificationItems(p.verificationPlan, 'verificationPlan');
+                // R1.4b/R3.6: rechazo EN REGISTRO (no solo en gate) si el plan no
+                // cubre los verificadores mecanicamente requeridos por el repo.
+                const missingKinds = s.requiredVerifiers.filter((k) => !plan.some((item) => item.kind === k));
+                if (missingKinds.length > 0) {
+                    throw new Error(`register --entity task: verificationPlan no cubre los verificadores requeridos: ${missingKinds.join(', ')}`);
+                }
+                const obligations = p.reviewObligations === undefined ? [] : reviewObligations(p.reviewObligations, taskId);
+                s.tasks.push({
+                    id: taskId, title: String(p.title ?? taskId), status: 'pending', attempts: 0,
+                    verificationPlan: plan, reviewObligations: obligations, createdAt: now(),
+                });
+            }
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: taskId });
+            return;
+        }
+        if (p.entity === 'cycle-plan') {
+            const items = verificationItems(p.items, 'register --entity cycle-plan items');
+            // Idempotente por creacion-unica (Task 4): un re-registro defensivo
+            // (ej. tras crash sin memoria de si ya se registro) NUNCA debe pisar
+            // un plan ya existente y perder los `satisfiedBy` ya enlazados.
+            if (s.cycleVerificationPlan.length === 0) {
+                s.cycleVerificationPlan = items;
+            }
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
+            return;
+        }
+        if (p.entity === 'dispatch') {
+            if (typeof p.dispatchId !== 'string' || p.dispatchId.length === 0)
+                throw new Error('register --entity dispatch requiere dispatchId (string no vacio)');
+            if (typeof p.taskId !== 'string' || p.taskId.length === 0)
+                throw new Error('register --entity dispatch requiere taskId (string no vacio)');
+            const dispatchId = p.dispatchId;
+            const taskId = p.taskId;
+            if (!s.tasks.some((task) => task.id === taskId))
+                throw new Error('register --entity dispatch: taskId desconocido');
+            if (!s.dispatches.some((d) => d.id === dispatchId)) {
+                s.dispatches.push({ id: dispatchId, taskId, at: now() });
+                const task = s.tasks.find((t) => t.id === taskId);
+                if (task !== undefined)
+                    task.attempts += 1;
+            }
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: dispatchId });
+            return;
+        }
+        if (p.entity === 'task-status') {
+            if (typeof p.taskId !== 'string' || p.taskId.length === 0)
+                throw new Error('register --entity task-status requiere taskId (string no vacio)');
+            if (p.status !== 'pending' && p.status !== 'in-progress' && p.status !== 'done')
+                throw new Error('register --entity task-status requiere status pending|in-progress|done');
+            const taskId = p.taskId;
+            const status = p.status;
+            const task = s.tasks.find((t) => t.id === taskId);
+            // Fake-success eliminado: una referencia a un taskId inexistente NO
+            // es un no-op silencioso con outcome 'applied' — se rechaza (Fix 1
+            // Parte C lo captura sin tumbar el supervisor).
+            if (task === undefined)
+                throw new Error('register --entity task-status: taskId desconocido');
+            task.status = status;
+            if (status === 'done')
+                task.completedAt = now();
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
+            return;
+        }
+        if (p.entity === 'next-action') {
+            if (typeof p.actionId !== 'string' || typeof p.type !== 'string' || typeof p.target !== 'string') {
+                throw new Error('register --entity next-action requiere actionId, type, target (strings)');
+            }
+            s.cycle.nextAction = {
+                actionId: p.actionId,
+                type: p.type,
+                target: p.target,
+                preconditions: p.preconditions === undefined ? [] : stringArray(p.preconditions, 'next-action preconditions'),
+                attempt: typeof p.attempt === 'number' ? p.attempt : 0,
+                state: p.state === 'in-progress' ? 'in-progress' : 'pending',
+            };
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: p.actionId });
+            return;
+        }
+        if (p.entity === 'custody-decision') {
+            if (p.decision !== 'resume' || typeof p.reason !== 'string' || p.reason.trim().length === 0) {
+                throw new Error('register --entity custody-decision requiere decision=resume y reason no vacio');
+            }
+            if (s.cycle.status !== 'BLOCKED')
+                throw new Error('custody-decision solo aplica a un ciclo BLOCKED');
+            s.custodyDecisions ??= [];
+            s.custodyDecisions.push({ at: now(), decision: 'resume', reason: p.reason, generationToken: env.generationToken });
+            for (const generation of s.generations) {
+                if (generation.state === 'active' || generation.state === 'controller-suspected-stall')
+                    generation.state = 'superseded';
+            }
+            s.cycle.status = 'IN_PROGRESS';
+            s.cycle.blockedReason = undefined;
+            (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
+            return;
+        }
+        throw new Error(`register-entity desconocida: ${String(p.entity)}`);
+    }
+    if (env.kind === 'verdict') {
+        const p = env.payload;
+        if (typeof p.verdictId !== 'string' || p.verdictId.length === 0)
+            throw new Error('verdict requiere verdictId');
+        if (typeof p.obligationId !== 'string' || p.obligationId.length === 0)
+            throw new Error('verdict requiere obligationId');
+        if (typeof p.fingerprint !== 'string' || typeof p.cwd !== 'string') {
+            throw new Error('verdict requiere evidencia de fingerprint reproducible');
+        }
+        const verdictArgv = stringArray(p.argv, 'verdict argv');
+        const verdictPaths = stringArray(p.paths, 'verdict paths');
+        if (p.result !== 'pass' && p.result !== 'fail' && p.result !== 'inconclusive')
+            throw new Error('verdict requiere result pass|fail|inconclusive');
+        const verdictId = String(p.verdictId);
+        const obligationId = String(p.obligationId);
+        if (!s.tasks.some((task) => task.reviewObligations.some((obligation) => obligation.id === obligationId))) {
+            throw new Error(`verdict refiere obligationId desconocido: ${obligationId}`);
+        }
+        if (!s.verdicts.some((v) => v.id === verdictId)) {
+            const result = p.result;
+            // R2.3: redaccion tambien en el `detail` de texto libre humano, no
+            // solo en argv — antes de cualquier escritura durable.
+            s.verdicts.push({
+                id: verdictId, obligationId, result, detail: (0, redact_1.redactText)(String(p.detail ?? '')), receivedAt: now(),
+                fingerprint: p.fingerprint, argv: verdictArgv, paths: verdictPaths, cwd: p.cwd,
+            });
+            for (const t of s.tasks) {
+                const o = t.reviewObligations.find((x) => x.id === obligationId);
+                if (o !== undefined)
+                    o.verdictId = verdictId;
+                for (const item of t.verificationPlan) {
+                    if (item.kind === 'review' && item.id === obligationId)
+                        item.satisfiedBy = verdictId;
+                }
+            }
+            // Veredicto adverso => FixObligation ATOMICA: misma mutacion, misma
+            // escritura de estado (R1.4c, bloqueador 5).
+            if (result !== 'pass') {
+                s.fixes.push({ id: `fix-${verdictId}`, verdictId, closed: false });
+            }
+            else {
+                // pass sobre la MISMA obligacion cierra cualquier fix abierto de
+                // un veredicto adverso anterior — un ciclo real fail->fix->pass
+                // debe poder llegar a COMPLETE (bloqueador de este dispatch).
+                const priorAdverseIds = s.verdicts
+                    .filter((v) => v.obligationId === obligationId && v.id !== verdictId && v.result !== 'pass')
+                    .map((v) => v.id);
+                for (const fix of s.fixes) {
+                    if (priorAdverseIds.includes(fix.verdictId))
+                        fix.closed = true;
+                }
+            }
+        }
+        (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: verdictId });
+        return;
+    }
+}
+/** Consume TODAS las requests pendientes en orden. ORDEN CRITICO (R1.3,
+ *  bloqueador 4): (1) mutar estado, (2) writeJournal, (3) borrar archivos,
+ *  (4) fsync del directorio. Solo el supervisor llama esto (single-writer). */
+function consumePendingRequests(repoRoot, branch, activeToken) {
+    const r = (0, store_1.readJournal)(repoRoot, branch);
+    if (r.corrupt || r.state === null)
+        throw new Error('journal corrupto: el supervisor no opera sobre corrupcion (R1.6)');
+    let s = r.state;
+    const pending = (0, requests_1.listPendingRequests)(repoRoot, branch);
+    const processedFiles = [];
+    const deferredRenames = [];
+    let applied = 0, rejectedStale = 0, rejectedDigest = 0, rejectedInvalid = 0, corrupt = 0;
+    let dirChanged = false; // corrupt-rename O borrado normal: cualquiera muta el directorio
+    let stateTouched = false;
+    for (const p of pending) {
+        if (p.corrupt) {
+            corrupt++;
+            deferredRenames.push({ from: p.file, to: `${p.file}.corrupt` });
+            if (!s.requestProblems.some((problem) => problem.file === p.file && problem.kind === 'corrupt')) {
+                s.requestProblems.push({ file: p.file, kind: 'corrupt', detail: 'request JSON/shape invalido', at: now() });
+            }
+            (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-corrupt', file: p.file });
+            dirChanged = true;
+            stateTouched = true;
+            continue;
+        }
+        const env = p.envelope;
+        const digest = (0, requests_1.digestOf)(env.payload);
+        if (s.appliedRequests[env.requestId] !== undefined) {
+            // replay tras crash post-journal/pre-borrado: ya aplicada, solo borrar
+            processedFiles.push(p.file);
+            dirChanged = true;
+            continue;
+        }
+        // Fix 1: idempotencyKey reutilizada con payload DISTINTO se detecta
+        // PROACTIVAMENTE aca, antes de mutar nada — jamas dejamos que
+        // applyOutcome('applied') tire (eso encallaria al supervisor para
+        // siempre, con el archivo ofensor nunca borrado). Se rechaza visible
+        // via el outcome ya existente 'rejected-digest-mismatch'.
+        const priorSameKey = Object.values(s.appliedRequests).find((a) => a.idempotencyKey === env.idempotencyKey);
+        if (priorSameKey !== undefined && priorSameKey.payloadDigest !== digest) {
+            (0, requests_1.applyOutcome)(s, { requestId: env.requestId, idempotencyKey: env.idempotencyKey, payloadDigest: digest, outcome: 'rejected-digest-mismatch' });
+            (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-rejected-digest-mismatch', requestId: env.requestId });
+            rejectedDigest++;
+        }
+        else if (activeToken !== null && env.generationToken !== activeToken) {
+            (0, requests_1.applyOutcome)(s, { requestId: env.requestId, idempotencyKey: env.idempotencyKey, payloadDigest: digest, outcome: 'rejected-stale-generation' });
+            (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-rejected-stale', requestId: env.requestId });
+            rejectedStale++;
+        }
+        else {
+            // Defensa en profundidad (Fix 1 Parte C): CUALQUIER error de
+            // validacion inesperado (Fix 6/7 u otro futuro) jamas debe tumbar
+            // al supervisor. Se trata como el .corrupt existente — visible,
+            // jamas descartado en silencio — pero con sufijo distinto porque
+            // esto es rechazo de CONTENIDO, no de forma (R1.6).
+            try {
+                // Toda request se valida/muta sobre una copia. Un fallo profundo
+                // nunca deja un estado parcialmente contaminado que luego no se
+                // pueda serializar o reintentar.
+                const candidate = structuredClone(s);
+                applyRequestToState(candidate, env, digest);
+                s = candidate;
+                applied++;
+                stateTouched = true;
+            }
+            catch (e) {
+                rejectedInvalid++;
+                deferredRenames.push({ from: p.file, to: `${p.file}.rejected` });
+                if (!s.requestProblems.some((problem) => problem.file === p.file && problem.kind === 'rejected')) {
+                    s.requestProblems.push({ file: p.file, kind: 'rejected', detail: (0, redact_1.redactText)(e.message), at: now() });
+                }
+                (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-rejected-invalid', requestId: env.requestId, detail: e.message });
+                dirChanged = true;
+                stateTouched = true;
+                continue;
+            }
+        }
+        processedFiles.push(p.file);
+        dirChanged = true;
+    }
+    if (processedFiles.length > 0 || stateTouched) {
+        (0, store_1.writeJournal)(repoRoot, branch, s); // (2) journal ANTES del borrado
+    }
+    for (const rename of deferredRenames) {
+        if (fs_1.default.existsSync(rename.from))
+            fs_1.default.renameSync(rename.from, rename.to);
+    }
+    for (const f of processedFiles)
+        fs_1.default.rmSync(f, { force: true }); // (3)
+    if (dirChanged)
+        (0, atomic_file_1.fsyncDirSync)((0, paths_1.requestsDir)(repoRoot, branch)); // (4) — incluye batches solo-corrupt
+    return { applied, rejectedStale, rejectedDigest, rejectedInvalid, corrupt };
+}