agentic-workflow-manager 9.12.0 → 9.12.2

package/dist/src/commands/job/gate.js

@@ -2,6 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeGate = computeGate;
 exports.computeTrackGate = computeTrackGate;
+// Interlock mecanico (design R3.2): falla CERRADO. Solo `pass` con fingerprint
+// VIGENTE satisface (R1.4c, RF-2.8). Cada agujero del bloqueador 5 de la
+// review tiene su categoria propia — nada aprueba por vacuidad ni por
+// referencia falsa.
+const types_1 = require("../../core/journal/types");
 const store_1 = require("../../core/journal/store");
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
 function sameSelection(left, right) {
@@ -12,7 +17,7 @@ function evaluateEvidence(state, fingerprintNow, scope) {
     if (state.cycle.status === 'BLOCKED') {
         reasons.push({ category: 'cycle-blocked', detail: `ciclo BLOCKED: ${state.cycle.blockedReason ?? 'sin razon registrada'}` });
     }
-    for (const problem of state.requestProblems) {
+    for (const problem of (0, types_1.activeRequestProblems)(state)) {
         reasons.push({ category: 'request-problem', detail: `request ${problem.kind} en ${problem.file}: ${problem.detail}` });
     }
     for (const j of Object.values(state.jobs)) {

package/dist/src/commands/job/index.js

@@ -116,13 +116,34 @@ function registerJobCommand(program) {
         }
         if (typeof payload !== 'object' || payload === null || Array.isArray(payload))
             throw new Error('--json requiere un objeto JSON');
+        if ('entity' in payload && payload.entity !== opts.entity) {
+            throw new Error('--json entity debe coincidir con --entity');
+        }
         const repo = process.cwd();
         const branch = branchOf(repo);
         assertAuthenticatedCwd(repo, branch);
+        if (opts.entity === 'task') {
+            const current = (0, store_1.readJournal)(repo, branch);
+            if (current.corrupt || current.state === null)
+                throw new Error('register --entity task requiere journal valido');
+            const taskId = payload.taskId;
+            const rawPlan = payload.verificationPlan;
+            const allowedKinds = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
+            if (typeof taskId !== 'string' || taskId.length === 0)
+                throw new Error('register --entity task requiere taskId');
+            if (rawPlan !== undefined && (!Array.isArray(rawPlan) || !rawPlan.every(item => typeof item === 'object' && item !== null && typeof item.id === 'string' && item.id.length > 0
+                && allowedKinds.includes(item.kind) && (item.satisfiedBy === undefined || typeof item.satisfiedBy === 'string')))) {
+                throw new Error('register --entity task requiere verificationPlan valido');
+            }
+            const plan = (rawPlan ?? []);
+            const missing = current.state.requiredVerifiers.filter(kind => !plan.some(item => item.kind === kind));
+            if (missing.length > 0)
+                throw new Error(`register --entity task: verificationPlan no cubre los verificadores requeridos: ${missing.join(', ')}`);
+        }
         const r = (0, requests_1.emitRequest)(repo, branch, {
             kind: 'register-entity', generationToken: opts.generation,
             idempotencyKey: crypto_1.default.createHash('sha256').update(`${opts.entity}:${opts.json}`).digest('hex'),
-            payload: { entity: opts.entity, ...payload },
+            payload: { ...payload, entity: opts.entity },
         });
         process.stdout.write(JSON.stringify({ requestId: r.requestId }, null, 2) + '\n');
     });

package/dist/src/commands/watch/admission-recovery.js

@@ -0,0 +1,161 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverAdmissionCustody = recoverAdmissionCustody;
+const path_1 = __importDefault(require("path"));
+const validate_1 = require("../../core/plan/validate");
+const capabilities_1 = require("../../core/model-policy/capabilities");
+const event_store_1 = require("../../core/model-policy/event-store");
+const local_event_scope_1 = require("../../core/model-policy/local-event-scope");
+const store_1 = require("../../core/journal/store");
+const types_1 = require("../../core/journal/types");
+const process_1 = require("../../core/journal/process");
+const adapter_1 = require("../../core/journal/adapter");
+const generations_1 = require("./generations");
+const lock_1 = require("./lock");
+const supervisor_1 = require("./supervisor");
+function contextFor(input) {
+    if (!(0, adapter_1.isWatchProvider)(input.provider))
+        throw new Error('provider de recovery invalido');
+    if (!(0, adapter_1.isControllerAutonomy)(input.controllerAutonomy))
+        throw new Error('postura del controller invalida');
+    if (!input.routingIdentity)
+        throw new Error('runtime de recovery requerido');
+    const runtime = (0, capabilities_1.validateRuntimeKey)({ target: input.provider, ...input.routingIdentity });
+    return { provider: input.provider, runtime: { kind: runtime.kind, version: runtime.version, accountScopeDigest: runtime.accountScopeDigest }, controllerAutonomy: input.controllerAutonomy };
+}
+function sameContext(a, b) {
+    return a.provider === b.provider && a.controllerAutonomy === b.controllerAutonomy
+        && a.runtime?.kind === b.runtime?.kind && a.runtime?.version === b.runtime?.version
+        && a.runtime?.accountScopeDigest === b.runtime?.accountScopeDigest;
+}
+function admissionCustodyCause(reason) {
+    if (!reason || (reason.match(/ADMISSION_[A-Z_]+/g) ?? []).length !== 1)
+        return undefined;
+    const old = reason.startsWith('admisión compacta desatendida bloqueada antes de dispatch: ');
+    if ((old || reason.startsWith('admisión currentness no verificable tras 3 reintentos: '))
+        && reason.includes('ADMISSION_CURRENTNESS_BLOCKED:'))
+        return 'currentness';
+    if ((old || reason.startsWith('admisión sensors no verificable tras 3 reintentos: '))
+        && reason.includes('ADMISSION_SENSORS_BLOCKED:'))
+        return 'sensors';
+    return undefined;
+}
+function assertNoAmbiguousWork(repoRoot, branch, state) {
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
+        throw new Error('recovery bloqueado: request rechazada o corrupta activa');
+    for (const generation of state.generations) {
+        if ((0, generations_1.controllerGenerationHasUnresolvedClaim)(repoRoot, branch, generation))
+            throw new Error('recovery bloqueado: claim de controller sin identidad demostrable');
+        for (const ref of [generation.processRef, generation.wrapperRef]) {
+            if (ref && ((0, process_1.refIsAlive)(ref) || !(0, process_1.groupIsGone)(ref.processGroup)))
+                throw new Error('recovery bloqueado: controller vivo o ambiguo');
+        }
+    }
+    for (const job of Object.values(state.jobs)) {
+        if (!['exited', 'cancelled'].includes(job.executionState))
+            throw new Error(`recovery bloqueado: job ${job.id} activo o ambiguo`);
+        for (const ref of [job.processRef, job.wrapperRef]) {
+            if (ref && ((0, process_1.refIsAlive)(ref) || !(0, process_1.groupIsGone)(ref.processGroup)))
+                throw new Error(`recovery bloqueado: job ${job.id} vivo o ambiguo`);
+        }
+    }
+}
+/** Explicit offline transition. The journal record is the authoritative audit;
+ * the event is supplementary, so retry after a crash cannot duplicate the
+ * state transition or silently discard the original custody reason. */
+async function recoverAdmissionCustody(repoRoot, branch, input, dispatchAdmission) {
+    if (typeof repoRoot !== 'string' || !path_1.default.isAbsolute(repoRoot) || typeof branch !== 'string' || branch.length === 0
+        || !input || typeof input !== 'object' || typeof input.reason !== 'string'
+        || input.reason.trim().length === 0 || input.reason.length > 1024
+        || (input.generationToken !== undefined && (typeof input.generationToken !== 'string' || input.generationToken.length === 0))) {
+        throw new Error('parametros de recovery invalidos');
+    }
+    const context = contextFor(input);
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        const read = (0, store_1.readJournal)(repoRoot, branch);
+        if (read.corrupt || !read.state || read.state.schema !== 2 || !read.state.planBinding)
+            throw new Error('recovery requiere journal schema-2 vigente');
+        const state = read.state;
+        (0, lock_1.verifyBranchInvariant)(repoRoot, state.branch);
+        const previous = state.admissionRecoveries?.at(-1);
+        if (state.cycle.status === 'IN_PROGRESS' && previous
+            && previous.reason === input.reason && previous.generationToken === input.generationToken
+            && sameContext(previous.context, context))
+            return 'already-recovered';
+        if (state.cycle.status !== 'BLOCKED' || !admissionCustodyCause(state.cycle.blockedReason)) {
+            throw new Error('recovery solo admite custodia causada por admisión currentness o sensores');
+        }
+        const latest = state.generations.at(-1);
+        if (latest?.token !== input.generationToken || (latest === undefined && input.generationToken !== undefined)) {
+            throw new Error('generation de recovery no es la vigente');
+        }
+        if (latest?.provider && latest.provider !== context.provider)
+            throw new Error('provider de generation no coincide con identidad de recovery');
+        if (state.admissionContext && !sameContext(state.admissionContext, context))
+            throw new Error('identidad de runtime o postura no coincide con la admisión original');
+        assertNoAmbiguousWork(repoRoot, branch, state);
+        const prospective = structuredClone(state);
+        prospective.cycle.status = 'IN_PROGRESS';
+        prospective.cycle.blockedReason = undefined;
+        const independentBlocker = (0, supervisor_1.recoveryWhitelistBlocker)(prospective);
+        if (independentBlocker)
+            throw new Error(`recovery bloqueado por causa independiente: ${independentBlocker}`);
+        const binding = state.planBinding;
+        if (!binding)
+            throw new Error('binding del plan ausente');
+        const plan = (0, validate_1.validatePlanFile)(binding.path, repoRoot);
+        if (plan.state !== 'valid' || plan.planDigest !== binding.digest || plan.schema !== binding.schema
+            || (binding.executionDigest !== undefined && plan.executionDigest !== binding.executionDigest)) {
+            throw new Error('binding del plan alterado: recovery denegado');
+        }
+        // A v1 plan does not ask the admission engine to evaluate routing.
+        // Recovery still promises a current native receipt for the asserted
+        // provider/runtime, so check its machine seal and live local scope
+        // explicitly; an operator assertion alone is not evidence.
+        const runtime = (0, capabilities_1.validateRuntimeKey)({ target: context.provider, ...context.runtime });
+        const stored = (0, event_store_1.readStoredEventReceipt)(runtime);
+        if (stored.state !== 'present')
+            throw new Error(`recibo nativo ausente o invalido para ${context.provider}: ejecuta awm model-policy setup --provider ${context.provider}`);
+        const local = await (0, local_event_scope_1.queryLocalEventScope)(repoRoot, context.provider, runtime.kind);
+        if (local.state !== 'current' || local.scope.runtime.target !== runtime.target
+            || local.scope.runtime.kind !== runtime.kind || local.scope.runtime.version !== runtime.version
+            || local.scope.runtime.accountScopeDigest !== runtime.accountScopeDigest
+            || stored.receipt.runtime.target !== runtime.target || stored.receipt.runtime.kind !== runtime.kind
+            || stored.receipt.runtime.version !== runtime.version || stored.receipt.runtime.accountScopeDigest !== runtime.accountScopeDigest
+            || stored.receipt.binaryDigest !== local.scope.binaryDigest || stored.receipt.configDigest !== local.scope.configDigest
+            || Date.parse(stored.receipt.recordedAt) > Date.now()) {
+            throw new Error(`recibo nativo no coincide con runtime/cuenta local de ${context.provider}`);
+        }
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, provider: context.provider,
+            routingIdentity: context.runtime, controllerAutonomy: context.controllerAutonomy };
+        const report = await (dispatchAdmission ?? (0, supervisor_1.admissionForConfig)(repoRoot, branch, cfg))();
+        if (report.state !== 'admitted' || report.planState !== 'valid' || report.executionMode !== 'desatendido'
+            || report.journal !== 'current' || report.currentness !== 'current' || report.sensors !== 'pass'
+            || (report.planDigest !== undefined && report.planDigest !== binding.digest)) {
+            throw new Error(`admisión estricta todavía bloqueada: ${report.diagnostics.map(item => `${item.code}: ${item.message}`).join('; ')}`);
+        }
+        const candidate = structuredClone(state);
+        candidate.admissionRecoveries ??= [];
+        candidate.admissionRecoveries.push({ at: new Date().toISOString(), reason: input.reason,
+            blockedReason: state.cycle.blockedReason, generationToken: input.generationToken,
+            context, planDigest: binding.digest,
+            assertion: state.admissionContext ? 'recorded' : 'legacy-operator-asserted' });
+        candidate.admissionContext = context;
+        candidate.admissionRetry = undefined;
+        candidate.cycle.status = 'IN_PROGRESS';
+        candidate.cycle.blockedReason = undefined;
+        // Existing generations and nextAction remain untouched. The next watch
+        // tick performs strict admission again before reconciling either.
+        (0, store_1.writeJournal)(repoRoot, branch, candidate);
+        (0, store_1.appendEvent)(repoRoot, branch, { kind: 'admission-recovered', generationToken: input.generationToken,
+            reason: input.reason, blockedReason: state.cycle.blockedReason, planDigest: binding.digest });
+        return 'recovered';
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
+}

package/dist/src/commands/watch/apply.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyCyclePlanAppend = applyCyclePlanAppend;
 exports.registerTrackIntegrationItems = registerTrackIntegrationItems;
+exports.applyRequestToState = applyRequestToState;
 exports.consumePendingRequests = consumePendingRequests;
 // Consumo transaccional de requests (bloqueador 4): mutar estado ->
 // writeJournal -> RECIEN AHI borrar archivos. El replay es seguro por
@@ -502,6 +503,8 @@ function applyRequestToState(s, env, digest, repoRoot, eventScope) {
             }
             if (s.cycle.status !== 'BLOCKED')
                 throw new Error('custody-decision solo aplica a un ciclo BLOCKED');
+            if ((0, types_1.activeRequestProblems)(s).length > 0)
+                throw new Error('custody-decision no resuelve requests rechazadas pendientes');
             s.custodyDecisions ??= [];
             s.custodyDecisions.push({ at: now(), decision: 'resume', reason: p.reason, generationToken: env.generationToken });
             for (const generation of s.generations) {
@@ -666,7 +669,10 @@ function consumePendingRequests(repoRoot, branch, activeToken, eventScope) {
                 rejectedInvalid++;
                 deferredRenames.push({ from: p.file, to: `${p.file}.rejected` });
                 if (!s.requestProblems.some((problem) => problem.file === p.file && problem.kind === 'rejected')) {
-                    s.requestProblems.push({ file: p.file, kind: 'rejected', detail: (0, redact_1.redactText)(e.message), at: now() });
+                    s.requestProblems.push({ file: p.file, kind: 'rejected', detail: (0, redact_1.redactText)(e.message), at: now(),
+                        requestId: env.requestId, generationToken: env.generationToken,
+                        ...(env.kind === 'register-entity' && env.payload.entity === 'task' && typeof env.payload.taskId === 'string'
+                            ? { taskId: env.payload.taskId } : {}) });
                 }
                 (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-rejected-invalid', requestId: env.requestId, detail: e.message });
                 dirChanged = true;

package/dist/src/commands/watch/archive-unused.js

@@ -50,8 +50,10 @@ function watchJournalStatus(repoRoot, branch) {
     }
     catch { /* recognized present journal, but never eligible by absence alone */ }
     const binding = current.state.planBinding;
+    const latest = current.state.generations.reduce((prev, generation) => prev === undefined || generation.n > prev.n ? generation : prev, undefined);
     return {
         state: 'present', cycleState: current.state.cycle.status, bootstrapUnused,
+        ...(latest ? { latestGeneration: { n: latest.n, token: latest.token, state: latest.state } } : {}),
         ...(binding ? { binding: { path: binding.path, digest: binding.digest, ...(binding.executionDigest ? { executionDigest: binding.executionDigest, executionIdentitySchema: binding.executionIdentitySchema } : {}), schema: binding.schema, executionMode: binding.executionMode, boundAt: binding.boundAt } } : {}),
     };
 }

package/dist/src/commands/watch/index.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerWatchCommand = registerWatchCommand;
 const child_process_1 = require("child_process");
 const init_1 = require("./init");
+const request_recovery_1 = require("./request-recovery");
+const admission_recovery_1 = require("./admission-recovery");
 const supervisor_1 = require("./supervisor");
 const capabilities_1 = require("../../core/model-policy/capabilities");
 const adapter_1 = require("../../core/journal/adapter");
@@ -144,6 +146,59 @@ function registerWatchCommand(program) {
         await (0, supervisor_1.runSupervisorLoop)(repo, branch, cfg);
         process.stdout.write('gate verde: ciclo COMPLETE — drenado, lock liberado, apagando\n');
     });
+    watch.command('recover-request')
+        .description('reconcilia una task rechazada con una request correctiva aplicada bajo lock exclusivo')
+        .requiredOption('--rejected <requestId>', 'request rechazada archivada')
+        .requiredOption('--replacement <requestId>', 'request correctiva pendiente')
+        .requiredOption('--generation <token>', 'generacion vigente')
+        .requiredOption('--reason <text>', 'motivo auditado de la recuperacion')
+        .option('--resume', 'reanuda explicitamente custodia si el unico bloqueo era la request')
+        .action((opts) => {
+        const repo = process.cwd();
+        const branch = currentBranch(repo);
+        try {
+            (0, context_1.resolveCommandContext)(repo, branch);
+            (0, request_recovery_1.recoverRejectedTask)(repo, branch, {
+                rejectedRequestId: opts.rejected, replacementRequestId: opts.replacement,
+                generationToken: opts.generation, reason: opts.reason, resume: opts.resume === true,
+            });
+            process.stdout.write(JSON.stringify({ recovered: true, rejectedRequestId: opts.rejected, replacementRequestId: opts.replacement, resumed: opts.resume === true }) + '\n');
+        }
+        catch (error) {
+            process.stderr.write(`${error.message}\n`);
+            process.exitCode = 1;
+        }
+    });
+    watch.command('recover-admission')
+        .description('reanuda offline una custodia por admisión tras una nueva comprobación estricta')
+        .option('--generation <token>', 'token de la ultima generacion; omitir solo si no existe')
+        .requiredOption('--reason <text>', 'motivo explícito de la decisión del operador')
+        .action(async (opts, command) => {
+        const repo = process.cwd();
+        try {
+            const branch = currentBranch(repo);
+            (0, context_1.resolveCommandContext)(repo, branch);
+            const parent = command.parent?.opts() ?? {};
+            if (command.parent?.getOptionValueSource('provider') !== 'cli')
+                throw new Error('recover-admission requiere --provider explícito');
+            if (!(0, adapter_1.isControllerAutonomy)(parent.controllerAutonomy))
+                throw new Error('recover-admission requiere --controller-autonomy valido');
+            if (parent.runtimeKind === undefined || parent.runtimeVersion === undefined || parent.accountScopeDigest === undefined) {
+                throw new Error('recover-admission requiere --runtime-kind, --runtime-version y --account-scope-digest');
+            }
+            const outcome = await (0, admission_recovery_1.recoverAdmissionCustody)(repo, branch, {
+                provider: parent.provider,
+                routingIdentity: { kind: parent.runtimeKind, version: parent.runtimeVersion, accountScopeDigest: parent.accountScopeDigest },
+                controllerAutonomy: parent.controllerAutonomy,
+                generationToken: opts.generation, reason: opts.reason,
+            });
+            process.stdout.write(JSON.stringify({ recovered: true, outcome, generationToken: opts.generation ?? null }) + '\n');
+        }
+        catch (error) {
+            process.stderr.write(`${error.message}\n`);
+            process.exitCode = 1;
+        }
+    });
     watch
         .command('rebind')
         .description('reconcilia intencionalmente el binding desatendido tras un cambio válido del ciclo del plan')

package/dist/src/commands/watch/init.js

@@ -13,6 +13,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const store_1 = require("../../core/journal/store");
 const paths_1 = require("../../core/journal/paths");
+const types_1 = require("../../core/journal/types");
 const lock_1 = require("./lock");
 const validate_1 = require("../../core/plan/validate");
 const identity_1 = require("../../core/plan/identity");
@@ -104,7 +105,7 @@ function rebindBlocker(state) {
     const nonterminal = Object.values(state.jobs).filter(job => !TERMINAL_JOB_STATES.has(job.executionState));
     if (nonterminal.length > 0)
         return `hay jobs no terminales: ${nonterminal.map(job => job.id).join(', ')}`;
-    if (state.requestProblems.length > 0)
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
         return 'hay conflictos durables de requests';
     if (state.verdicts.some(verdict => verdict.result !== 'pass'))
         return 'hay evidencia adversa durable';

package/dist/src/commands/watch/request-recovery.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverRejectedTask = recoverRejectedTask;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const json_1 = require("../../core/plan/json");
+const atomic_file_1 = require("../../core/atomic-file");
+const types_1 = require("../../core/journal/types");
+const requests_1 = require("../../core/journal/requests");
+const paths_1 = require("../../core/journal/paths");
+const store_1 = require("../../core/journal/store");
+const process_1 = require("../../core/journal/process");
+const apply_1 = require("./apply");
+const lock_1 = require("./lock");
+const REQUEST_ID = /^req-[0-9]+-[0-9]{10}-[a-f0-9]{8}$/;
+const MAX_REQUEST_BYTES = 256 * 1024;
+function validatedId(value, label) {
+    if (typeof value !== 'string' || !REQUEST_ID.test(value))
+        throw new Error(`${label} requiere un requestId valido`);
+    return value;
+}
+/** Reads only one canonical, bounded request file. The inode check closes a
+ * swap between lstat and open, including platforms without O_NOFOLLOW. */
+function requestEnvelope(file, requestId) {
+    const before = fs_1.default.lstatSync(file);
+    if (!before.isFile() || before.isSymbolicLink() || before.size < 1 || before.size > MAX_REQUEST_BYTES) {
+        throw new Error('request de recovery no es un archivo regular acotado');
+    }
+    const descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+    let body;
+    try {
+        const opened = fs_1.default.fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) {
+            throw new Error('request de recovery cambio de identidad');
+        }
+        body = fs_1.default.readFileSync(descriptor, { encoding: 'utf8' });
+    }
+    finally {
+        fs_1.default.closeSync(descriptor);
+    }
+    const parsed = (0, json_1.parseJsonNoDuplicate)(body);
+    if (!(0, requests_1.isWellFormedEnvelope)(parsed) || parsed.requestId !== requestId)
+        throw new Error('request de recovery tiene envelope invalido');
+    return parsed;
+}
+function taskId(envelope) {
+    if (envelope.kind !== 'register-entity' || envelope.payload.entity !== 'task'
+        || typeof envelope.payload.taskId !== 'string' || envelope.payload.taskId.length === 0) {
+        throw new Error('recovery solo admite register-entity task con taskId');
+    }
+    return envelope.payload.taskId;
+}
+function mayResume(state) {
+    if (state.cycle.status !== 'BLOCKED' || state.cycle.blockedReason !== 'recovery no autorizado: hay conflictos durables de requests') {
+        throw new Error('resume requiere custodia BLOCKED por requests');
+    }
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
+        throw new Error('resume requiere resolver todas las requests activas');
+}
+/** Offline recovery lane: no supervisor or controller may own this journal.
+ * The correction and its audit link are published in one state transaction. */
+function recoverRejectedTask(repoRoot, branch, input) {
+    if (typeof repoRoot !== 'string' || !path_1.default.isAbsolute(repoRoot) || typeof branch !== 'string' || branch.length === 0
+        || !input || typeof input !== 'object' || typeof input.generationToken !== 'string' || input.generationToken.length === 0
+        || typeof input.reason !== 'string' || input.reason.trim().length === 0 || input.reason.length > 1024 || typeof input.resume !== 'boolean') {
+        throw new Error('parametros de recovery invalidos');
+    }
+    const rejectedId = validatedId(input.rejectedRequestId, '--rejected');
+    const replacementId = validatedId(input.replacementRequestId, '--replacement');
+    if (rejectedId === replacementId)
+        throw new Error('la request correctiva debe ser distinta');
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        const read = (0, store_1.readJournal)(repoRoot, branch);
+        if (read.corrupt || !read.state || read.state.schema !== 2 || !read.state.planBinding)
+            throw new Error('recovery requiere journal schema-2 vigente');
+        const state = read.state;
+        const latest = [...state.generations].sort((a, b) => b.n - a.n)[0];
+        if (!latest || latest.token !== input.generationToken)
+            throw new Error('generation de recovery no es la vigente');
+        for (const generation of state.generations) {
+            for (const ref of [generation.processRef, generation.wrapperRef]) {
+                if (ref && (0, process_1.refIsAlive)(ref))
+                    throw new Error('controller vivo: recovery requiere custodia exclusiva');
+            }
+        }
+        const dir = (0, paths_1.requestsDir)(repoRoot, branch);
+        const originalFile = path_1.default.join(dir, `${rejectedId}.json`);
+        const problem = state.requestProblems.find(item => item.kind === 'rejected' && item.file === originalFile);
+        if (!problem)
+            throw new Error('rechazo durable no encontrado');
+        if (problem.resolution) {
+            if (problem.resolution.replacementRequestId !== replacementId || problem.resolution.generationToken !== input.generationToken || problem.resolution.reason !== input.reason
+                || (0, types_1.activeRequestProblems)(state).includes(problem))
+                throw new Error('recovery previo incompatible');
+            if (input.resume && state.cycle.status === 'BLOCKED') {
+                const candidate = structuredClone(state);
+                mayResume(candidate);
+                candidate.custodyDecisions ??= [];
+                candidate.custodyDecisions.push({ at: new Date().toISOString(), decision: 'resume', reason: input.reason, generationToken: input.generationToken });
+                candidate.cycle.status = 'IN_PROGRESS';
+                candidate.cycle.blockedReason = undefined;
+                for (const generation of candidate.generations)
+                    if (generation.state === 'active' || generation.state === 'controller-suspected-stall')
+                        generation.state = 'superseded';
+                (0, store_1.writeJournal)(repoRoot, branch, candidate);
+            }
+            return;
+        }
+        const original = requestEnvelope(`${originalFile}.rejected`, rejectedId);
+        const replacementFile = path_1.default.join(dir, `${replacementId}.json`);
+        const replacement = requestEnvelope(replacementFile, replacementId);
+        if (original.generationToken !== input.generationToken || replacement.generationToken !== input.generationToken || taskId(original) !== taskId(replacement)) {
+            throw new Error('request correctiva no enlaza el mismo taskId o generation');
+        }
+        if (state.tasks.some(task => task.id === taskId(original)))
+            throw new Error('task ya existente: recovery requiere un registro rechazado sin aplicar');
+        if (state.appliedRequests[replacementId] !== undefined || Object.values(state.appliedRequests).some(item => item.idempotencyKey === replacement.idempotencyKey && item.payloadDigest !== (0, requests_1.digestOf)(replacement.payload))) {
+            throw new Error('request correctiva ya tiene outcome o idempotencyKey conflictiva');
+        }
+        const candidate = structuredClone(state);
+        (0, apply_1.applyRequestToState)(candidate, replacement, (0, requests_1.digestOf)(replacement.payload), repoRoot);
+        if (candidate.appliedRequests[replacementId]?.outcome !== 'applied' || !candidate.tasks.some(task => task.id === taskId(replacement))) {
+            throw new Error('request correctiva no fue aplicada');
+        }
+        const target = candidate.requestProblems.find(item => item.kind === 'rejected' && item.file === originalFile);
+        target.requestId = rejectedId;
+        target.taskId = taskId(original);
+        target.generationToken = original.generationToken;
+        target.resolution = { replacementRequestId: replacementId, replacementPayloadDigest: (0, requests_1.digestOf)(replacement.payload), reason: input.reason,
+            generationToken: input.generationToken, at: new Date().toISOString() };
+        if (input.resume) {
+            mayResume(candidate);
+            candidate.custodyDecisions ??= [];
+            candidate.custodyDecisions.push({ at: new Date().toISOString(), decision: 'resume', reason: input.reason, generationToken: input.generationToken });
+            candidate.cycle.status = 'IN_PROGRESS';
+            candidate.cycle.blockedReason = undefined;
+            for (const generation of candidate.generations)
+                if (generation.state === 'active' || generation.state === 'controller-suspected-stall')
+                    generation.state = 'superseded';
+        }
+        (0, store_1.writeJournal)(repoRoot, branch, candidate);
+        fs_1.default.rmSync(replacementFile);
+        (0, atomic_file_1.fsyncDirSync)(dir);
+        (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-recovered', rejectedRequestId: rejectedId, replacementRequestId: replacementId, generationToken: input.generationToken, resumed: input.resume });
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
+}