agentic-workflow-manager 9.12.1 → 9.12.2

package/dist/src/commands/watch/admission-recovery.js

@@ -0,0 +1,161 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverAdmissionCustody = recoverAdmissionCustody;
+const path_1 = __importDefault(require("path"));
+const validate_1 = require("../../core/plan/validate");
+const capabilities_1 = require("../../core/model-policy/capabilities");
+const event_store_1 = require("../../core/model-policy/event-store");
+const local_event_scope_1 = require("../../core/model-policy/local-event-scope");
+const store_1 = require("../../core/journal/store");
+const types_1 = require("../../core/journal/types");
+const process_1 = require("../../core/journal/process");
+const adapter_1 = require("../../core/journal/adapter");
+const generations_1 = require("./generations");
+const lock_1 = require("./lock");
+const supervisor_1 = require("./supervisor");
+function contextFor(input) {
+    if (!(0, adapter_1.isWatchProvider)(input.provider))
+        throw new Error('provider de recovery invalido');
+    if (!(0, adapter_1.isControllerAutonomy)(input.controllerAutonomy))
+        throw new Error('postura del controller invalida');
+    if (!input.routingIdentity)
+        throw new Error('runtime de recovery requerido');
+    const runtime = (0, capabilities_1.validateRuntimeKey)({ target: input.provider, ...input.routingIdentity });
+    return { provider: input.provider, runtime: { kind: runtime.kind, version: runtime.version, accountScopeDigest: runtime.accountScopeDigest }, controllerAutonomy: input.controllerAutonomy };
+}
+function sameContext(a, b) {
+    return a.provider === b.provider && a.controllerAutonomy === b.controllerAutonomy
+        && a.runtime?.kind === b.runtime?.kind && a.runtime?.version === b.runtime?.version
+        && a.runtime?.accountScopeDigest === b.runtime?.accountScopeDigest;
+}
+function admissionCustodyCause(reason) {
+    if (!reason || (reason.match(/ADMISSION_[A-Z_]+/g) ?? []).length !== 1)
+        return undefined;
+    const old = reason.startsWith('admisión compacta desatendida bloqueada antes de dispatch: ');
+    if ((old || reason.startsWith('admisión currentness no verificable tras 3 reintentos: '))
+        && reason.includes('ADMISSION_CURRENTNESS_BLOCKED:'))
+        return 'currentness';
+    if ((old || reason.startsWith('admisión sensors no verificable tras 3 reintentos: '))
+        && reason.includes('ADMISSION_SENSORS_BLOCKED:'))
+        return 'sensors';
+    return undefined;
+}
+function assertNoAmbiguousWork(repoRoot, branch, state) {
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
+        throw new Error('recovery bloqueado: request rechazada o corrupta activa');
+    for (const generation of state.generations) {
+        if ((0, generations_1.controllerGenerationHasUnresolvedClaim)(repoRoot, branch, generation))
+            throw new Error('recovery bloqueado: claim de controller sin identidad demostrable');
+        for (const ref of [generation.processRef, generation.wrapperRef]) {
+            if (ref && ((0, process_1.refIsAlive)(ref) || !(0, process_1.groupIsGone)(ref.processGroup)))
+                throw new Error('recovery bloqueado: controller vivo o ambiguo');
+        }
+    }
+    for (const job of Object.values(state.jobs)) {
+        if (!['exited', 'cancelled'].includes(job.executionState))
+            throw new Error(`recovery bloqueado: job ${job.id} activo o ambiguo`);
+        for (const ref of [job.processRef, job.wrapperRef]) {
+            if (ref && ((0, process_1.refIsAlive)(ref) || !(0, process_1.groupIsGone)(ref.processGroup)))
+                throw new Error(`recovery bloqueado: job ${job.id} vivo o ambiguo`);
+        }
+    }
+}
+/** Explicit offline transition. The journal record is the authoritative audit;
+ * the event is supplementary, so retry after a crash cannot duplicate the
+ * state transition or silently discard the original custody reason. */
+async function recoverAdmissionCustody(repoRoot, branch, input, dispatchAdmission) {
+    if (typeof repoRoot !== 'string' || !path_1.default.isAbsolute(repoRoot) || typeof branch !== 'string' || branch.length === 0
+        || !input || typeof input !== 'object' || typeof input.reason !== 'string'
+        || input.reason.trim().length === 0 || input.reason.length > 1024
+        || (input.generationToken !== undefined && (typeof input.generationToken !== 'string' || input.generationToken.length === 0))) {
+        throw new Error('parametros de recovery invalidos');
+    }
+    const context = contextFor(input);
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        const read = (0, store_1.readJournal)(repoRoot, branch);
+        if (read.corrupt || !read.state || read.state.schema !== 2 || !read.state.planBinding)
+            throw new Error('recovery requiere journal schema-2 vigente');
+        const state = read.state;
+        (0, lock_1.verifyBranchInvariant)(repoRoot, state.branch);
+        const previous = state.admissionRecoveries?.at(-1);
+        if (state.cycle.status === 'IN_PROGRESS' && previous
+            && previous.reason === input.reason && previous.generationToken === input.generationToken
+            && sameContext(previous.context, context))
+            return 'already-recovered';
+        if (state.cycle.status !== 'BLOCKED' || !admissionCustodyCause(state.cycle.blockedReason)) {
+            throw new Error('recovery solo admite custodia causada por admisión currentness o sensores');
+        }
+        const latest = state.generations.at(-1);
+        if (latest?.token !== input.generationToken || (latest === undefined && input.generationToken !== undefined)) {
+            throw new Error('generation de recovery no es la vigente');
+        }
+        if (latest?.provider && latest.provider !== context.provider)
+            throw new Error('provider de generation no coincide con identidad de recovery');
+        if (state.admissionContext && !sameContext(state.admissionContext, context))
+            throw new Error('identidad de runtime o postura no coincide con la admisión original');
+        assertNoAmbiguousWork(repoRoot, branch, state);
+        const prospective = structuredClone(state);
+        prospective.cycle.status = 'IN_PROGRESS';
+        prospective.cycle.blockedReason = undefined;
+        const independentBlocker = (0, supervisor_1.recoveryWhitelistBlocker)(prospective);
+        if (independentBlocker)
+            throw new Error(`recovery bloqueado por causa independiente: ${independentBlocker}`);
+        const binding = state.planBinding;
+        if (!binding)
+            throw new Error('binding del plan ausente');
+        const plan = (0, validate_1.validatePlanFile)(binding.path, repoRoot);
+        if (plan.state !== 'valid' || plan.planDigest !== binding.digest || plan.schema !== binding.schema
+            || (binding.executionDigest !== undefined && plan.executionDigest !== binding.executionDigest)) {
+            throw new Error('binding del plan alterado: recovery denegado');
+        }
+        // A v1 plan does not ask the admission engine to evaluate routing.
+        // Recovery still promises a current native receipt for the asserted
+        // provider/runtime, so check its machine seal and live local scope
+        // explicitly; an operator assertion alone is not evidence.
+        const runtime = (0, capabilities_1.validateRuntimeKey)({ target: context.provider, ...context.runtime });
+        const stored = (0, event_store_1.readStoredEventReceipt)(runtime);
+        if (stored.state !== 'present')
+            throw new Error(`recibo nativo ausente o invalido para ${context.provider}: ejecuta awm model-policy setup --provider ${context.provider}`);
+        const local = await (0, local_event_scope_1.queryLocalEventScope)(repoRoot, context.provider, runtime.kind);
+        if (local.state !== 'current' || local.scope.runtime.target !== runtime.target
+            || local.scope.runtime.kind !== runtime.kind || local.scope.runtime.version !== runtime.version
+            || local.scope.runtime.accountScopeDigest !== runtime.accountScopeDigest
+            || stored.receipt.runtime.target !== runtime.target || stored.receipt.runtime.kind !== runtime.kind
+            || stored.receipt.runtime.version !== runtime.version || stored.receipt.runtime.accountScopeDigest !== runtime.accountScopeDigest
+            || stored.receipt.binaryDigest !== local.scope.binaryDigest || stored.receipt.configDigest !== local.scope.configDigest
+            || Date.parse(stored.receipt.recordedAt) > Date.now()) {
+            throw new Error(`recibo nativo no coincide con runtime/cuenta local de ${context.provider}`);
+        }
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, provider: context.provider,
+            routingIdentity: context.runtime, controllerAutonomy: context.controllerAutonomy };
+        const report = await (dispatchAdmission ?? (0, supervisor_1.admissionForConfig)(repoRoot, branch, cfg))();
+        if (report.state !== 'admitted' || report.planState !== 'valid' || report.executionMode !== 'desatendido'
+            || report.journal !== 'current' || report.currentness !== 'current' || report.sensors !== 'pass'
+            || (report.planDigest !== undefined && report.planDigest !== binding.digest)) {
+            throw new Error(`admisión estricta todavía bloqueada: ${report.diagnostics.map(item => `${item.code}: ${item.message}`).join('; ')}`);
+        }
+        const candidate = structuredClone(state);
+        candidate.admissionRecoveries ??= [];
+        candidate.admissionRecoveries.push({ at: new Date().toISOString(), reason: input.reason,
+            blockedReason: state.cycle.blockedReason, generationToken: input.generationToken,
+            context, planDigest: binding.digest,
+            assertion: state.admissionContext ? 'recorded' : 'legacy-operator-asserted' });
+        candidate.admissionContext = context;
+        candidate.admissionRetry = undefined;
+        candidate.cycle.status = 'IN_PROGRESS';
+        candidate.cycle.blockedReason = undefined;
+        // Existing generations and nextAction remain untouched. The next watch
+        // tick performs strict admission again before reconciling either.
+        (0, store_1.writeJournal)(repoRoot, branch, candidate);
+        (0, store_1.appendEvent)(repoRoot, branch, { kind: 'admission-recovered', generationToken: input.generationToken,
+            reason: input.reason, blockedReason: state.cycle.blockedReason, planDigest: binding.digest });
+        return 'recovered';
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
+}

package/dist/src/commands/watch/index.js

@@ -7,6 +7,7 @@ exports.registerWatchCommand = registerWatchCommand;
 const child_process_1 = require("child_process");
 const init_1 = require("./init");
 const request_recovery_1 = require("./request-recovery");
+const admission_recovery_1 = require("./admission-recovery");
 const supervisor_1 = require("./supervisor");
 const capabilities_1 = require("../../core/model-policy/capabilities");
 const adapter_1 = require("../../core/journal/adapter");
@@ -168,6 +169,36 @@ function registerWatchCommand(program) {
             process.exitCode = 1;
         }
     });
+    watch.command('recover-admission')
+        .description('reanuda offline una custodia por admisión tras una nueva comprobación estricta')
+        .option('--generation <token>', 'token de la ultima generacion; omitir solo si no existe')
+        .requiredOption('--reason <text>', 'motivo explícito de la decisión del operador')
+        .action(async (opts, command) => {
+        const repo = process.cwd();
+        try {
+            const branch = currentBranch(repo);
+            (0, context_1.resolveCommandContext)(repo, branch);
+            const parent = command.parent?.opts() ?? {};
+            if (command.parent?.getOptionValueSource('provider') !== 'cli')
+                throw new Error('recover-admission requiere --provider explícito');
+            if (!(0, adapter_1.isControllerAutonomy)(parent.controllerAutonomy))
+                throw new Error('recover-admission requiere --controller-autonomy valido');
+            if (parent.runtimeKind === undefined || parent.runtimeVersion === undefined || parent.accountScopeDigest === undefined) {
+                throw new Error('recover-admission requiere --runtime-kind, --runtime-version y --account-scope-digest');
+            }
+            const outcome = await (0, admission_recovery_1.recoverAdmissionCustody)(repo, branch, {
+                provider: parent.provider,
+                routingIdentity: { kind: parent.runtimeKind, version: parent.runtimeVersion, accountScopeDigest: parent.accountScopeDigest },
+                controllerAutonomy: parent.controllerAutonomy,
+                generationToken: opts.generation, reason: opts.reason,
+            });
+            process.stdout.write(JSON.stringify({ recovered: true, outcome, generationToken: opts.generation ?? null }) + '\n');
+        }
+        catch (error) {
+            process.stderr.write(`${error.message}\n`);
+            process.exitCode = 1;
+        }
+    });
     watch
         .command('rebind')
         .description('reconcilia intencionalmente el binding desatendido tras un cambio válido del ciclo del plan')

package/dist/src/commands/watch/supervisor.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Supervisor = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
+exports.Supervisor = exports.ADMISSION_RETRY_DELAY_MS = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
 exports.routingFacts = routingFacts;
 exports.defaultDispatchAdmission = defaultDispatchAdmission;
 exports.admissionForConfig = admissionForConfig;
@@ -192,6 +192,21 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
 function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
     return defaultDispatchAdmission(repoRoot, branch, cfg.provider, cfg.routingIdentity, deps, cfg.controllerAutonomy);
 }
+function admissionContextForConfig(cfg) {
+    if (!(0, adapter_1.isWatchProvider)(cfg.provider))
+        throw new Error('provider de supervisor invalido');
+    if (cfg.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(cfg.controllerAutonomy))
+        throw new Error('postura del controller invalida');
+    const runtime = cfg.routingIdentity === undefined ? undefined : (0, capabilities_1.validateRuntimeKey)({ target: cfg.provider, ...cfg.routingIdentity });
+    return { provider: cfg.provider,
+        ...(runtime ? { runtime: { kind: runtime.kind, version: runtime.version, accountScopeDigest: runtime.accountScopeDigest } } : {}),
+        ...(cfg.controllerAutonomy ? { controllerAutonomy: cfg.controllerAutonomy } : {}) };
+}
+function sameAdmissionContext(left, right) {
+    return left.provider === right.provider && left.controllerAutonomy === right.controllerAutonomy
+        && left.runtime?.kind === right.runtime?.kind && left.runtime?.version === right.runtime?.version
+        && left.runtime?.accountScopeDigest === right.runtime?.accountScopeDigest;
+}
 // 'frozen' (R5.2/R6.3, Task 10): SOLO puede ocurrir en el journal de un
 // TRACK individual (nunca en el del plan) — el track terminó, con las 6
 // observaciones demostrables (cero jobs vivos, gate local verde, worktree
@@ -200,7 +215,24 @@ function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
 /** How many consecutive ticks an inconclusive sensor verdict may defer dispatch
  *  before the supervisor says so out loud. Small: the deferral covers a verdict
  *  still settling, not one that never will. */
-exports.MAX_SENSOR_DEFERRALS = 3;
+exports.MAX_SENSOR_DEFERRALS = types_1.MAX_ADMISSION_DEFERRALS;
+exports.ADMISSION_RETRY_DELAY_MS = 5000;
+function transientAdmission(report) {
+    // Currentness and sensors are evaluated before journalStatus, so their
+    // blocked reports legitimately carry journal=not-required. The caller
+    // verifies the bound journal identity independently before deferring.
+    if (report.state !== 'blocked' || report.executionMode !== 'desatendido'
+        || report.planState !== 'valid' || !['not-required', 'current'].includes(report.journal)
+        || report.diagnostics.length !== 1)
+        return undefined;
+    if (report.currentness === 'unverifiable' && report.sensors === 'not-required'
+        && report.diagnostics[0].code === 'ADMISSION_CURRENTNESS_BLOCKED')
+        return 'currentness';
+    if (report.currentness === 'current' && report.sensors === 'not-certified'
+        && report.diagnostics[0].code === 'ADMISSION_SENSORS_BLOCKED')
+        return 'sensors';
+    return undefined;
+}
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
 function recoveryWhitelistBlocker(state) {
     if (state.cycle.status === 'BLOCKED') {
@@ -230,21 +262,19 @@ class Supervisor {
     cfg;
     spawner;
     dispatchAdmission;
+    autoBeginGeneration;
     backoff = new generations_1.Backoff();
     relaunchNotBefore = 0;
-    /** Consecutive ticks deferred on an inconclusive sensor verdict. Bounded:
-     *  the deferral exists for a verdict that is still settling, and a verdict
-     *  that never settles must become visible rather than loop forever. */
-    sensorDeferrals = 0;
     lastActivity = null;
     lastGenerationToken = null;
     trackRuntime;
-    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = admissionForConfig(repoRoot, branch, cfg)) {
+    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = admissionForConfig(repoRoot, branch, cfg), autoBeginGeneration = false) {
         this.repoRoot = repoRoot;
         this.branch = branch;
         this.cfg = cfg;
         this.spawner = spawner;
         this.dispatchAdmission = dispatchAdmission;
+        this.autoBeginGeneration = autoBeginGeneration;
         this.trackRuntime = trackRuntime ?? (0, tracks_1.defaultTrackRuntime)(repoRoot, branch, { termGraceMs: cfg.termGraceMs, killGraceMs: cfg.killGraceMs });
     }
     fingerprintNow = (argv, paths, cwd) => {
@@ -281,7 +311,7 @@ class Supervisor {
         }
     }
     async tick() {
-        const before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+        let before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
         if (before0.corrupt || before0.state === null)
             throw new Error('journal corrupto: el supervisor no opera sobre corrupcion (R1.6)');
         // Historical/schema-1 journals are intentionally readable by migration
@@ -295,6 +325,24 @@ class Supervisor {
         // longer reconstructible.
         if (before0.state.cycle.status === 'COMPLETE')
             return 'complete';
+        // A historical custody cannot be silently converted into another
+        // cause on a later tick. Only the locked offline recovery may resume.
+        if (before0.state.cycle.status === 'BLOCKED')
+            return 'custody';
+        const assertedContext = admissionContextForConfig(this.cfg);
+        if (before0.state.admissionContext && !sameAdmissionContext(before0.state.admissionContext, assertedContext)) {
+            (0, generations_1.enterCustody)(this.repoRoot, this.branch, 'identidad de admisión cambió al reiniciar: provider/runtime/postura');
+            return 'custody';
+        }
+        if (!before0.state.admissionContext && assertedContext.runtime && assertedContext.controllerAutonomy) {
+            before0.state.admissionContext = assertedContext;
+            (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+            before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+            if (before0.corrupt || !before0.state)
+                throw new Error('journal no verificable tras vincular identidad de admisión');
+        }
+        if (before0.state.admissionRetry && Date.now() < Date.parse(before0.state.admissionRetry.nextRetryAt))
+            return 'continue';
         // A controller can create jobs and runnerTick can start them. Both are
         // downstream of the same full compact unattended admission, so it must
         // complete before any reconciliation path that could dispatch either.
@@ -309,40 +357,49 @@ class Supervisor {
             }
             if (admission.state !== 'admitted' || admission.executionMode !== 'desatendido'
                 || admission.currentness !== 'current' || admission.sensors !== 'pass' || admission.journal !== 'current') {
-                // A first empirical sensor observation can be inconclusive while
-                // the already-started controller is still settling. It never
-                // authorizes dispatch; retry the read-only admission next tick
-                // instead of permanently custodying a healthy cycle.
-                //
-                // Bounded, because the verdict is not always transient: a
-                // registry whose sensors are all disabled reports
-                // `not-certified` forever. Unbounded, this returned before
-                // `consumePendingRequests` below, so the supervisor ticked
-                // indefinitely applying nothing and writing nothing — no event,
-                // no state change, no exit. Refusing to progress is correct
-                // here; refusing invisibly is not. Consuming requests cannot be
-                // hoisted above this gate to compensate: applying a job-request
-                // creates a Job that runnerTick can start, which is the dispatch
-                // this admission exists to authorize.
-                if (admission.planState === 'valid' && admission.currentness === 'current'
-                    && admission.sensors === 'not-certified' && admission.journal === 'not-required') {
-                    this.sensorDeferrals += 1;
-                    if (this.sensorDeferrals <= exports.MAX_SENSOR_DEFERRALS)
+                const kind = transientAdmission(admission);
+                if (kind) {
+                    const binding = before0.state.planBinding;
+                    const plan = (0, validate_1.validatePlanFile)(binding.path, this.repoRoot);
+                    if (plan.state !== 'valid' || plan.planDigest !== binding.digest || plan.schema !== binding.schema
+                        || (binding.executionDigest !== undefined && plan.executionDigest !== binding.executionDigest)
+                        || (admission.planDigest !== undefined && admission.planDigest !== binding.digest)) {
+                        (0, generations_1.enterCustody)(this.repoRoot, this.branch, 'binding del plan alterado durante admisión transitoria');
+                        return 'custody';
+                    }
+                    const prior = before0.state.admissionRetry;
+                    const attempts = (prior?.attempts ?? 0) + 1;
+                    if (attempts <= types_1.MAX_ADMISSION_DEFERRALS) {
+                        const now = Date.now();
+                        before0.state.admissionRetry = { kind, attempts, firstAt: prior?.firstAt ?? new Date(now).toISOString(), nextRetryAt: new Date(now + exports.ADMISSION_RETRY_DELAY_MS).toISOString() };
+                        (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                        (0, store_1.appendEvent)(this.repoRoot, this.branch, { kind: 'admission-retry', cause: kind, attempts, retryAfterMs: exports.ADMISSION_RETRY_DELAY_MS });
                         return 'continue';
-                    // The reason must not carry the running counter. enterCustody is
-                    // idempotent on (status, reason), so a message that changes every
-                    // tick defeats that guard and rewrites the journal plus appends a
-                    // custody-blocked event every tickMs, without bound. Naming the
-                    // bound instead of the count keeps the reason stable, so custody
-                    // is entered once and stays entered.
-                    (0, generations_1.enterCustody)(this.repoRoot, this.branch, `veredicto de sensores no concluyente tras ${exports.MAX_SENSOR_DEFERRALS} ticks: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
+                    }
+                    (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión ${kind} no verificable tras ${types_1.MAX_ADMISSION_DEFERRALS} reintentos: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
                     return 'custody';
                 }
                 (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión compacta desatendida bloqueada antes de dispatch: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
                 return 'custody';
             }
-            // The verdict settled, which is exactly what the deferral waited for.
-            this.sensorDeferrals = 0;
+            // An incomplete assertion can be repaired while the cycle is
+            // still waiting. Bind it only after an admitted observation, never
+            // on an early currentness/sensor response that has not reached the
+            // provider, runtime and autonomy gates yet.
+            if (!before0.state.admissionContext) {
+                before0.state.admissionContext = assertedContext;
+                (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+                if (before0.corrupt || !before0.state)
+                    throw new Error('journal no verificable tras vincular admisión completa');
+            }
+            if (before0.state.admissionRetry) {
+                before0.state.admissionRetry = undefined;
+                (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+                if (before0.corrupt || !before0.state)
+                    throw new Error('journal no verificable tras resolver reintento de admisión');
+            }
         }
         let recoveryResumeAction;
         // Schema-2 custody is reconciled before any controller launch.  This is
@@ -396,14 +453,14 @@ class Supervisor {
             // verdicts, and an adverse verdict without a closed fix all stop
             // recovery before a controller can create more work.
             const verdictById = new Map(before0.state.verdicts.map(verdict => [verdict.id, verdict]));
-            const openReviewOrFix = before0.state.tasks.some(task => {
+            const openReviewOrFix = (terminalTaskClaims && before0.state.tasks.some(task => {
                 const obligations = task.reviewObligations;
                 return !['spec', 'quality'].every(kind => obligations.some(obligation => obligation.kind === kind))
                     || obligations.some(obligation => {
                         const verdict = obligation.verdictId === undefined ? undefined : verdictById.get(obligation.verdictId);
                         return verdict === undefined || verdict.result !== 'pass';
                     });
-            }) || before0.state.verdicts.some(verdict => verdict.result !== 'pass'
+            })) || before0.state.verdicts.some(verdict => verdict.result !== 'pass'
                 && !before0.state.fixes.some(fix => fix.verdictId === verdict.id && fix.closed));
             const recovery = (0, fingerprint_1.reconcileUnattendedRecovery)({
                 journal: before0.state, journalCorrupt: false, plan: before0.state.planBinding,
@@ -442,6 +499,8 @@ class Supervisor {
         // mismo resultado terminal.
         if (before.frozen !== undefined)
             return 'frozen';
+        if (this.autoBeginGeneration && (0, generations_1.activeGeneration)(before) === undefined)
+            (0, generations_1.beginGeneration)(this.repoRoot, this.branch);
         const pending = before.cycle.nextAction;
         const resumeAction = recoveryResumeAction ?? { schema: 'controller-recovery/v1', kind: pending !== undefined ? 'resume-next-action' : 'resume-cycle' };
         if (this.ensureController(resumeAction) === 'custody')
@@ -721,12 +780,8 @@ async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.d
     const onSignal = () => { shutdownRequested = true; wakeSleep?.(); };
     process.on('SIGINT', onSignal);
     process.on('SIGTERM', onSignal);
-    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission);
+    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission, true);
     try {
-        const s0 = (0, store_1.readJournal)(repoRoot, branch).state;
-        if ((0, generations_1.activeGeneration)(s0) === undefined) {
-            (0, generations_1.beginGeneration)(repoRoot, branch);
-        }
         for (;;) {
             if (shutdownRequested)
                 break;

package/dist/src/core/journal/types.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
+exports.MAX_ADMISSION_DEFERRALS = exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
 exports.activeRequestProblems = activeRequestProblems;
 exports.isControllerRecoveryAction = isControllerRecoveryAction;
 exports.emptyState = emptyState;
@@ -50,6 +50,7 @@ function activeRequestProblems(state) {
             || !state.tasks.some(task => task.id === problem.taskId);
     });
 }
+exports.MAX_ADMISSION_DEFERRALS = 3;
 function isControllerRecoveryAction(x) {
     return isObj(x) && Object.keys(x).length === 2
         && x.schema === 'controller-recovery/v1'
@@ -117,6 +118,12 @@ function isWellFormedState(x) {
         return false;
     if (x.custodyDecisions !== undefined && (!Array.isArray(x.custodyDecisions) || !x.custodyDecisions.every(isWellFormedCustodyDecision)))
         return false;
+    if (x.admissionRetry !== undefined && !isWellFormedAdmissionRetry(x.admissionRetry))
+        return false;
+    if (x.admissionContext !== undefined && !isWellFormedAdmissionContext(x.admissionContext))
+        return false;
+    if (x.admissionRecoveries !== undefined && (!Array.isArray(x.admissionRecoveries) || !x.admissionRecoveries.every(isWellFormedAdmissionRecovery)))
+        return false;
     if (!x.generations.every(isWellFormedGeneration) || !x.tasks.every(isWellFormedTask))
         return false;
     if (!x.cycleVerificationPlan.every(isWellFormedVerificationItem))
@@ -274,6 +281,36 @@ function isWellFormedCustodyDecision(x) {
     return isObj(x) && typeof x.at === 'string' && x.decision === 'resume'
         && typeof x.reason === 'string' && typeof x.generationToken === 'string';
 }
+function isWellFormedAdmissionRetry(x) {
+    return isObj(x) && Object.keys(x).length === 4
+        && (x.kind === 'currentness' || x.kind === 'sensors')
+        && Number.isInteger(x.attempts) && Number(x.attempts) >= 1 && Number(x.attempts) <= exports.MAX_ADMISSION_DEFERRALS
+        && typeof x.firstAt === 'string' && Number.isFinite(Date.parse(x.firstAt))
+        && typeof x.nextRetryAt === 'string' && Number.isFinite(Date.parse(x.nextRetryAt))
+        && Date.parse(x.nextRetryAt) >= Date.parse(x.firstAt);
+}
+function isWellFormedAdmissionContext(x) {
+    if (!isObj(x) || !Object.keys(x).every(key => ['provider', 'runtime', 'controllerAutonomy'].includes(key))
+        || (x.provider !== 'codex' && x.provider !== 'claude-code')
+        || (x.controllerAutonomy !== undefined && x.controllerAutonomy !== 'approval-free'))
+        return false;
+    if (x.runtime === undefined)
+        return true;
+    return isObj(x.runtime) && Object.keys(x.runtime).length === 3
+        && typeof x.runtime.kind === 'string' && x.runtime.kind.length > 0
+        && typeof x.runtime.version === 'string' && x.runtime.version.length > 0
+        && typeof x.runtime.accountScopeDigest === 'string' && /^[a-f0-9]{64}$/.test(x.runtime.accountScopeDigest);
+}
+function isWellFormedAdmissionRecovery(x) {
+    return isObj(x) && Object.keys(x).every(key => ['at', 'reason', 'blockedReason', 'generationToken', 'context', 'planDigest', 'assertion'].includes(key))
+        && typeof x.at === 'string' && Number.isFinite(Date.parse(x.at))
+        && typeof x.reason === 'string' && x.reason.trim().length > 0 && x.reason.length <= 1024
+        && typeof x.blockedReason === 'string' && x.blockedReason.length > 0
+        && (x.generationToken === undefined || (typeof x.generationToken === 'string' && x.generationToken.length > 0))
+        && isWellFormedAdmissionContext(x.context)
+        && typeof x.planDigest === 'string' && /^[a-f0-9]{64}$/.test(x.planDigest)
+        && (x.assertion === 'recorded' || x.assertion === 'legacy-operator-asserted');
+}
 function isWellFormedProcessRef(x) {
     if (!isObj(x))
         return false;

package/dist/tests/commands/watch/admission-recovery.test.js

@@ -0,0 +1,278 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const commander_1 = require("commander");
+const init_1 = require("../../../src/commands/watch/init");
+const store_1 = require("../../../src/core/journal/store");
+const validate_1 = require("../../../src/core/plan/validate");
+const process_1 = require("../../../src/core/journal/process");
+const eventStore = __importStar(require("../../../src/core/model-policy/event-store"));
+const localScope = __importStar(require("../../../src/core/model-policy/local-event-scope"));
+const supervisor_1 = require("../../../src/commands/watch/supervisor");
+const admission_recovery_1 = require("../../../src/commands/watch/admission-recovery");
+const watch_1 = require("../../../src/commands/watch");
+const supervisorModule = __importStar(require("../../../src/commands/watch/supervisor"));
+const DIGEST = 'a'.repeat(64);
+const identity = { kind: 'native', version: '1.0.0', accountScopeDigest: DIGEST };
+const input = { provider: 'codex', routingIdentity: identity, controllerAutonomy: 'approval-free',
+    generationToken: 'legacy-1', reason: 'Operador verificó currentness y recibos vigentes' };
+const admitted = async () => ({ state: 'admitted', planState: 'valid', executionMode: 'desatendido', journal: 'current', currentness: 'current', sensors: 'pass', diagnostics: [] });
+const blocked = (code, currentness, sensors) => async () => ({ state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness, sensors, diagnostics: [{ code, message: 'still blocked' }] });
+describe('issue #196: admission custody recovery', () => {
+    let repo;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-admission-recovery-'));
+        (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'main'], { cwd: repo });
+        (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '--allow-empty', '-qm', 'seed'], { cwd: repo });
+        fs_1.default.mkdirSync(path_1.default.join(repo, 'plans'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, 'plans', 'cycle.md'), fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8'));
+        fs_1.default.writeFileSync(path_1.default.join(repo, 'source.md'), '## Canonical source\nfixture source\n');
+        (0, init_1.initWatch)(repo, 'main');
+        const plan = (0, validate_1.validatePlanFile)('plans/cycle.md', repo);
+        if (plan.state !== 'valid')
+            throw new Error('invalid fixture');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        state.schema = 2;
+        state.planBinding = { path: 'plans/cycle.md', digest: plan.planDigest, schema: plan.schema, executionMode: 'desatendido', boundAt: new Date().toISOString() };
+        state.generations.push({ n: 1, token: input.generationToken, state: 'terminated', launchedAt: new Date().toISOString(), provider: 'codex' });
+        state.cycle.status = 'BLOCKED';
+        state.cycle.blockedReason = 'admisión compacta desatendida bloqueada antes de dispatch: ADMISSION_CURRENTNESS_BLOCKED: Consumed contract currentness is unverifiable: registry:baseline.';
+        (0, store_1.writeJournal)(repo, 'main', state);
+        jest.spyOn(eventStore, 'readStoredEventReceipt').mockImplementation(runtime => ({ state: 'present', receipt: {
+                schema: 'routing-capabilities/v2', runtime, binaryDigest: DIGEST, configDigest: DIGEST,
+                recordedAt: new Date().toISOString(), claims: [],
+            } }));
+        jest.spyOn(localScope, 'queryLocalEventScope').mockImplementation(async (_cwd, target, kind) => ({ state: 'current', scope: {
+                runtime: { target, kind, version: identity.version, accountScopeDigest: identity.accountScopeDigest },
+                binaryDigest: DIGEST, configDigest: DIGEST,
+            } }));
+    });
+    afterEach(() => { jest.restoreAllMocks(); fs_1.default.rmSync(repo, { recursive: true, force: true }); });
+    test('legacy currentness custody resumes once with original reason, generation and nextAction retained', async () => {
+        const original = (0, store_1.readJournal)(repo, 'main').state;
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('recovered');
+        const result = (0, store_1.readJournal)(repo, 'main').state;
+        expect(result.cycle.status).toBe('IN_PROGRESS');
+        expect(result.cycle.nextAction).toEqual(original.cycle.nextAction);
+        expect(result.generations).toEqual(original.generations);
+        expect(result.tasks).toEqual(original.tasks);
+        expect(result.dispatches).toEqual(original.dispatches);
+        expect(result.jobs).toEqual(original.jobs);
+        expect(result).toHaveProperty('admissionRecoveries.0.blockedReason', original.cycle.blockedReason);
+        expect(result).toHaveProperty('admissionRecoveries.0.generationToken', input.generationToken);
+        const revision = result.revision;
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('already-recovered');
+        expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+    });
+    test('persistent unverifiable currentness → custody without generation → explicit recovery → one launch', async () => {
+        const initial = (0, store_1.readJournal)(repo, 'main').state;
+        initial.generations = [];
+        initial.cycle.status = 'IN_PROGRESS';
+        initial.cycle.blockedReason = undefined;
+        (0, store_1.writeJournal)(repo, 'main', initial);
+        let now = Date.now();
+        jest.spyOn(Date, 'now').mockImplementation(() => now);
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, routingIdentity: identity, controllerAutonomy: 'approval-free' };
+        const transient = blocked('ADMISSION_CURRENTNESS_BLOCKED', 'unverifiable', 'not-required');
+        let spawns = 0;
+        for (let i = 0; i < supervisor_1.MAX_SENSOR_DEFERRALS + 1; i++) {
+            const outcome = await new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawns++; }, undefined, transient, true).tick();
+            expect(outcome).toBe(i < supervisor_1.MAX_SENSOR_DEFERRALS ? 'continue' : 'custody');
+            now += 5000;
+        }
+        const held = (0, store_1.readJournal)(repo, 'main').state;
+        expect(held.generations).toHaveLength(0);
+        expect(held.tasks).toHaveLength(0);
+        expect(spawns).toBe(0);
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', { ...input, generationToken: undefined }, admitted)).toBe('recovered');
+        expect(await new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawns++; }, undefined, admitted, true).tick()).toBe('continue');
+        const resumed = (0, store_1.readJournal)(repo, 'main').state;
+        expect(resumed.generations).toHaveLength(1);
+        expect(resumed.cycle.nextAction).toEqual(held.cycle.nextAction);
+        expect(resumed.jobs).toEqual({});
+        expect(resumed.dispatches).toEqual([]);
+        expect(spawns).toBeGreaterThan(0);
+    });
+    test('persistent currentness and sensor failures leave custody untouched', async () => {
+        for (const [code, currentness, sensors] of [
+            ['ADMISSION_CURRENTNESS_BLOCKED', 'unverifiable', 'not-required'],
+            ['ADMISSION_SENSORS_BLOCKED', 'current', 'not-certified'],
+        ]) {
+            const revision = (0, store_1.readJournal)(repo, 'main').state.revision;
+            await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, blocked(code, currentness, sensors))).rejects.toThrow(/admisión|currentness|sensores/i);
+            expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+        }
+    });
+    test('legacy recovery refuses a missing native receipt even when v1 plan admission says admitted', async () => {
+        jest.spyOn(eventStore, 'readStoredEventReceipt').mockReturnValue({ state: 'absent' });
+        const revision = (0, store_1.readJournal)(repo, 'main').state.revision;
+        await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).rejects.toThrow(/recibo|receipt/i);
+        expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
+    });
+    test('sensor custody can recover only after sensors pass', async () => {
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        state.cycle.blockedReason = 'admisión sensors no verificable tras 3 reintentos: ADMISSION_SENSORS_BLOCKED: not-certified';
+        (0, store_1.writeJournal)(repo, 'main', state);
+        await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, blocked('ADMISSION_SENSORS_BLOCKED', 'current', 'not-certified'))).rejects.toThrow();
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('recovered');
+    });
+    test('changed binding, active request problem, pending job and identity mismatch all fail closed', async () => {
+        const check = async (mutate, pattern) => {
+            const state = (0, store_1.readJournal)(repo, 'main').state;
+            mutate(state);
+            (0, store_1.writeJournal)(repo, 'main', state);
+            const revision = (0, store_1.readJournal)(repo, 'main').state.revision;
+            await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).rejects.toThrow(pattern);
+            expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+        };
+        await check(state => { state.planBinding.digest = DIGEST; }, /binding|plan/i);
+        const validPlan = (0, validate_1.validatePlanFile)('plans/cycle.md', repo);
+        if (validPlan.state !== 'valid')
+            throw new Error('fixture changed');
+        const s1 = (0, store_1.readJournal)(repo, 'main').state;
+        s1.planBinding.digest = validPlan.planDigest;
+        (0, store_1.writeJournal)(repo, 'main', s1);
+        await check(state => { state.requestProblems.push({ file: 'rejected', kind: 'rejected', detail: 'x', at: new Date().toISOString() }); }, /request/i);
+        const s2 = (0, store_1.readJournal)(repo, 'main').state;
+        s2.requestProblems = [];
+        (0, store_1.writeJournal)(repo, 'main', s2);
+        await check(state => { state.jobs['J1'] = { id: 'J1', fingerprint: 'x', commandDigest: 'x', argv: ['true'], cwd: '.', paths: [], expandedPaths: [], executionState: 'received', observationState: 'progressing', phaseTimestamps: {} }; }, /job/i);
+        const sJob = (0, store_1.readJournal)(repo, 'main').state;
+        sJob.jobs = {};
+        (0, store_1.writeJournal)(repo, 'main', sJob);
+        await check(state => { state.generations[0].processRef = (0, process_1.captureSelfRef)('recovery-test'); }, /controller/i);
+        const sController = (0, store_1.readJournal)(repo, 'main').state;
+        sController.generations[0].processRef = undefined;
+        (0, store_1.writeJournal)(repo, 'main', sController);
+        await check(state => { state.generations[0].provider = 'claude-code'; }, /provider|identidad/i);
+        const s3 = (0, store_1.readJournal)(repo, 'main').state;
+        s3.generations[0].provider = 'codex';
+        (0, store_1.writeJournal)(repo, 'main', s3);
+        await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', { ...input, routingIdentity: { ...identity, accountScopeDigest: 'bad' } }, admitted)).rejects.toThrow(/runtime|digest/i);
+    });
+    test('an independent missing required verifier keeps the cycle BLOCKED', async () => {
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        state.requiredVerifiers = ['test'];
+        state.tasks.push({ id: 'S1', title: 'complete claim', status: 'done', attempts: 1, verificationPlan: [], reviewObligations: [] });
+        (0, store_1.writeJournal)(repo, 'main', state);
+        const revision = (0, store_1.readJournal)(repo, 'main').state.revision;
+        await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).rejects.toThrow(/verificador|required/i);
+        expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
+    });
+    test('a long-lived cycle can recover again after 128 prior audited decisions', async () => {
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        state.admissionRecoveries = Array.from({ length: 128 }, (_, index) => ({
+            at: new Date().toISOString(), reason: `prior-${index}`, blockedReason: state.cycle.blockedReason,
+            generationToken: input.generationToken, context: { provider: 'codex', runtime: identity, controllerAutonomy: 'approval-free' },
+            planDigest: state.planBinding.digest, assertion: 'legacy-operator-asserted',
+        }));
+        (0, store_1.writeJournal)(repo, 'main', state);
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('recovered');
+        expect((0, store_1.readJournal)(repo, 'main').state.admissionRecoveries).toHaveLength(129);
+    });
+    test('after audited recovery supervisor still rechecks admission before any dispatch', async () => {
+        await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted);
+        let spawns = 0;
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, provider: 'codex', routingIdentity: identity, controllerAutonomy: 'approval-free' };
+        const sup = new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawns++; }, undefined, blocked('ADMISSION_CURRENTNESS_BLOCKED', 'unverifiable', 'not-required'));
+        expect(await sup.tick()).toBe('continue');
+        expect(spawns).toBe(0);
+        expect((0, store_1.readJournal)(repo, 'main').state.tasks).toHaveLength(0);
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.nextAction?.actionId).toBe('bootstrap-cycle');
+    });
+    test('public watch recover-admission CLI records one offline transition', async () => {
+        const before = (0, store_1.readJournal)(repo, 'main').state;
+        before.tasks.push({ id: 'S1', title: 'pending work', status: 'pending', attempts: 0, verificationPlan: [], reviewObligations: [] });
+        (0, store_1.writeJournal)(repo, 'main', before);
+        jest.spyOn(supervisorModule, 'admissionForConfig').mockReturnValue(admitted);
+        const cwd = jest.spyOn(process, 'cwd').mockReturnValue(repo);
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, watch_1.registerWatchCommand)(program);
+        try {
+            await program.parseAsync(['node', 'awm', 'watch', 'recover-admission',
+                '--provider', 'codex', '--runtime-kind', identity.kind, '--runtime-version', identity.version,
+                '--account-scope-digest', identity.accountScopeDigest, '--controller-autonomy', 'approval-free',
+                '--generation', input.generationToken, '--reason', input.reason]);
+            expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('IN_PROGRESS');
+            expect(stdout.mock.calls.map(call => String(call[0])).join('')).toContain('"recovered":true');
+            let spawned = 0;
+            const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, provider: 'codex', routingIdentity: identity, controllerAutonomy: 'approval-free' };
+            const outcome = await new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawned++; }, undefined, admitted, true).tick();
+            expect({ outcome, blockedReason: (0, store_1.readJournal)(repo, 'main').state.cycle.blockedReason }).toEqual({ outcome: 'continue', blockedReason: undefined });
+            const resumed = (0, store_1.readJournal)(repo, 'main').state;
+            expect(resumed.tasks.map(task => task.id)).toEqual(['S1']);
+            expect(resumed.jobs).toEqual({});
+            expect(resumed.dispatches).toEqual([]);
+            expect(resumed.cycle.nextAction?.actionId).toBe('bootstrap-cycle');
+            expect(resumed.generations).toHaveLength(2);
+            expect(spawned).toBeGreaterThan(0);
+        }
+        finally {
+            cwd.mockRestore();
+            stdout.mockRestore();
+        }
+    });
+    test('CLI requires provider to be asserted, not inherited from the watch default', async () => {
+        const cwd = jest.spyOn(process, 'cwd').mockReturnValue(repo);
+        const stderr = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        const program = new commander_1.Command();
+        (0, watch_1.registerWatchCommand)(program);
+        try {
+            await program.parseAsync(['node', 'awm', 'watch', 'recover-admission',
+                '--runtime-kind', identity.kind, '--runtime-version', identity.version,
+                '--account-scope-digest', identity.accountScopeDigest, '--controller-autonomy', 'approval-free',
+                '--generation', input.generationToken, '--reason', input.reason]);
+            expect(stderr.mock.calls.map(call => String(call[0])).join('')).toMatch(/--provider/);
+            expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
+        }
+        finally {
+            cwd.mockRestore();
+            stderr.mockRestore();
+            process.exitCode = 0;
+        }
+    });
+});

package/dist/tests/commands/watch/supervisor-loop.test.js

@@ -416,9 +416,12 @@ describe('supervisor loop', () => {
         });
         let spawned = 0;
         const sup = new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, () => { spawned += 1; }, undefined, notCertified);
+        let now = Date.now();
+        jest.spyOn(Date, 'now').mockImplementation(() => now);
         for (let i = 0; i < supervisor_1.MAX_SENSOR_DEFERRALS; i += 1) {
             expect(await sup.tick()).toBe('continue');
             expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('IN_PROGRESS');
+            now += 5000;
         }
         // The verdict never settled, so the supervisor must stop pretending it might.
         expect(await sup.tick()).toBe('custody');
@@ -443,6 +446,91 @@ describe('supervisor loop', () => {
         // Deferring dispatch was right throughout, and stays right.
         expect(spawned).toBe(0);
     });
+    test('unverifiable currentness retries durably across supervisor restart and does not spawn before admitted', async () => {
+        initUnattendedFixture(repo);
+        let now = Date.now();
+        jest.spyOn(Date, 'now').mockImplementation(() => now);
+        let verdict = 'unverifiable';
+        const observe = async () => verdict === 'unverifiable'
+            ? { state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness: 'unverifiable', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_CURRENTNESS_BLOCKED', message: 'registry:baseline' }] }
+            : admitted();
+        let spawned = 0;
+        const spawn = () => { spawned += 1; };
+        expect(await new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, spawn, undefined, observe, true).tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).toHaveProperty('admissionRetry.attempts', 1);
+        expect((0, store_1.readJournal)(repo, 'main').state.generations).toHaveLength(0);
+        expect(spawned).toBe(0);
+        // New supervisor instance represents a process restart. Repeated early
+        // ticks cannot spend or reset the durable retry budget.
+        const restarted = new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, spawn, undefined, observe, true);
+        expect(await restarted.tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).toHaveProperty('admissionRetry.attempts', 1);
+        now += 5000;
+        verdict = 'current';
+        expect(await restarted.tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).not.toHaveProperty('admissionRetry');
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('IN_PROGRESS');
+        expect((0, store_1.readJournal)(repo, 'main').state.generations).toHaveLength(1);
+        expect(spawned).toBeGreaterThan(0);
+    });
+    test('stale currentness is conclusive and never receives transient retry budget', async () => {
+        initUnattendedFixture(repo);
+        const blocked = async () => ({ state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'current', currentness: 'stale', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_CURRENTNESS_BLOCKED', message: 'stale' }] });
+        let spawned = 0;
+        expect(await new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, () => { spawned++; }, undefined, blocked).tick()).toBe('custody');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        expect(state.cycle.status).toBe('BLOCKED');
+        expect(state).not.toHaveProperty('admissionRetry');
+        expect(state.generations).toHaveLength(0);
+        expect(spawned).toBe(0);
+    });
+    test('first admission observation binds provider, runtime and autonomy; changed restart identity never dispatches', async () => {
+        initUnattendedFixture(repo);
+        const identity = { kind: 'native', version: '1.0.0', accountScopeDigest: 'a'.repeat(64) };
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, routingIdentity: identity, controllerAutonomy: 'approval-free' };
+        const notCurrent = async () => ({ state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness: 'unverifiable', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_CURRENTNESS_BLOCKED', message: 'temporary' }] });
+        let spawns = 0;
+        expect(await new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawns++; }, undefined, notCurrent).tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).toHaveProperty('admissionContext', { provider: 'codex', runtime: identity, controllerAutonomy: 'approval-free' });
+        const changed = { ...cfg, routingIdentity: { ...identity, accountScopeDigest: 'b'.repeat(64) } };
+        expect(await new supervisor_1.Supervisor(repo, 'main', changed, () => { spawns++; }, undefined, admitted).tick()).toBe('custody');
+        expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
+        expect(spawns).toBe(0);
+    });
+    test('alternating transient causes share one durable retry budget', async () => {
+        initUnattendedFixture(repo);
+        let now = Date.now();
+        jest.spyOn(Date, 'now').mockImplementation(() => now);
+        let reads = 0;
+        const alternating = async () => {
+            const sensor = reads++ % 2 === 1;
+            return sensor
+                ? { state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness: 'current', sensors: 'not-certified', diagnostics: [{ code: 'ADMISSION_SENSORS_BLOCKED', message: 'temporary' }] }
+                : { state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness: 'unverifiable', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_CURRENTNESS_BLOCKED', message: 'temporary' }] };
+        };
+        let spawns = 0;
+        for (let i = 0; i < supervisor_1.MAX_SENSOR_DEFERRALS + 1; i++) {
+            const outcome = await new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, () => { spawns++; }, undefined, alternating).tick();
+            expect(outcome).toBe(i < supervisor_1.MAX_SENSOR_DEFERRALS ? 'continue' : 'custody');
+            now += 5000;
+        }
+        expect(reads).toBe(supervisor_1.MAX_SENSOR_DEFERRALS + 1);
+        expect(spawns).toBe(0);
+        expect((0, store_1.readJournal)(repo, 'main').state.generations).toHaveLength(0);
+    });
+    test('an incomplete first configuration can be corrected before dispatch without trapping the cycle', async () => {
+        initUnattendedFixture(repo);
+        const notCurrent = async () => ({ state: 'blocked', planState: 'valid', executionMode: 'desatendido', journal: 'not-required', currentness: 'unverifiable', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_CURRENTNESS_BLOCKED', message: 'temporary' }] });
+        let spawned = 0;
+        expect(await new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, () => { spawned++; }, undefined, notCurrent).tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).not.toHaveProperty('admissionContext');
+        const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, routingIdentity: { kind: 'native', version: '1.0.0', accountScopeDigest: 'a'.repeat(64) }, controllerAutonomy: 'approval-free' };
+        const retry = (0, store_1.readJournal)(repo, 'main').state.admissionRetry;
+        jest.spyOn(Date, 'now').mockReturnValue(Date.parse(retry.nextRetryAt));
+        expect(await new supervisor_1.Supervisor(repo, 'main', cfg, () => { spawned++; }, undefined, admitted, true).tick()).toBe('continue');
+        expect((0, store_1.readJournal)(repo, 'main').state).toHaveProperty('admissionContext', { provider: 'codex', runtime: cfg.routingIdentity, controllerAutonomy: 'approval-free' });
+        expect(spawned).toBeGreaterThan(0);
+    });
     test('una admisión compacta bloqueada no lanza controlador ni wrappers', async () => {
         initUnattendedFixture(repo);
         const state = (0, store_1.readJournal)(repo, 'main').state;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.12.1",
+  "version": "9.12.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"