agentic-workflow-manager 9.11.3 → 9.11.5

package/dist/src/commands/job/gate.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeGate = computeGate;
 exports.computeTrackGate = computeTrackGate;
+const store_1 = require("../../core/journal/store");
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
 function sameSelection(left, right) {
     return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind && left.effort.value === right.effort.value;
@@ -149,9 +150,19 @@ function evaluateEvidence(state, fingerprintNow, scope) {
     }
     return { pass: reasons.length === 0, reasons };
 }
-function computeGate(state, corrupt, fingerprintNow) {
+/**
+ * `absent` defaults to false so every existing caller keeps today's behaviour
+ * exactly: an unreadable journal fails closed either way. What changes is the
+ * REASON an absent one reports — it used to claim corruption, sending operators
+ * to look for damage in a healthy repository (#173). The exit code does not
+ * change: this interlock has no plan binding to read an execution mode from when
+ * the journal is missing, so it stays fail-closed and names the remedy instead.
+ */
+function computeGate(state, corrupt, fingerprintNow, absent = false) {
     if (corrupt || state === null) {
-        return { pass: false, reasons: [{ category: 'corrupt', detail: 'state.json corrupto o ilegible: la corrupcion jamas certifica' }] };
+        return absent && !corrupt
+            ? { pass: false, reasons: [{ category: 'absent', detail: store_1.ABSENT_JOURNAL_DETAIL }] }
+            : { pass: false, reasons: [{ category: 'corrupt', detail: 'state.json corrupto o ilegible: la corrupcion jamas certifica' }] };
     }
     return evaluateEvidence(state, fingerprintNow, { requireGlobalKinds: true });
 }
@@ -161,9 +172,12 @@ function computeGate(state, corrupt, fingerprintNow) {
  *  ahi) y rechaza cualquier tarea que aparezca en el journal pero no en la
  *  asignacion del track (R2.3) — nunca certifica por una tarea ajena que se
  *  haya colado. */
-function computeTrackGate(state, corruptState, fingerprintNow) {
-    if (corruptState || state === null)
-        return { pass: false, reasons: [{ category: 'corrupt-state', detail: 'journal ausente o corrupto' }] };
+function computeTrackGate(state, corruptState, fingerprintNow, absent = false) {
+    if (corruptState || state === null) {
+        return absent && !corruptState
+            ? { pass: false, reasons: [{ category: 'absent-state', detail: store_1.ABSENT_JOURNAL_DETAIL }] }
+            : { pass: false, reasons: [{ category: 'corrupt-state', detail: 'journal corrupto o ilegible' }] };
+    }
     if (state.trackContext === undefined)
         return { pass: false, reasons: [{ category: 'wrong-context', detail: 'gate local requiere trackContext' }] };
     const assigned = new Set(state.trackContext.taskIds);

package/dist/src/commands/job/index.js

@@ -219,8 +219,13 @@ function registerJobCommand(program) {
         const branch = branchOf(repo);
         assertAuthenticatedCwd(repo, branch);
         const r = (0, store_1.readJournal)(repo, branch);
-        if (r.corrupt || r.state === null) {
-            process.stdout.write(JSON.stringify({ corruptState: true }, null, 2) + '\n');
+        const presence = (0, store_1.journalPresence)(r);
+        if (presence !== 'present' || r.state === null) {
+            // Absence and corruption need different responses, so they are
+            // reported as different facts. Both still fail closed (#173).
+            process.stdout.write(JSON.stringify(presence === 'absent'
+                ? { journal: 'absent', corruptState: false, remedy: store_1.ABSENT_JOURNAL_DETAIL }
+                : { journal: 'corrupt', corruptState: true }, null, 2) + '\n');
             process.exit(1);
         }
         try {
@@ -257,7 +262,7 @@ function registerJobCommand(program) {
                 process.exit(1);
             }
         }
-        const g = (0, gate_1.computeGate)(r.state, r.corrupt, realFingerprintNow(repo));
+        const g = (0, gate_1.computeGate)(r.state, r.corrupt, realFingerprintNow(repo), r.absent);
         process.stdout.write(JSON.stringify(g, null, 2) + '\n');
         if (!g.pass)
             process.exit(1); // falla cerrado (R3.2)
@@ -270,8 +275,9 @@ function registerJobCommand(program) {
         const branch = branchOf(repo);
         assertAuthenticatedCwd(repo, branch);
         const r = (0, store_1.readJournal)(repo, branch);
-        if (r.corrupt || r.state === null) {
-            process.stdout.write(JSON.stringify({ corruptState: true }) + '\n');
+        const presence = (0, store_1.journalPresence)(r);
+        if (presence !== 'present' || r.state === null) {
+            process.stdout.write(JSON.stringify({ journal: presence, corruptState: presence === 'corrupt' }) + '\n');
             process.exit(1);
             return;
         }
@@ -287,7 +293,7 @@ function registerJobCommand(program) {
         assertAuthenticatedCwd(repo, branch);
         const r = (0, store_1.readJournal)(repo, branch);
         if (r.corrupt || r.state === null) {
-            process.stderr.write('journal corrupto o ausente\n');
+            process.stderr.write(`${r.absent && !r.corrupt ? store_1.ABSENT_JOURNAL_DETAIL : 'journal corrupto o ilegible'}\n`);
             process.exit(1);
         }
         const plan = (0, reap_1.planReap)(r.state);
@@ -308,7 +314,7 @@ function registerJobCommand(program) {
         assertAuthenticatedCwd(repo, branch);
         const r = (0, store_1.readJournal)(repo, branch);
         if (r.corrupt || r.state === null) {
-            process.stderr.write('journal corrupto\n');
+            process.stderr.write(`${r.absent && !r.corrupt ? store_1.ABSENT_JOURNAL_DETAIL : 'journal corrupto o ilegible'}\n`);
             process.exit(1);
         }
         let baseline = null;

package/dist/src/commands/job/query.js

@@ -6,23 +6,27 @@ exports.queryShow = queryShow;
 const store_1 = require("../../core/journal/store");
 const process_1 = require("../../core/journal/process");
 /** Fuente unica de "que hay corriendo": cruza identidad completa contra
- *  procesos vivos. corrupt es VISIBLE, nunca descartado (R1.6). */
+ *  procesos vivos. corrupt es VISIBLE, nunca descartado (R1.6), y un journal
+ *  que nunca existio se reporta como `absent`, no como corrupcion (#173). */
 function queryPs(repoRoot, branch) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
-    if (r.corrupt)
-        return { corruptState: true, jobs: [] };
+    const journal = (0, store_1.journalPresence)(r);
+    if (journal !== 'present')
+        return { corruptState: journal === 'corrupt', journal, jobs: [] };
     const jobs = Object.values(r.state.jobs).map((j) => ({
         id: j.id, executionState: j.executionState, observationState: j.observationState, verdict: j.verdict,
         alive: j.processRef ? (0, process_1.refIsAlive)(j.processRef) : 'sin-pid',
     }));
-    return { corruptState: false, jobs };
+    return { corruptState: false, journal, jobs };
 }
 function queryList(repoRoot, branch) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
-    if (r.corrupt)
-        return { corruptState: true, cycleStatus: null, jobs: [] };
+    const journal = (0, store_1.journalPresence)(r);
+    if (journal !== 'present')
+        return { corruptState: journal === 'corrupt', journal, cycleStatus: null, jobs: [] };
     return {
         corruptState: false,
+        journal,
         cycleStatus: r.state.cycle.status,
         jobs: Object.values(r.state.jobs).map((j) => ({
             id: j.id, executionState: j.executionState, verdict: j.verdict, argv: j.argv, satisfies: j.satisfies,
@@ -31,7 +35,8 @@ function queryList(repoRoot, branch) {
 }
 function queryShow(repoRoot, branch, jobId) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
-    if (r.corrupt)
-        return { corruptState: true, job: null };
-    return { corruptState: false, job: r.state.jobs[jobId] ?? null };
+    const journal = (0, store_1.journalPresence)(r);
+    if (journal !== 'present')
+        return { corruptState: journal === 'corrupt', journal, job: null };
+    return { corruptState: false, journal, job: r.state.jobs[jobId] ?? null };
 }

package/dist/src/commands/sensors/init.js

@@ -139,16 +139,6 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     }
     return { pack, sensors };
 }
-/** Pack names present as directories under `<registryRoot>/sensor-packs/`, sorted. */
-function availablePacks(registryRoot) {
-    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
-    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory())
-        return [];
-    return fs_1.default.readdirSync(packsDir, { withFileTypes: true })
-        .filter(e => e.isDirectory())
-        .map(e => e.name)
-        .sort();
-}
 async function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const detectionCwd = opts.packageRoot ? path_1.default.resolve(cwd, opts.packageRoot) : cwd;

package/dist/src/commands/sensors/run.js

@@ -29,7 +29,6 @@ const project_1 = require("./project");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
-const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
 const READ_ONLY_MAX_ENTRIES = 250_000;

package/dist/src/commands/track/status.js

@@ -56,7 +56,7 @@ function aggregateTrackStatus(planRoot, plan) {
         const observed = (0, store_1.readJournal)(ref.worktreePath, ref.branch);
         tracks[ref.trackId] = {
             phase: ref.phase,
-            gate: (0, gate_1.computeTrackGate)(observed.state, observed.corrupt, fingerprintFor(ref.worktreePath)),
+            gate: (0, gate_1.computeTrackGate)(observed.state, observed.corrupt, fingerprintFor(ref.worktreePath), observed.absent),
         };
     }
     return { cohort: deriveCohortPhase(refs), tracks };

package/dist/src/commands/watch/supervisor.js

@@ -5,6 +5,9 @@ exports.routingFacts = routingFacts;
 exports.defaultDispatchAdmission = defaultDispatchAdmission;
 exports.admissionForConfig = admissionForConfig;
 exports.runSupervisorLoop = runSupervisorLoop;
+// Loop foreground (R4.4/R4.5): tick = apply -> collect/spawn -> stall -> gate.
+// COMPLETE exige gate verde (que exige cero vivos): drenaje ANTES de declarar.
+// Custodia BLOCKED: el loop sigue, el lock NO se libera, nada se mata.
 const store_1 = require("../../core/journal/store");
 const fingerprint_1 = require("../../core/journal/fingerprint");
 const validate_1 = require("../../core/plan/validate");
@@ -464,7 +467,7 @@ class Supervisor {
         if (freezing)
             return this.attemptFreeze();
         const r = (0, store_1.readJournal)(this.repoRoot, this.branch);
-        const gate = (0, gate_1.computeGate)(r.state, r.corrupt, this.fingerprintNow);
+        const gate = (0, gate_1.computeGate)(r.state, r.corrupt, this.fingerprintNow, r.absent);
         const liveJobs = r.state === null ? 1 : Object.values(r.state.jobs).filter((j) => LIVE.includes(j.executionState)).length;
         // R7/C3/C4 (Task 12): un journal de PLAN con cohorte de tracks NUNCA
         // declara `cycle.status = COMPLETE` por este camino genérico mientras
@@ -640,8 +643,11 @@ exports.Supervisor = Supervisor;
  *  generacion propia (cero huerfanos). */
 async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.defaultWrapperSpawner)(), trackRuntime, dispatchAdmission) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
-    if (r.corrupt || r.state === null)
-        throw new Error('journal ausente o corrupto: corre `awm watch --init` primero');
+    if (r.corrupt || r.state === null) {
+        throw new Error(r.absent && !r.corrupt
+            ? 'journal ausente: corre `awm watch --init --plan <plan>` primero'
+            : 'journal corrupto o ilegible: inspecciona .awm/journal antes de continuar');
+    }
     if (r.state.schema !== 2 || !r.state.planBinding) {
         throw new Error('journal legacy o sin binding compacto: `awm watch` no puede ejecutar ni despachar trabajo');
     }

package/dist/src/core/artifact-name.js

@@ -50,7 +50,6 @@ function isSafeArtifactName(name) {
     if (/[. ]$/.test(value))
         return false;
     // Bytes de control y NUL: truncan la ruta a nivel syscall en algunos SO.
-    // eslint-disable-next-line no-control-regex
     if (/[\u0000-\u001f\u007f]/.test(value))
         return false;
     // Cualquier separador (de ambas plataformas) convierte esto en una ruta,

package/dist/src/core/dashboard/render-html.js

@@ -14,13 +14,6 @@ function sectionHtml(section, supplement = '') {
     const rows = section.items.length === 0 ? '<p class="empty">No observations reported.</p>' : `<table><thead><tr><th scope="col">Observation</th><th scope="col">State</th><th scope="col">Detail</th><th scope="col">Remediation</th></tr></thead><tbody>${section.items.map((item) => `<tr><td data-label="Observation">${escapeHtml(item.label)}</td><td data-label="State"><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span></td><td data-label="Detail">${item.detail ? escapeHtml(item.detail) : '—'}</td><td data-label="Remediation">${item.remediation ? `<code>${escapeHtml(item.remediation)}</code>` : '—'}</td></tr>`).join('')}</tbody></table>`;
     return `<section id="${section.id}" aria-label="${title}"><header><h2>${title}</h2><span class="eyebrow">${escapeHtml(section.availability.replace('_', ' '))}</span></header><div class="section-body">${availability}${supplement}${rows}</div></section>`;
 }
-function diagnosticCards(items, attribute) {
-    const labels = ['installation', 'sensors', 'permissions'];
-    const cards = items.slice(0, 3).map((item, index) => `<li data-diagnostic-card="${labels[index] ?? 'diagnostic'}"><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><strong>${escapeHtml(item.label)}</strong><span>${item.detail ? escapeHtml(item.detail) : 'No additional detail'}</span></li>`).join('') || '<li><span class="state not_applicable">— Not applicable</span><strong>No machine observations</strong><span>Machine diagnostics are not available.</span></li>';
-    if (attribute === 'data-machine-diagnostics')
-        return `<section data-machine-diagnostics aria-labelledby="machine-diagnostics-heading"><header><h2 id="machine-diagnostics-heading">Machine diagnostics</h2></header><div class="section-body"><ul class="diagnostic-grid">${cards}</ul></div></section>`;
-    return `<div class="machine-preparation-strip" data-machine-preparation role="group" aria-labelledby="machine-preparation-heading"><h3 id="machine-preparation-heading">Preparación de máquina</h3><ul class="diagnostic-grid">${cards}</ul></div>`;
-}
 function machineBento(items) {
     const names = ['Instalación', 'Sensores globales', 'Persistencia'];
     return `<div class="machine-bento" data-machine-bento>${names.map((name, index) => {

package/dist/src/core/journal/store.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ABSENT_JOURNAL_DETAIL = void 0;
+exports.journalPresence = journalPresence;
 exports.assertJournalInitPaths = assertJournalInitPaths;
 exports.initJournal = initJournal;
 exports.initBoundJournal = initBoundJournal;
@@ -18,6 +20,16 @@ const types_1 = require("./types");
 const paths_1 = require("./paths");
 const identity_1 = require("../plan/identity");
 const validate_1 = require("../plan/validate");
+function journalPresence(read) {
+    if (read.corrupt)
+        return 'corrupt';
+    if (read.absent || read.state === null)
+        return 'absent';
+    return 'present';
+}
+/** What an absent journal actually needs, naming the command rather than leaving
+ *  the operator to infer it — and saying who this interlock is for. */
+exports.ABSENT_JOURNAL_DETAIL = 'journal ausente (no corrupto): el interlock desatendido exige un journal ligado — corre `awm watch --init --plan <plan>`. Un ciclo interactivo no requiere journal.';
 /** Schema 1 evoluciono de forma aditiva durante R1/R5. Normalizamos solamente
  * campos que antes no existian; evidencia legacy queda deliberadamente con
  * fingerprint vacio para que el gate la considere stale, nunca certificada.
@@ -188,28 +200,35 @@ function initBoundJournal(repoRoot, branch, binding, report) {
     }
 }
 /** Lectura corrupt-aware (R1.6): sintaxis invalida O shape invalido => corrupt:true.
- *  Los CONSUMIDORES deciden: consultas muestran 'corrupt'; gate/reconcile bloquean. */
+ *  Un journal que nunca se creo es `absent`, jamas `corrupt`.
+ *  Los CONSUMIDORES deciden: consultas muestran el estado; gate/reconcile bloquean. */
 function readJournal(repoRoot, branch) {
     const sp = (0, paths_1.statePath)(repoRoot, branch);
     let raw;
     try {
+        // Both tree assertions RETURN on ENOENT and throw a plain Error for an
+        // unsafe or linked segment, so the only ENOENT that can reach here comes
+        // from the state file itself. An unsafe tree is therefore never reported
+        // as absence — the same rule `watchJournalStatus` already states.
         assertJournalTree(repoRoot, branch);
         assertJournalFileNotSymlink(sp);
         raw = fs_1.default.readFileSync(sp, 'utf8');
     }
-    catch {
-        return { state: null, corrupt: true };
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { state: null, corrupt: false, absent: true }
+            : { state: null, corrupt: true, absent: false };
     }
     let parsed;
     try {
         parsed = normalizeSchemaOne(JSON.parse(raw));
     }
     catch {
-        return { state: null, corrupt: true, raw };
+        return { state: null, corrupt: true, absent: false, raw };
     }
     if (!(0, types_1.isWellFormedState)(parsed))
-        return { state: null, corrupt: true, raw };
-    return { state: parsed, corrupt: false, raw };
+        return { state: null, corrupt: true, absent: false, raw };
+    return { state: parsed, corrupt: false, absent: false, raw };
 }
 /** Escritura canonica: SOLO el supervisor la invoca (single-writer). CAS por
  *  revision monotonica: el snapshot que traes debe ser el vigente. */
@@ -219,6 +238,11 @@ function writeJournal(repoRoot, branch, state) {
     const current = readJournal(repoRoot, branch);
     if (current.corrupt)
         throw new Error('journal corrupto: no se escribe sobre corrupcion (R1.6)');
+    // Absence used to arrive here as `corrupt`, and this guard is what kept
+    // initialization create-only. Naming it explicitly preserves that exactly:
+    // only initJournal/initBoundJournal may bring a journal into existence.
+    if (current.absent)
+        throw new Error('journal inexistente: la creacion es de initJournal/initBoundJournal, no de writeJournal');
     if (current.state !== null && current.state.revision !== state.revision) {
         throw new Error(`revision desactualizada: disco=${current.state.revision} propuesta=${state.revision}`);
     }

package/dist/src/core/ledger/scan.js

@@ -136,7 +136,6 @@ function scanProjectLedgers(projectRoot, overrides = {}) {
             throw new Error('ledger archive directory escapes project root');
         directories.push({ directory: archive, archive: true });
     }
-    let filesSeen = 0;
     let linesSeen = 0;
     let entryLimitReached = false;
     let omittedEvidenceRefs = 0;
@@ -145,7 +144,6 @@ function scanProjectLedgers(projectRoot, overrides = {}) {
     for (const { isArchive, target } of collected.candidates.slice(0, limits.maxFiles)) {
         if (entryLimitReached)
             break;
-        filesSeen += 1;
         const stat = fs_1.default.lstatSync(target);
         if (stat.isSymbolicLink()) {
             skip('symlink-entry');

package/dist/src/core/miro.js

@@ -85,7 +85,6 @@ function computeLayout(storyMap) {
     let groupLeftX = PADDING; // running X from frame left edge
     for (let ai = 0; ai < activities.length; ai++) {
         const activity = activities[ai];
-        const numTaskCols = Math.max(1, activity.tasks.length);
         const groupWidth = activityGroupWidths[ai];
         // Activity card — spans its task columns
         const activityX = frameLeft + groupLeftX + groupWidth / 2;

package/dist/src/core/profile.js

@@ -27,7 +27,6 @@ function findProjectRoot(startDir) {
     catch {
         return null;
     }
-    // eslint-disable-next-line no-constant-condition
     while (true) {
         if (fs_1.default.existsSync(path_1.default.join(dir, '.git')) ||
             fs_1.default.existsSync(path_1.default.join(dir, 'package.json')) ||

package/dist/src/core/text.js

@@ -14,13 +14,13 @@ exports.sanitizeDeclaredField = sanitizeDeclaredField;
  *  `AGENTS.md` documenta bajo `defensive-guard-consistency`: endurecer una copia
  *  y dejar la otra atrás. */
 function stripControlChars(text) {
-    // eslint-disable-next-line no-control-regex -- necesitamos matchear C0 deliberadamente
+    // Necesitamos matchear C0 deliberadamente.
     return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
 }
 /** Keeps an untrusted diagnostic field on one terminal line, without changing
  * the whitespace policy for multiline public text or composed markdown. */
 function sanitizeDiagnosticText(text) {
-    // eslint-disable-next-line no-control-regex -- remove all C0/C1 controls, including terminal escape bytes
+    // Remove all C0/C1 controls, including terminal escape bytes.
     return text.replace(/\r\n|[\r\n\t\u2028\u2029]/g, ' ').replace(/[\x00-\x1f\x7f-\x9f]/g, '');
 }
 /**

package/dist/src/core/tracks/teardown.js

@@ -2,6 +2,31 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decideTeardown = void 0;
 exports.worktreeOwnershipProven = worktreeOwnershipProven;
+// Task 13 (R4.2/R4.3/R4.6/R4.10/C2/C9): `decideTeardown` YA vive en
+// `protocol.ts` (autoridad única de decisión) — este módulo NO crea una
+// segunda copia (mismo criterio que `join.ts` con `decideJoinReconciliation`,
+// T11). `teardown.test.ts` prueba la matriz completa IMPORTANDO este
+// re-export, así que cualquier fix que descubra tiene que vivir en
+// `protocol.ts` (y volver a correr la exploración de T1 en el mismo commit)
+// para que el gate siga significando algo.
+//
+// Lo que SÍ aporta este archivo es la única prueba de OWNERSHIP real que
+// `tracks.ts` necesita antes de siquiera considerar `remove-owned-worktree`
+// como decisión segura: cuatro condiciones simultáneas (R4.10) —
+//   1. `teardownIntent.worktreePath` (snapshot durable tomado en
+//      `TEARDOWN_REQUESTED` -> `TEARDOWN_INTENT`) resuelve al MISMO target
+//      canónico que `ref.worktreePath` (el dato vivo del journal).
+//   2. `teardownIntent.branch === ref.branch`.
+//   3. `.awm/track.json` del worktree (`readDescriptor`) coincide en
+//      `planJournalId`/`trackId`/`fencingToken` — la identidad completa que
+//      el propio track escribió al armarse (Task 9), nunca reconstruida a
+//      mano.
+//   4. `git worktree list --porcelain` asocia ESE path exactamente con la
+//      branch determinista del track (`ownedWorktreeExists`, ya construida
+//      en Task 9 sobre el mismo criterio).
+// Cualquier chequeo indemostrable (no existe, no legible, mismatch, fallo de
+// git) es "ownership NO probado" — fail-closed (R4.6): el caller nunca
+// adopta ni borra lo que no pudo probar.
 const descriptor_1 = require("./descriptor");
 const paths_1 = require("../paths");
 const git_1 = require("./git");

package/dist/tests/commands/context.test.js

@@ -66,7 +66,7 @@ describe('awm context orchestrators', () => {
     it('sanea bytes de control antes de escribir a la terminal', () => {
         const hostil = { name: 'x\x1b[31m', appliesWhen: 'w\x07', terminatesTo: 't\x00' };
         const r = (0, context_1.runContextOrchestrators)(collected([hostil]), { json: false });
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect(r.stdout).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
 });

package/dist/tests/commands/job/absent-vs-corrupt-journal.test.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const gate_1 = require("../../../src/commands/job/gate");
+const query_1 = require("../../../src/commands/job/query");
+const store_1 = require("../../../src/core/journal/store");
+const paths_1 = require("../../../src/core/journal/paths");
+const types_1 = require("../../../src/core/journal/types");
+// #173. A journal that was never created is a different FACT from a damaged
+// one, and needs a different response: absence is resolved by
+// `awm watch --init --plan`, corruption by inspecting the file. `readJournal`
+// collapsed both into `corrupt: true`, so a healthy repository with no journal
+// told the operator its state file was unreadable.
+//
+// These are two separate cases with two separate assertions on purpose: a single
+// test on "not pass" would not distinguish them, which is how this survived.
+const BRANCH = 'main';
+describe('an absent journal is not a corrupt one', () => {
+    let repo;
+    let previous;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-173-'));
+        previous = { home: process.env.HOME, awmHome: process.env.AWM_HOME };
+        process.env.HOME = path_1.default.join(repo, 'operator-home');
+        process.env.AWM_HOME = path_1.default.join(repo, 'awm-home');
+    });
+    afterEach(() => {
+        for (const [key, value] of [['HOME', previous.home], ['AWM_HOME', previous.awmHome]]) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    });
+    function writeState(body) {
+        fs_1.default.mkdirSync((0, paths_1.journalDir)(repo, BRANCH), { recursive: true });
+        fs_1.default.writeFileSync((0, paths_1.statePath)(repo, BRANCH), body);
+    }
+    it('reports a repository that never had a journal as absent, never corrupt', () => {
+        const read = (0, store_1.readJournal)(repo, BRANCH);
+        expect(read).toEqual({ state: null, corrupt: false, absent: true });
+        expect((0, store_1.journalPresence)(read)).toBe('absent');
+    });
+    it.each([
+        ['truncated JSON', '{"schema":2,"branch":"'],
+        ['well-formed JSON of the wrong shape', '{"nope":1}'],
+        ['an empty file', ''],
+    ])('still reports %s as corrupt, not absent', (_case, body) => {
+        writeState(body);
+        const read = (0, store_1.readJournal)(repo, BRANCH);
+        expect(read.corrupt).toBe(true);
+        expect(read.absent).toBe(false);
+        expect((0, store_1.journalPresence)(read)).toBe('corrupt');
+    });
+    // The adversarial case this change had to survive: `readFileSync` on a
+    // dangling symlink raises ENOENT, so a naive ENOENT check would report an
+    // attacker-placed link as an innocent absence. The symlink assertion runs
+    // first and throws without an errno, which is what keeps that impossible.
+    it('never reports a symlinked state file as absence, even a dangling one', () => {
+        fs_1.default.mkdirSync((0, paths_1.journalDir)(repo, BRANCH), { recursive: true });
+        fs_1.default.symlinkSync(path_1.default.join(repo, 'no-such-target'), (0, paths_1.statePath)(repo, BRANCH));
+        const read = (0, store_1.readJournal)(repo, BRANCH);
+        expect(read.corrupt).toBe(true);
+        expect(read.absent).toBe(false);
+    });
+    it('never reports a symlinked journal directory as absence', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, 'elsewhere'), { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.symlinkSync(path_1.default.join(repo, 'elsewhere'), path_1.default.join(repo, '.awm', 'journal'));
+        const read = (0, store_1.readJournal)(repo, BRANCH);
+        expect(read.corrupt).toBe(true);
+        expect(read.absent).toBe(false);
+    });
+    // Absence used to arrive at writeJournal as `corrupt`, and that is what kept
+    // journal creation exclusive to initJournal/initBoundJournal. Naming it must
+    // not have loosened that.
+    it('still refuses to create a journal through the write path', () => {
+        expect(() => (0, store_1.writeJournal)(repo, BRANCH, (0, types_1.emptyState)(BRANCH)))
+            .toThrow(/journal inexistente: la creacion es de initJournal/);
+        expect(fs_1.default.existsSync((0, paths_1.statePath)(repo, BRANCH))).toBe(false);
+    });
+    it('reports absence through the job queries without dereferencing a null state', () => {
+        expect((0, query_1.queryPs)(repo, BRANCH)).toEqual({ corruptState: false, journal: 'absent', jobs: [] });
+        expect((0, query_1.queryList)(repo, BRANCH)).toEqual({ corruptState: false, journal: 'absent', cycleStatus: null, jobs: [] });
+        expect((0, query_1.queryShow)(repo, BRANCH, 'j1')).toEqual({ corruptState: false, journal: 'absent', job: null });
+    });
+    it('reports corruption through the job queries with corruptState still true', () => {
+        writeState('{"schema":2,"branch":"');
+        expect((0, query_1.queryPs)(repo, BRANCH)).toEqual({ corruptState: true, journal: 'corrupt', jobs: [] });
+        expect((0, query_1.queryList)(repo, BRANCH)).toEqual({ corruptState: true, journal: 'corrupt', cycleStatus: null, jobs: [] });
+        expect((0, query_1.queryShow)(repo, BRANCH, 'j1')).toEqual({ corruptState: true, journal: 'corrupt', job: null });
+    });
+});
+describe('the gates name absence and still fail closed', () => {
+    const fingerprint = () => 'fp';
+    it('reports an absent journal as absent, and names the command that creates one', () => {
+        const gate = (0, gate_1.computeGate)(null, false, fingerprint, true);
+        expect(gate.pass).toBe(false);
+        expect(gate.reasons).toEqual([{ category: 'absent', detail: store_1.ABSENT_JOURNAL_DETAIL }]);
+        expect(gate.reasons[0].detail).toContain('awm watch --init --plan');
+        // The interlock has no plan binding to read an execution mode from when
+        // the journal is missing, so it does not certify on absence either.
+        expect(gate.reasons[0].detail).toContain('interactivo');
+    });
+    it('reports a corrupt journal as corrupt even when absence is also claimed', () => {
+        expect((0, gate_1.computeGate)(null, true, fingerprint, true).reasons)
+            .toEqual([expect.objectContaining({ category: 'corrupt' })]);
+    });
+    // Proves the 60 existing call sites are unchanged: without the new argument a
+    // null state still fails closed exactly as before.
+    it('keeps every caller that omits the new argument failing closed as corrupt', () => {
+        expect((0, gate_1.computeGate)(null, false, fingerprint).pass).toBe(false);
+        expect((0, gate_1.computeGate)(null, false, fingerprint).reasons)
+            .toEqual([expect.objectContaining({ category: 'corrupt' })]);
+    });
+    it('distinguishes the same two facts for a track gate', () => {
+        expect((0, gate_1.computeTrackGate)(null, false, fingerprint, true).reasons)
+            .toEqual([{ category: 'absent-state', detail: store_1.ABSENT_JOURNAL_DETAIL }]);
+        expect((0, gate_1.computeTrackGate)(null, true, fingerprint, true).reasons)
+            .toEqual([expect.objectContaining({ category: 'corrupt-state' })]);
+        expect((0, gate_1.computeTrackGate)(null, false, fingerprint).reasons)
+            .toEqual([expect.objectContaining({ category: 'corrupt-state' })]);
+    });
+    it('does not report absence for a journal that is present', () => {
+        const gate = (0, gate_1.computeGate)((0, types_1.emptyState)('main'), false, fingerprint, false);
+        expect(gate.reasons).not.toContainEqual(expect.objectContaining({ category: 'absent' }));
+    });
+});

package/dist/tests/commands/multi-agent-targeting.test.js

@@ -180,7 +180,7 @@ describe('multi-agent targeting (add/remove/sync/update/doctor)', () => {
         fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.com/baseline.git' }], null, 2));
         const { runUpdateCore } = require('../../src/commands/update');
         const syncRegistries = jest.fn(async () => [SYNCED_REGISTRY]);
-        const planReconciliation = jest.fn((o) => ({ operations: [], records: [], reports: [] }));
+        const planReconciliation = jest.fn((_operations) => ({ operations: [], records: [], reports: [] }));
         const applyInstallPlan = jest.fn(() => ({ installed: [], skipped: [], transactionId: 'tx', modifiedFiles: [] }));
         const resyncInstalledHooks = jest.fn(() => []);
         const outcome = await runUpdateCore({}, {

package/dist/tests/commands/preflight/preflight.test.js

@@ -25,7 +25,6 @@ jest.mock('../../../src/commands/sensors/run', () => ({
 jest.mock('../../../src/core/currentness/check', () => ({
     checkCurrentness: jest.fn(),
 }));
-const mockExecSync = child_process_1.execSync;
 const mockRunSensors = run_1.runSensors;
 const mockCheckCurrentness = check_1.checkCurrentness;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */

package/dist/tests/commands/process.test.js

@@ -79,7 +79,7 @@ describe('awm process show (texto)', () => {
         });
         const r = (0, process_1.runProcessShow)({ models: [hostile], diagnostics: [] }, 'mi-proceso', false);
         expect(r.code).toBe(0);
-        // eslint-disable-next-line no-control-regex -- necesitamos verificar la ausencia deliberada de C0
+        // Necesitamos verificar la ausencia deliberada de C0.
         expect(r.stdout).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
         expect(r.stdout).toContain('Objetivo[31mmalicioso[0m.');
         expect(r.stdout).toContain('Uno]0;pwned');

package/dist/tests/commands/track/status.test.js

@@ -83,7 +83,7 @@ describe('aggregateTrackStatus — agregado read-only (R9.5, R9.6)', () => {
         expect(currentPlanState.tracks[0]).not.toHaveProperty('gate');
         expect(fs_1.default.readFileSync((0, paths_1.statePath)(planRoot, planBranch), 'utf8')).toBe(planBefore);
     });
-    test('journal de track corrupto/ausente nunca se descarta en silencio: gate rojo con corrupt-state', () => {
+    test('journal de track ausente nunca se descarta en silencio: gate rojo con absent-state', () => {
         // ni siquiera se inicializa el journal del segundo track: readJournal
         // sobre un directorio sin state.json => corrupt:true (R1.6).
         const missingTrackRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-missing-'));
@@ -93,7 +93,10 @@ describe('aggregateTrackStatus — agregado read-only (R9.5, R9.6)', () => {
             (0, store_1.writeJournal)(planRoot, planBranch, planState);
             const out = (0, status_1.aggregateTrackStatus)(planRoot, (0, store_1.readJournal)(planRoot, planBranch).state);
             expect(out.tracks.ghost.gate.pass).toBe(false);
-            expect(out.tracks.ghost.gate.reasons).toEqual([{ category: 'corrupt-state', detail: expect.any(String) }]);
+            // #173: the track journal here is ABSENT, not damaged. The gate is
+            // still red — it is never discarded in silence — but it now names the
+            // fact it observed instead of claiming corruption.
+            expect(out.tracks.ghost.gate.reasons).toEqual([{ category: 'absent-state', detail: expect.any(String) }]);
         }
         finally {
             fs_1.default.rmSync(missingTrackRoot, { recursive: true, force: true });

package/dist/tests/commands/track/supervisor-wrapper-cli.test.js

@@ -25,9 +25,6 @@ class ExitSignal extends Error {
         this.code = code;
     }
 }
-function git(repo, args) {
-    return (0, child_process_1.execFileSync)('git', args, { cwd: repo, encoding: 'utf8' }).trim();
-}
 function gitInit(repo, branch) {
     (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'init', '-q', '-b', branch], { cwd: repo });
     fs_1.default.writeFileSync(path_1.default.join(repo, 'f.txt'), 'x');

package/dist/tests/commands/watch/apply.test.js

@@ -126,7 +126,7 @@ describe('aplicacion transaccional de requests', () => {
         expect(Object.keys((0, store_1.readJournal)(repo, 'rama').state.jobs)).toHaveLength(1); // sin duplicados
     });
     test('register-entity CREA task con VerificationPlan y ReviewObligations; cycle-plan y dispatch (R1.4/R1.4b)', () => {
-        const request = (0, requests_1.emitRequest)(repo, 'rama', {
+        (0, requests_1.emitRequest)(repo, 'rama', {
             kind: 'register-entity', generationToken: 'g1', idempotencyKey: 'e1',
             payload: {
                 entity: 'task', taskId: 'T1', title: 'implementar',

package/dist/tests/commands/watch/watch-init.test.js

@@ -180,7 +180,10 @@ describe('watch --init: plan-vs-repo mecanico', () => {
     test('watch --init --plan bloquea un plan no valido antes de crear journal', () => {
         const invalid = { state: 'invalid', diagnostics: [{ code: 'PLAN_SHAPE', message: 'bad' }] };
         expect(() => (0, init_1.initWatch)(repo, 'rama', { path: 'docs/plan.md', report: invalid })).toThrow(/válido/i);
-        expect((0, store_1.readJournal)(repo, 'rama').corrupt).toBe(true);
+        // #173: this asserted `.corrupt` as a proxy for "no journal was created",
+        // which is the exact confusion that issue is about. The fact it means is
+        // absence, and that is now what it says.
+        expect((0, store_1.readJournal)(repo, 'rama')).toMatchObject({ state: null, corrupt: false, absent: true });
     });
     test('watch --init --plan rechaza un plan interactivo antes de crear un binding desatendido', () => {
         const interactive = { ...validPlan('a'), executionMode: 'interactivo' };

package/dist/tests/core/context/provider.test.js

@@ -201,7 +201,7 @@ describe('composedOrchestrators', () => {
             { name: 'a\x1bx', appliesWhen: 'w\x07', terminatesTo: 't\x00' },
         ]);
         expect(out[0].name).toBe('ax');
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         const controlCharPattern = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
         expect(out[0].name).not.toMatch(controlCharPattern);
         expect(out[0].appliesWhen).not.toMatch(controlCharPattern);
@@ -216,7 +216,7 @@ describe('composedOrchestrators', () => {
                 { name: 'evil\x1b[31m', appliesWhen: 'w', terminatesTo: 't' },
             ],
         });
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect(ctx.markdown).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
     it('lo que renderiza el payload sale de esta misma funcion', () => {

package/dist/tests/core/context/strategies/config-instructions.test.js

@@ -47,7 +47,7 @@ describe('ConfigInstructionsStrategy.inject', () => {
 });
 describe('ConfigInstructionsStrategy.remove', () => {
     it('removes only the sentinel, preserving user entries', () => {
-        const { configPath, absPath, provider, input } = setup({ instructions: ['docs/rules.md'] });
+        const { configPath, provider, input } = setup({ instructions: ['docs/rules.md'] });
         strat.inject(input, provider);
         strat.remove(input, provider);
         const cfg = JSON.parse(fs_1.default.readFileSync(configPath, 'utf-8'));

package/dist/tests/core/dashboard/render-terminal.test.js

@@ -26,7 +26,7 @@ describe('renderFullTerminal', () => {
     it('renders all lifecycle sections in canonical order with status and remediation', () => {
         const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)(completeSnapshot()));
         const headings = ['Machine / install', 'Project readiness', 'Design / planning', 'Execution', 'QA', 'Docs', 'Retro', 'Final / history', 'Processes'];
-        expect(headings.map((heading) => output.indexOf(heading))).toEqual([...headings.map((_, index) => expect.any(Number))].map((_, index) => expect.any(Number)));
+        expect(headings.map((heading) => output.indexOf(heading))).toEqual(headings.map(() => expect.any(Number)));
         for (let index = 1; index < headings.length; index++)
             expect(output.indexOf(headings[index])).toBeGreaterThan(output.indexOf(headings[index - 1]));
         expect(output).toContain('⚠ Sensors [project.sensors] — 2 stale');

package/dist/tests/core/diagnostics/provider-checks.test.js

@@ -191,7 +191,6 @@ describe('gatherProviderChecks — shared skills.global does not mask broken lin
     });
     it('still reports shared (healthy, non-degrading) when the shared dir has no broken links', () => {
         const { gatherContext } = require('../../../src/core/diagnostics/context');
-        const { computeProviderOverall } = require('../../../src/core/diagnostics/checks');
         const scanSkills = jest.fn(() => ({ valid: ['ok-skill'], repairable: [], dead: [], usurped: [] }));
         const ctx = gatherContext({ cwd: tmpHome, bundles: [], agents: ['opencode', 'codex'], scanSkills });
         for (const provider of ctx.providers) {

package/dist/tests/core/discovery.test.js

@@ -14,7 +14,6 @@ const SKILLS_ROOT = CONTENT_ROOT;
 const WORKFLOWS_ROOT = CONTENT_ROOT;
 // For backward-compat with mock expectations that check SKILLS_DIR-style paths:
 const SKILLS_DIR = path_1.default.join(CONTENT_ROOT, 'skills');
-const WORKFLOWS_DIR = path_1.default.join(CONTENT_ROOT, 'workflows');
 const directoryStat = { dev: 1n, ino: 3n, isDirectory: () => true, isSymbolicLink: () => false };
 const skillStat = { dev: 1n, ino: 2n, size: 0n, isFile: () => true, isSymbolicLink: () => false };
 describe('Artifact Discovery', () => {

package/dist/tests/core/init/orchestrator.test.js

@@ -62,7 +62,7 @@ describe('runInitSteps — orchestrator', () => {
     function buildDeps(cwd) {
         const { gatherContext } = require('../../../src/core/diagnostics/context');
         const { discoverAllBundles } = require('../../../src/core/bundles');
-        const { contentRoots, registriesDir } = require('../../../src/core/registries');
+        const { contentRoots } = require('../../../src/core/registries');
         const { defaultActions } = require('../../../src/core/init/steps');
         // Seed content at ~/.awm/registries/baseline (content root IS the registry root).
         const contentRoot = path_1.default.join(process.env.AWM_HOME, 'registries', 'baseline');

package/dist/tests/core/journal/process.test.js

@@ -222,7 +222,7 @@ describe('process identity', () => {
     });
     test('captureRefFor degrada a unknown si ps falla, nunca crashea al capturar identidad (R2.1)', () => {
         const cp = require('child_process');
-        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((..._args) => {
             const err = new Error('spawn ps ENOENT');
             err.code = 'ENOENT';
             throw err;

package/dist/tests/core/orchestrators.test.js

@@ -197,7 +197,7 @@ describe('readDeclaredOrchestrators', () => {
             stderrBoundary(result.diagnostics);
             expect(stderrBoundary.mock.calls[0][0].join('')).not.toMatch(/[\u2028\u0085]/);
             expect(stderrBoundary.mock.results[0].value).not.toMatch(/[\u2028\u0085]/);
-            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            // Reject all terminal controls and line separators.
             expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         });
         it.each(['inspection', 'read', 'parse', 'shape', 'fields'])('sanitizes %s diagnostics, including paths and error text', (branch) => {
@@ -224,7 +224,7 @@ describe('readDeclaredOrchestrators', () => {
             expect(result.diagnostics[0]).toContain('awm-registry.json');
             expect(result.diagnostics[0]).toContain('before');
             expect(result.diagnostics[0]).toContain('after');
-            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            // Reject all terminal controls and line separators.
             expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         });
         it('preserves valid raw fields and structural parsing without skill discovery', () => {
@@ -290,7 +290,7 @@ describe('collectDeclaredOrchestrators', () => {
         writeSkill('first', 'real-skill');
         const { diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         expect(diagnostics).toHaveLength(1);
-        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        // Diagnostic must contain no terminal controls or line separators.
         expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         expect(diagnostics[0]).toContain('shared');
         expect(diagnostics[0]).toContain('forged');
@@ -304,7 +304,7 @@ describe('collectDeclaredOrchestrators', () => {
         expect(diagnostics).toHaveLength(1);
         expect(diagnostics[0]).toContain('discovery unavailable');
         expect(diagnostics[0]).toContain('forged');
-        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        // Diagnostic must contain no terminal controls or line separators.
         expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
     });
     it('excludes a later colliding root without losing earlier or subsequent healthy roots', () => {

package/dist/tests/core/secure-fs/native-bridge.test.js

@@ -676,7 +676,6 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
         const junction = path_1.default.join(root, 'junction');
         fs_1.default.mkdirSync(outside);
         fs_1.default.symlinkSync(outside, junction, 'junction');
-        const target = path_1.default.join(junction, 'sensors.json');
         expect(() => binding.writeProjectTransaction(root, 'junction/sensors.json', Buffer.from('new bytes'), { mode: 'create', createParents: false })).toThrow(/rejected path ancestor/i);
         expect(fs_1.default.existsSync(path_1.default.join(outside, 'sensors.json'))).toBe(false);
     });

package/dist/tests/core/text.test.js

@@ -28,7 +28,7 @@ describe('sanitizeDeclaredField', () => {
         expect((0, text_1.sanitizeDeclaredField)('a\n## Forjado *b* `c` <d>')).toBe('a  Forjado b c d');
     });
     it('no deja ESC ni otros C0 sobrevivir aunque el saneo markdown no los toque', () => {
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect((0, text_1.sanitizeDeclaredField)('name\x1b[31mred\x07')).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
     it('es idempotente sobre texto ya limpio', () => {

package/dist/tests/structural/directory-fsync-is-single-source.test.js

@@ -86,7 +86,7 @@ describe('directory fsync has exactly one implementation', () => {
         ];
         expect(rejects(regression, 1)).toBe(true);
         // The sanctioned replacement carries no directory open at all.
-        expect(regression.map((_, i) => i).some(i => rejects(['fsyncDirSync(path.dirname(file));'], 0))).toBe(false);
+        expect(rejects(['fsyncDirSync(path.dirname(file));'], 0)).toBe(false);
         // Flushing a FILE descriptor stays legal — that is a real, portable fsync.
         const fileFlush = ["const fd = fs.openSync(temporary, 'wx', 0o600);", 'fs.fsyncSync(fd);'];
         expect(rejects(fileFlush, 0)).toBe(false);

package/dist/tests/structural/lint-covers-typescript.test.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 // #171: the lint gate linted 14 files — all js/mjs — and exited 0 on a
 // TypeScript CLI. `eslint.config.awm.mjs` imports a project config that does
@@ -23,12 +24,37 @@ const CLI_ROOT = path_1.default.resolve(__dirname, '../..');
  *  repo already documents in tests/integration/published-doctor-evidence.e2e.test.ts,
  *  and the one this test hit on both Windows legs of its first CI run. Going
  *  through `process.execPath` needs no shell, so no argument escaping either. */
-function lint() {
-    const raw = (0, child_process_1.execFileSync)(process.execPath, [
+function lint(target = '.') {
+    const args = [
         path_1.default.join(CLI_ROOT, 'node_modules', 'eslint', 'bin', 'eslint.js'),
-        '.', '--config', 'eslint.config.awm.mjs', '--format', 'json',
-    ], { cwd: CLI_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-    return JSON.parse(raw);
+        target, '--config', 'eslint.config.awm.mjs', '--format', 'json',
+    ];
+    try {
+        const raw = (0, child_process_1.execFileSync)(process.execPath, args, { cwd: CLI_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        // eslint exits non-zero when it reports an error, and the JSON report is
+        // still on stdout. A probe that EXPECTS a finding must read it, not die.
+        const stdout = error.stdout;
+        if (typeof stdout !== 'string' || stdout.trim() === '')
+            throw error;
+        return JSON.parse(stdout);
+    }
+}
+/** Lint one throwaway `.ts` file inside the repo, so the real config's `.ts`
+ *  block applies to it, and report what the gate said about it. */
+function probe(body) {
+    const directory = fs_1.default.mkdtempSync(path_1.default.join(CLI_ROOT, 'tests', '.lint-probe-'));
+    const file = path_1.default.join(directory, 'probe.ts');
+    try {
+        fs_1.default.writeFileSync(file, body);
+        const results = lint(path_1.default.relative(CLI_ROOT, file).split(path_1.default.sep).join('/'));
+        return results.flatMap(entry => entry.messages);
+    }
+    finally {
+        fs_1.default.rmSync(directory, { recursive: true, force: true });
+    }
 }
 describe('the lint gate covers TypeScript (#171)', () => {
     jest.setTimeout(10 * 60_000);
@@ -53,4 +79,37 @@ describe('the lint gate covers TypeScript (#171)', () => {
             .map(m => `${entry.filePath}: ${m.message}`));
         expect(unresolved).toEqual([]);
     });
+    // The gate examining TypeScript is worth nothing if it cannot fail on it.
+    // #171 left the rule at 'warn' with a backlog behind it; these assert the
+    // gate now BLOCKS, and that the tree it blocks on is clean.
+    test('the tree it lints is clean, with nothing left to report', () => {
+        const findings = results.flatMap(entry => entry.messages.map(m => `${entry.filePath}: ${m.ruleId ?? 'directive'} ${m.message}`));
+        expect(findings).toEqual([]);
+    });
+    test('an unused variable in TypeScript is an error, not a warning', () => {
+        const messages = probe('const neverUsed = 1;\nexport const used = 2;\n');
+        const unused = messages.filter(m => m.ruleId === '@typescript-eslint/no-unused-vars');
+        expect(unused).toHaveLength(1);
+        expect(unused[0].severity).toBe(2);
+        expect(unused[0].message).toContain('neverUsed');
+    });
+    test('an underscore-prefixed unused binding stays deliberate and unreported', () => {
+        expect(probe('const _deliberatelyUnused = 1;\nexport const used = 2;\n')).toEqual([]);
+    });
+    // The reason the rule had to become the TypeScript-aware one rather than the
+    // base rule: eslint's own `no-unused-vars` does not understand type
+    // annotations, so it flagged every parameter NAME inside a function TYPE.
+    // That was 195 of the 259 findings #171 exposed. Renaming those to `_x` would
+    // have made the types less readable to silence noise.
+    test('parameter names inside a function type are not reported as unused', () => {
+        const messages = probe('export type Fingerprint = (argv: string[], paths: string[], cwd: string) => string | null;\n');
+        expect(messages).toEqual([]);
+    });
+    test('a caught error that is never inspected is reported too', () => {
+        const messages = probe('export function f(value: number): number {\n    try { return value; } catch (error) { return 0; }\n}\n');
+        const unused = messages.filter(m => m.ruleId === '@typescript-eslint/no-unused-vars');
+        expect(unused).toHaveLength(1);
+        expect(unused[0].severity).toBe(2);
+        expect(unused[0].message).toContain('error');
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.3",
+  "version": "9.11.5",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -59,6 +59,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
     "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",