F2.3: alinear versión de paquete API

F2.2: contrato seguro de autenticación Android

.github/workflows/android.yml

@@ -0,0 +1,60 @@
+name: Android APK
+
+on:
+  push:
+    branches:
+      - 'feature/f2-2*'
+      - 'feature/f2-3*'
+    paths:
+      - 'android-app/**'
+      - '.github/workflows/android.yml'
+  pull_request:
+    paths:
+      - 'android-app/**'
+      - 'api-v3/src/auth/**'
+      - '.github/workflows/android.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-debug-apk:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Android API 36
+        run: sdkmanager 'platforms;android-36' 'build-tools;36.0.0'
+
+      - name: Gradle 8.13
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.13'
+
+      - name: Assemble debug
+        working-directory: android-app
+        run: gradle --no-daemon :app:assembleDebug
+
+      - name: Unit tests
+        working-directory: android-app
+        run: gradle --no-daemon :app:testDebugUnitTest
+
+      - name: Upload APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: DH-Inspeccion-F2.3-0.10.2-debug
+          path: android-app/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/f2-2-ci.yml

@@ -0,0 +1,136 @@
+name: F2.2 Integration CI
+
+on:
+  push:
+    branches:
+      - 'feature/f2-2*'
+    paths:
+      - 'api-v3/**'
+      - 'web-v2/**'
+      - 'scripts/**'
+      - 'docker-compose.yml'
+      - '.github/workflows/f2-2-ci.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  api:
+    name: API · typecheck, tests, build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build
+
+  migrations:
+    name: DB · migrations on PostgreSQL 16/PostGIS
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgis/postgis:16-3.4
+        env:
+          POSTGRES_USER: dhv2_owner
+          POSTGRES_PASSWORD: owner_test_password
+          POSTGRES_DB: dhv2_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U dhv2_owner -d dhv2_ci"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 20
+    env:
+      DB_HOST: 127.0.0.1
+      DB_PORT: 5432
+      DB_NAME: dhv2_ci
+      DB_MIGRATION_USER: dhv2_owner
+      DB_MIGRATION_PASSWORD: owner_test_password
+      DB_APP_USER: dhv2_app
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - name: PostgreSQL client
+        run: |
+          command -v psql >/dev/null || {
+            sudo apt-get update
+            sudo apt-get install -y postgresql-client
+          }
+      - name: Prepare roles and extensions
+        env:
+          PGPASSWORD: owner_test_password
+        run: |
+          psql -v ON_ERROR_STOP=1 -h 127.0.0.1 -U dhv2_owner -d dhv2_ci <<'SQL'
+          CREATE EXTENSION IF NOT EXISTS postgis;
+          CREATE EXTENSION IF NOT EXISTS pgcrypto;
+          DO $$
+          BEGIN
+            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname='dhv2_app') THEN
+              CREATE ROLE dhv2_app LOGIN PASSWORD 'app_test_password';
+            END IF;
+          END
+          $$;
+          GRANT CONNECT ON DATABASE dhv2_ci TO dhv2_app;
+          GRANT USAGE ON SCHEMA public TO dhv2_app;
+
+          -- This reset was a one-time late production operation. It is marked as
+          -- executed on the clean CI database so the historical schema can be
+          -- constructed chronologically without running that production-only wipe.
+          CREATE TABLE IF NOT EXISTS typeorm_migrations (
+            id SERIAL PRIMARY KEY,
+            timestamp bigint NOT NULL,
+            name varchar NOT NULL
+          );
+          INSERT INTO typeorm_migrations (timestamp,name)
+          VALUES (1788652800000,'ResetProductionOperationalData1788652800000');
+          SQL
+      - run: npm ci
+      - run: npm run build
+      - name: Run every pending migration
+        run: npm run migration:run
+      - name: Assert no pending migrations
+        run: |
+          npm run migration:show | tee /tmp/migrations.txt
+          grep -Fq 'Pending migrations: no' /tmp/migrations.txt
+      - name: Assert F2.2.1 reference import
+        env:
+          PGPASSWORD: owner_test_password
+        run: |
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM assets a JOIN asset_types t ON t.id=a.asset_type_id WHERE a.data_origin='IMPORT' AND a.source_name='Tablas de yacimiento(1).xlsx' AND lower(t.code)='yacimiento'")" = "230"
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM assets WHERE (operational_area_id IS NULL) <> (operator_company_id IS NULL)")" = "0"
+          test "$(psql -At -h 127.0.0.1 -U dhv2_owner -d dhv2_ci -c "SELECT count(*) FROM source_documents WHERE document_number IN ('DH-F221-TERRITORIO','DH-F221-APP')")" = "2"
+
+  web:
+    name: WEB · typecheck, build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web-v2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: web-v2/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build

.github/workflows/f2-3-ci.yml

@@ -0,0 +1,62 @@
+name: F2.3 Field Finding CI
+
+on:
+  push:
+    branches:
+      - 'feature/f2-3*'
+    paths:
+      - 'api-v3/**'
+      - '.github/workflows/f2-3-ci.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  api:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: api-v3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Node 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: api-v3/package-lock.json
+      - name: Install
+        run: npm ci
+      - name: Typecheck
+        run: npm run typecheck 2>&1 | tee typecheck.log
+      - name: Upload TypeScript diagnostic
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: f2-3-typecheck-diagnostic
+          path: api-v3/typecheck.log
+          if-no-files-found: warn
+          retention-days: 3
+      - name: Tests
+        run: npm test 2>&1 | tee test.log
+      - name: Upload test diagnostic
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: f2-3-test-diagnostic
+          path: api-v3/test.log
+          if-no-files-found: warn
+          retention-days: 3
+      - name: Build
+        run: npm run build 2>&1 | tee build.log
+      - name: Upload build diagnostic
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: f2-3-build-diagnostic
+          path: api-v3/build.log
+          if-no-files-found: warn
+          retention-days: 3

android-app/app/build.gradle.kts

@@ -0,0 +1,80 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+    id("org.jetbrains.kotlin.plugin.compose")
+}
+
+android {
+    namespace = "com.korexlabs.dhinspeccion"
+    compileSdk = 36
+
+    defaultConfig {
+        applicationId = "com.korexlabs.dhinspeccion"
+        minSdk = 26
+        targetSdk = 36
+        versionCode = 16
+        versionName = "0.10.2"
+
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        vectorDrawables.useSupportLibrary = true
+        buildConfigField("String", "API_BASE_URL", "\"https://dhv2.korexlabs.com/api/v3/\"")
+    }
+
+    buildTypes {
+        debug {
+            applicationIdSuffix = ".debug"
+            versionNameSuffix = "-debug"
+        }
+        release {
+            isMinifyEnabled = false
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+            )
+            // La firma de release NO se redefine aquí. Se conservará la clave histórica.
+        }
+    }
+
+    buildFeatures {
+        compose = true
+        buildConfig = true
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    kotlinOptions.jvmTarget = "17"
+
+    packaging.resources.excludes += "/META-INF/{AL2.0,LGPL2.1}"
+}
+
+dependencies {
+    val composeBom = platform("androidx.compose:compose-bom:2025.08.01")
+    implementation(composeBom)
+    androidTestImplementation(composeBom)
+
+    implementation("androidx.core:core-ktx:1.17.0")
+    implementation("androidx.activity:activity-compose:1.10.1")
+    implementation("androidx.fragment:fragment-ktx:1.8.9")
+    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.9.2")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.9.2")
+    implementation("androidx.compose.material3:material3")
+    implementation("androidx.compose.material:material-icons-extended")
+    implementation("androidx.compose.ui:ui")
+    implementation("androidx.compose.ui:ui-tooling-preview")
+    implementation("androidx.biometric:biometric:1.1.0")
+    debugImplementation("androidx.compose.ui:ui-tooling")
+
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.10.2")
+    implementation("com.squareup.retrofit2:retrofit:2.11.0")
+    implementation("com.squareup.retrofit2:converter-moshi:2.11.0")
+    implementation("com.squareup.moshi:moshi-kotlin:1.15.2")
+    implementation("com.squareup.okhttp3:okhttp:4.12.0")
+    implementation("com.google.android.gms:play-services-location:21.3.0")
+    implementation("androidx.exifinterface:exifinterface:1.4.1")
+
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.2.1")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.6.1")
+}

android-app/app/proguard-rules.pro

@@ -0,0 +1 @@
+# DH Inspección V2. Las reglas se ampliarán cuando se habilite minificación de release.

android-app/app/src/main/AndroidManifest.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+
+    <application
+        android:allowBackup="false"
+        android:label="@string/app_name"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.DHInspeccion"
+        android:usesCleartextTraffic="false">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.files"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

android-app/app/src/main/java/com/korexlabs/dhinspeccion/MainActivity.kt

@@ -0,0 +1,19 @@
+package com.korexlabs.dhinspeccion
+
+import android.os.Bundle
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.fragment.app.FragmentActivity
+import androidx.lifecycle.viewmodel.compose.viewModel
+import com.korexlabs.dhinspeccion.ui.DhRoot
+
+class MainActivity : FragmentActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        enableEdgeToEdge()
+        setContent {
+            val model: MainViewModel = viewModel()
+            DhRoot(model, this@MainActivity)
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/MainViewModel.kt

@@ -0,0 +1,291 @@
+package com.korexlabs.dhinspeccion
+
+import android.app.Application
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.lifecycle.AndroidViewModel
+import androidx.lifecycle.viewModelScope
+import com.korexlabs.dhinspeccion.data.CreateFieldFindingRequest
+import com.korexlabs.dhinspeccion.data.CreateFieldInventoryRequest
+import com.korexlabs.dhinspeccion.data.DhRepository
+import com.korexlabs.dhinspeccion.data.FieldAssetDetail
+import com.korexlabs.dhinspeccion.data.FieldFindingItem
+import com.korexlabs.dhinspeccion.data.FieldFindingOptionsResponse
+import com.korexlabs.dhinspeccion.data.FieldFindingsRepository
+import com.korexlabs.dhinspeccion.data.FieldInventoryItem
+import com.korexlabs.dhinspeccion.data.FieldType
+import com.korexlabs.dhinspeccion.data.StoredSession
+import com.korexlabs.dhinspeccion.data.VisitDetail
+import com.korexlabs.dhinspeccion.data.VisitSummary
+import kotlinx.coroutines.launch
+import java.io.File
+import java.time.Instant
+
+class MainViewModel(application: Application) : AndroidViewModel(application) {
+    private val repository = DhRepository(application)
+    private val findingsRepository = FieldFindingsRepository(application)
+
+    var session: StoredSession? by mutableStateOf(repository.currentSession())
+        private set
+    var busy by mutableStateOf(false)
+        private set
+    var error: String? by mutableStateOf(null)
+        private set
+    var notice: String? by mutableStateOf(null)
+        private set
+
+    var visits: List<VisitSummary> by mutableStateOf(emptyList())
+        private set
+    var visit: VisitDetail? by mutableStateOf(null)
+        private set
+
+    var inventory: List<FieldInventoryItem> by mutableStateOf(emptyList())
+        private set
+    var fieldTypes: List<FieldType> by mutableStateOf(emptyList())
+        private set
+    var selectedFieldAsset: FieldAssetDetail? by mutableStateOf(null)
+        private set
+
+    var fieldFindingOptions: FieldFindingOptionsResponse? by mutableStateOf(null)
+        private set
+    var lastCreatedFinding: FieldFindingItem? by mutableStateOf(null)
+        private set
+
+    init {
+        if (session != null) loadVisits()
+    }
+
+    fun clearMessages() {
+        error = null
+        notice = null
+    }
+
+    fun login(identifier: String, password: String) {
+        if (identifier.isBlank() || password.isBlank()) {
+            error = "Ingresá usuario y contraseña."
+            return
+        }
+        launchBusy {
+            session = repository.login(identifier, password)
+            notice = "Sesión iniciada."
+            loadVisitsInternal()
+        }
+    }
+
+    fun logout() {
+        viewModelScope.launch {
+            runCatching { repository.logout() }
+            session = null
+            visits = emptyList()
+            visit = null
+            inventory = emptyList()
+            fieldTypes = emptyList()
+            selectedFieldAsset = null
+            fieldFindingOptions = null
+            lastCreatedFinding = null
+        }
+    }
+
+    fun loadVisits() = launchBusy { loadVisitsInternal() }
+
+    private suspend fun loadVisitsInternal() {
+        visits = repository.visits().data
+    }
+
+    fun openVisit(id: String) = launchBusy {
+        visit = repository.visit(id)
+        inventory = emptyList()
+        fieldTypes = emptyList()
+        selectedFieldAsset = null
+        fieldFindingOptions = null
+        lastCreatedFinding = null
+    }
+
+    fun closeVisitView() {
+        visit = null
+        inventory = emptyList()
+        fieldTypes = emptyList()
+        selectedFieldAsset = null
+        fieldFindingOptions = null
+        lastCreatedFinding = null
+        loadVisits()
+    }
+
+    fun startVisit() {
+        val id = visit?.id ?: return
+        launchBusy {
+            visit = repository.startVisit(id)
+            notice = "Inspección iniciada."
+            loadVisitsInternal()
+        }
+    }
+
+    fun searchInventory(search: String, parentId: String? = null) {
+        val id = visit?.id ?: return
+        launchBusy {
+            inventory = repository.fieldInventory(id, search, parentId).data
+        }
+    }
+
+    fun loadFieldTypes(parentId: String? = null) {
+        val id = visit?.id ?: return
+        launchBusy {
+            fieldTypes = repository.fieldTypes(id, parentId).data
+        }
+    }
+
+    fun selectExisting(item: FieldInventoryItem) {
+        val visitId = visit?.id ?: return
+        launchBusy {
+            selectedFieldAsset = repository.selectFieldAsset(visitId, item.id)
+            notice = "Inventario agregado a la inspección."
+            inventory = repository.fieldInventory(visitId, null, null).data
+            if (selectedFieldAsset?.capture?.readyForFinding == true) {
+                loadFindingOptionsInternal(visitId, item.id)
+            }
+        }
+    }
+
+    fun createFieldAsset(
+        type: FieldType,
+        parentId: String?,
+        name: String,
+        commonName: String?,
+        attributes: Map<String, Any?>,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+    ) {
+        val visitId = visit?.id ?: return
+        if (visit?.status != "IN_PROGRESS") {
+            error = "La inspección debe estar en curso para dar de alta Inventario."
+            return
+        }
+        launchBusy {
+            val request = CreateFieldInventoryRequest(
+                typeId = type.id,
+                parentId = parentId,
+                name = name.trim(),
+                commonName = commonName?.trim()?.takeIf { it.isNotBlank() },
+                attributes = attributes,
+                deviceLatitude = latitude,
+                deviceLongitude = longitude,
+                deviceAccuracyM = accuracyM,
+                deviceCapturedAt = Instant.now().toString(),
+            )
+            selectedFieldAsset = repository.createFieldAsset(visitId, request)
+            notice = "Inventario creado con GPS. Falta la fotografía obligatoria."
+            inventory = repository.fieldInventory(visitId, null, null).data
+        }
+    }
+
+    fun uploadFieldPhoto(
+        file: File,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+    ) {
+        val visitId = visit?.id ?: return
+        val asset = selectedFieldAsset?.asset ?: return
+        launchBusy {
+            val response = repository.uploadFieldPhoto(
+                visitId = visitId,
+                assetId = asset.id,
+                file = file,
+                latitude = latitude,
+                longitude = longitude,
+                accuracyM = accuracyM,
+            )
+            selectedFieldAsset = selectedFieldAsset?.copy(capture = response.capture)
+            notice = if (response.capture.readyForFinding) {
+                "Captura completa: GPS y fotografía registrados."
+            } else {
+                "Fotografía registrada."
+            }
+            inventory = repository.fieldInventory(visitId, null, null).data
+            if (response.capture.readyForFinding) {
+                loadFindingOptionsInternal(visitId, asset.id)
+            }
+        }
+    }
+
+    fun openFindingForSelected() {
+        val visitId = visit?.id ?: return
+        val assetId = selectedFieldAsset?.asset?.id ?: return
+        launchBusy { loadFindingOptionsInternal(visitId, assetId) }
+    }
+
+    fun createFieldFinding(
+        catalogItemId: String?,
+        customTitle: String?,
+        customLegalBasis: String?,
+        description: String,
+        severity: Int?,
+        correctionDueOn: String?,
+    ) {
+        val visitId = visit?.id ?: return
+        val assetId = selectedFieldAsset?.asset?.id ?: return
+        if (description.isBlank()) {
+            error = "Describí el Hallazgo antes de guardarlo."
+            return
+        }
+        if (catalogItemId == null && customTitle.isNullOrBlank()) {
+            error = "Para OTROS, indicá un título para el Hallazgo."
+            return
+        }
+        if (severity != null && severity !in 1..10) {
+            error = "La gravedad debe estar entre 1 y 10."
+            return
+        }
+        launchBusy {
+            val response = findingsRepository.create(
+                visitId,
+                assetId,
+                CreateFieldFindingRequest(
+                    catalogItemId = catalogItemId,
+                    customTitle = customTitle?.trim()?.takeIf { it.isNotBlank() },
+                    customLegalBasis = customLegalBasis?.trim()?.takeIf { it.isNotBlank() },
+                    description = description.trim(),
+                    severity = severity,
+                    correctionDueOn = correctionDueOn?.trim()?.takeIf { it.isNotBlank() },
+                ),
+            )
+            lastCreatedFinding = response.finding
+            notice = "Hallazgo ${response.finding.code} registrado."
+            fieldFindingOptions = findingsRepository.options(visitId, assetId)
+        }
+    }
+
+    fun clearFindingFlow() {
+        fieldFindingOptions = null
+        lastCreatedFinding = null
+        error = null
+    }
+
+    fun clearSelectedFieldAsset() {
+        selectedFieldAsset = null
+        fieldFindingOptions = null
+        lastCreatedFinding = null
+    }
+
+    private suspend fun loadFindingOptionsInternal(visitId: String, assetId: String) {
+        fieldFindingOptions = findingsRepository.options(visitId, assetId)
+        lastCreatedFinding = null
+    }
+
+    private fun launchBusy(block: suspend () -> Unit) {
+        viewModelScope.launch {
+            busy = true
+            error = null
+            try {
+                block()
+            } catch (throwable: Throwable) {
+                error = DhRepository.humanError(throwable)
+                if (repository.currentSession() == null) session = null
+            } finally {
+                busy = false
+            }
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/data/DhMobile.kt

@@ -0,0 +1,531 @@
+package com.korexlabs.dhinspeccion.data
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import com.korexlabs.dhinspeccion.BuildConfig
+import com.squareup.moshi.Moshi
+import com.squareup.moshi.kotlin.reflect.KotlinJsonAdapterFactory
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.MultipartBody
+import okhttp3.OkHttpClient
+import okhttp3.RequestBody.Companion.asRequestBody
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONObject
+import retrofit2.HttpException
+import retrofit2.Retrofit
+import retrofit2.converter.moshi.MoshiConverterFactory
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.Multipart
+import retrofit2.http.POST
+import retrofit2.http.Part
+import retrofit2.http.Path
+import retrofit2.http.Query
+import java.io.File
+import java.security.KeyStore
+import java.time.Instant
+import java.util.UUID
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+// ---------- Auth ----------
+
+data class LoginRequest(
+    val identifier: String,
+    val password: String,
+    val deviceLabel: String = "DH Android",
+)
+
+data class RefreshRequest(val refreshToken: String)
+
+data class MobileUser(
+    val id: String,
+    val username: String,
+    val firstName: String? = null,
+    val lastName: String? = null,
+    val email: String? = null,
+    val mustChangePassword: Boolean = false,
+    val roles: List<String> = emptyList(),
+    val permissions: List<String> = emptyList(),
+)
+
+data class MobileSessionResponse(
+    val user: MobileUser,
+    val accessToken: String,
+    val refreshToken: String,
+    val accessExpiresInSeconds: Long,
+)
+
+data class StoredSession(
+    val userId: String,
+    val username: String,
+    val displayName: String,
+    val accessToken: String,
+    val refreshToken: String,
+)
+
+// ---------- Inspections ----------
+
+data class AssetSummary(
+    val id: String,
+    val code: String,
+    val name: String,
+    val typeName: String? = null,
+)
+
+data class PersonSummary(
+    val id: String,
+    val username: String? = null,
+    val firstName: String? = null,
+    val lastName: String? = null,
+)
+
+data class VisitSummary(
+    val id: String,
+    val code: String,
+    val title: String? = null,
+    val objective: String? = null,
+    val status: String,
+    val scopeAsset: AssetSummary? = null,
+    val operationalArea: AssetSummary? = null,
+    val operatorCompany: AssetSummary? = null,
+    val leadInspector: PersonSummary? = null,
+    val plannedStartAt: String? = null,
+    val actualStartedAt: String? = null,
+    val actualClosedAt: String? = null,
+    val instructions: String? = null,
+    val checklistGeneration: Int = 0,
+    val assetCount: Int = 0,
+    val memberCount: Int = 0,
+)
+
+data class VisitMeta(
+    val page: Int,
+    val pageSize: Int,
+    val total: Int,
+    val totalPages: Int,
+)
+
+data class VisitListResponse(val data: List<VisitSummary>, val meta: VisitMeta)
+
+data class PlannedAsset(
+    val id: String,
+    val code: String,
+    val name: String,
+    val typeName: String? = null,
+    val included: Boolean = true,
+    val planningSource: String? = null,
+    val exclusionReason: String? = null,
+)
+
+data class ChecklistItem(
+    val id: String,
+    val findingId: String? = null,
+    val findingCode: String? = null,
+    val findingTitle: String? = null,
+    val findingStatus: String? = null,
+    val severity: Int? = null,
+    val itemKind: String? = null,
+    val referenceOn: String? = null,
+    val asset: AssetSummary? = null,
+    val assetIncluded: Boolean = true,
+)
+
+data class ChecklistSummary(
+    val generation: Int = 0,
+    val stale: Boolean = false,
+    val antecedents: Int = 0,
+    val companyOverdue: Int = 0,
+    val verificationOverdue: Int = 0,
+    val upcomingControls: Int = 0,
+    val actionableAssets: Int = 0,
+    val excludedAssets: Int = 0,
+    val items: List<ChecklistItem> = emptyList(),
+)
+
+data class VisitDetail(
+    val id: String,
+    val code: String,
+    val title: String? = null,
+    val objective: String? = null,
+    val status: String,
+    val operationalArea: AssetSummary? = null,
+    val operatorCompany: AssetSummary? = null,
+    val leadInspector: PersonSummary? = null,
+    val plannedStartAt: String? = null,
+    val actualStartedAt: String? = null,
+    val actualClosedAt: String? = null,
+    val instructions: String? = null,
+    val assets: List<AssetSummary> = emptyList(),
+    val planningAssets: List<PlannedAsset> = emptyList(),
+    val team: List<PersonSummary> = emptyList(),
+    val checklist: ChecklistSummary = ChecklistSummary(),
+)
+
+// ---------- Field inventory ----------
+
+data class FieldContext(
+    val visitId: String? = null,
+    val visitCode: String? = null,
+    val areaId: String? = null,
+    val areaCode: String? = null,
+    val areaName: String? = null,
+    val companyId: String? = null,
+    val companyCode: String? = null,
+    val companyName: String? = null,
+)
+
+data class FieldInventoryItem(
+    val id: String,
+    val code: String,
+    val name: String,
+    val commonName: String? = null,
+    val informationStatus: String? = null,
+    val dataOrigin: String? = null,
+    val type: AssetSummary? = null,
+    val parent: AssetSummary? = null,
+    val selectedInInspection: Boolean = false,
+    val captureRequired: Boolean = false,
+    val hasGeometry: Boolean = false,
+    val fieldPhotoCount: Int = 0,
+    val readyForFinding: Boolean = true,
+)
+
+data class FieldInventoryListResponse(
+    val context: FieldContext,
+    val data: List<FieldInventoryItem>,
+)
+
+data class FieldAttributeDefinition(
+    val id: String,
+    val code: String,
+    val name: String,
+    val dataType: String,
+    val isRequired: Boolean = false,
+    val unit: String? = null,
+    val options: Any? = null,
+    val sortOrder: Int = 0,
+)
+
+data class FieldType(
+    val id: String,
+    val code: String,
+    val name: String,
+    val description: String? = null,
+    val attributes: List<FieldAttributeDefinition> = emptyList(),
+)
+
+data class FieldTypeResponse(
+    val context: FieldContext,
+    val parent: AssetSummary,
+    val data: List<FieldType>,
+)
+
+data class CaptureStatus(
+    val captureRequired: Boolean = false,
+    val hasGeometry: Boolean = false,
+    val creationGpsCaptured: Boolean = false,
+    val fieldPhotoCount: Int = 0,
+    val readyForFinding: Boolean = true,
+)
+
+data class FieldAssetDetail(
+    val context: FieldContext? = null,
+    val asset: FieldInventoryItem,
+    val selectedInInspection: Boolean = true,
+    val capture: CaptureStatus = CaptureStatus(),
+)
+
+data class CreateFieldInventoryRequest(
+    val typeId: String,
+    val parentId: String? = null,
+    val code: String? = null,
+    val name: String,
+    val commonName: String? = null,
+    val description: String? = null,
+    val discoveryNotes: String? = null,
+    val attributes: Map<String, Any?>,
+    val deviceLatitude: Double,
+    val deviceLongitude: Double,
+    val deviceAccuracyM: Double? = null,
+    val deviceCapturedAt: String,
+    val deviceLabel: String = "DH Android",
+)
+
+data class FieldPhotoResponse(
+    val capture: CaptureStatus,
+)
+
+interface DhApi {
+    @POST("auth/mobile/login")
+    suspend fun login(@Body request: LoginRequest): MobileSessionResponse
+
+    @POST("auth/mobile/refresh")
+    suspend fun refresh(@Body request: RefreshRequest): MobileSessionResponse
+
+    @POST("auth/mobile/logout")
+    suspend fun logout(@Header("Authorization") authorization: String): Map<String, Any?>
+
+    @GET("inspection-visits")
+    suspend fun visits(
+        @Header("Authorization") authorization: String,
+        @Query("inspectorId") inspectorId: String,
+        @Query("pageSize") pageSize: Int = 100,
+    ): VisitListResponse
+
+    @GET("inspection-visits/{id}")
+    suspend fun visit(
+        @Header("Authorization") authorization: String,
+        @Path("id") id: String,
+    ): VisitDetail
+
+    @POST("inspection-visits/{id}/start")
+    suspend fun startVisit(
+        @Header("Authorization") authorization: String,
+        @Path("id") id: String,
+    ): VisitDetail
+
+    @GET("inspection-visits/{visitId}/field-inventory")
+    suspend fun fieldInventory(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Query("search") search: String? = null,
+        @Query("parentId") parentId: String? = null,
+        @Query("limit") limit: Int = 80,
+    ): FieldInventoryListResponse
+
+    @GET("inspection-visits/{visitId}/field-inventory/types")
+    suspend fun fieldTypes(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Query("parentId") parentId: String? = null,
+    ): FieldTypeResponse
+
+    @POST("inspection-visits/{visitId}/field-inventory/{assetId}/select")
+    suspend fun selectFieldAsset(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+    ): FieldAssetDetail
+
+    @POST("inspection-visits/{visitId}/field-inventory")
+    suspend fun createFieldAsset(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Body request: CreateFieldInventoryRequest,
+    ): FieldAssetDetail
+
+    @Multipart
+    @POST("inspection-visits/{visitId}/field-inventory/{assetId}/photos")
+    suspend fun uploadFieldPhoto(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+        @Part file: MultipartBody.Part,
+        @Part("deviceLatitude") latitude: okhttp3.RequestBody,
+        @Part("deviceLongitude") longitude: okhttp3.RequestBody,
+        @Part("deviceAccuracyM") accuracy: okhttp3.RequestBody?,
+        @Part("deviceCapturedAt") capturedAt: okhttp3.RequestBody,
+        @Part("deviceLabel") deviceLabel: okhttp3.RequestBody,
+        @Part("exifLatitude") exifLatitude: okhttp3.RequestBody?,
+        @Part("exifLongitude") exifLongitude: okhttp3.RequestBody?,
+        @Part("exifCapturedAt") exifCapturedAt: okhttp3.RequestBody?,
+    ): FieldPhotoResponse
+}
+
+class SecureSessionStore(context: Context) {
+    private val prefs = context.getSharedPreferences("dh_v2_mobile_session", Context.MODE_PRIVATE)
+    private val alias = "dh_v2_mobile_session_key"
+
+    fun load(): StoredSession? {
+        val encoded = prefs.getString("payload", null) ?: return null
+        return runCatching {
+            val parts = encoded.split('.', limit = 2)
+            require(parts.size == 2)
+            val iv = Base64.decode(parts[0], Base64.NO_WRAP)
+            val encrypted = Base64.decode(parts[1], Base64.NO_WRAP)
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.DECRYPT_MODE, key(), GCMParameterSpec(128, iv))
+            val json = JSONObject(String(cipher.doFinal(encrypted), Charsets.UTF_8))
+            StoredSession(
+                userId = json.getString("userId"),
+                username = json.getString("username"),
+                displayName = json.optString("displayName", json.getString("username")),
+                accessToken = json.getString("accessToken"),
+                refreshToken = json.getString("refreshToken"),
+            )
+        }.getOrElse {
+            clear()
+            null
+        }
+    }
+
+    fun save(response: MobileSessionResponse): StoredSession {
+        val displayName = listOfNotNull(response.user.firstName, response.user.lastName)
+            .joinToString(" ").trim().ifBlank { response.user.username }
+        val stored = StoredSession(
+            userId = response.user.id,
+            username = response.user.username,
+            displayName = displayName,
+            accessToken = response.accessToken,
+            refreshToken = response.refreshToken,
+        )
+        val json = JSONObject()
+            .put("userId", stored.userId)
+            .put("username", stored.username)
+            .put("displayName", stored.displayName)
+            .put("accessToken", stored.accessToken)
+            .put("refreshToken", stored.refreshToken)
+            .toString()
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.ENCRYPT_MODE, key())
+        val encrypted = cipher.doFinal(json.toByteArray(Charsets.UTF_8))
+        val payload = Base64.encodeToString(cipher.iv, Base64.NO_WRAP) + "." +
+            Base64.encodeToString(encrypted, Base64.NO_WRAP)
+        prefs.edit().putString("payload", payload).apply()
+        return stored
+    }
+
+    fun clear() {
+        prefs.edit().clear().apply()
+    }
+
+    private fun key(): SecretKey {
+        val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+        (keyStore.getKey(alias, null) as? SecretKey)?.let { return it }
+        val generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore")
+        generator.init(
+            KeyGenParameterSpec.Builder(
+                alias,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+            )
+                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                .setRandomizedEncryptionRequired(true)
+                .build(),
+        )
+        return generator.generateKey()
+    }
+}
+
+class DhRepository(context: Context) {
+    private val store = SecureSessionStore(context.applicationContext)
+    private val refreshMutex = Mutex()
+    private val moshi = Moshi.Builder().addLast(KotlinJsonAdapterFactory()).build()
+    private val api: DhApi = Retrofit.Builder()
+        .baseUrl(BuildConfig.API_BASE_URL)
+        .client(OkHttpClient.Builder().build())
+        .addConverterFactory(MoshiConverterFactory.create(moshi))
+        .build()
+        .create(DhApi::class.java)
+
+    fun currentSession(): StoredSession? = store.load()
+
+    suspend fun login(identifier: String, password: String): StoredSession =
+        store.save(api.login(LoginRequest(identifier.trim(), password)))
+
+    suspend fun logout() {
+        val session = store.load()
+        if (session != null) runCatching { api.logout("Bearer ${session.accessToken}") }
+        store.clear()
+    }
+
+    suspend fun visits(): VisitListResponse = authorized { session ->
+        api.visits("Bearer ${session.accessToken}", session.userId)
+    }
+
+    suspend fun visit(id: String): VisitDetail = authorized { session ->
+        api.visit("Bearer ${session.accessToken}", id)
+    }
+
+    suspend fun startVisit(id: String): VisitDetail = authorized { session ->
+        api.startVisit("Bearer ${session.accessToken}", id)
+    }
+
+    suspend fun fieldInventory(visitId: String, search: String?, parentId: String? = null) = authorized { session ->
+        api.fieldInventory("Bearer ${session.accessToken}", visitId, search?.takeIf { it.isNotBlank() }, parentId)
+    }
+
+    suspend fun fieldTypes(visitId: String, parentId: String?) = authorized { session ->
+        api.fieldTypes("Bearer ${session.accessToken}", visitId, parentId)
+    }
+
+    suspend fun selectFieldAsset(visitId: String, assetId: String) = authorized { session ->
+        api.selectFieldAsset("Bearer ${session.accessToken}", visitId, assetId)
+    }
+
+    suspend fun createFieldAsset(visitId: String, request: CreateFieldInventoryRequest) = authorized { session ->
+        api.createFieldAsset("Bearer ${session.accessToken}", visitId, request)
+    }
+
+    suspend fun uploadFieldPhoto(
+        visitId: String,
+        assetId: String,
+        file: File,
+        latitude: Double,
+        longitude: Double,
+        accuracyM: Double?,
+        capturedAt: String = Instant.now().toString(),
+    ): FieldPhotoResponse = authorized { session ->
+        val text = "text/plain".toMediaType()
+        val body = file.asRequestBody("image/jpeg".toMediaType())
+        val part = MultipartBody.Part.createFormData("file", file.name, body)
+        api.uploadFieldPhoto(
+            authorization = "Bearer ${session.accessToken}",
+            visitId = visitId,
+            assetId = assetId,
+            file = part,
+            latitude = latitude.toString().toRequestBody(text),
+            longitude = longitude.toString().toRequestBody(text),
+            accuracy = accuracyM?.toString()?.toRequestBody(text),
+            capturedAt = capturedAt.toRequestBody(text),
+            deviceLabel = "DH Android".toRequestBody(text),
+            exifLatitude = latitude.toString().toRequestBody(text),
+            exifLongitude = longitude.toString().toRequestBody(text),
+            exifCapturedAt = capturedAt.toRequestBody(text),
+        )
+    }
+
+    private suspend fun <T> authorized(block: suspend (StoredSession) -> T): T {
+        var session = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        try {
+            return block(session)
+        } catch (error: HttpException) {
+            if (error.code() != 401) throw error
+        }
+        session = refresh(session.refreshToken)
+        return block(session)
+    }
+
+    private suspend fun refresh(previousRefreshToken: String): StoredSession = refreshMutex.withLock {
+        val latest = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        if (latest.refreshToken != previousRefreshToken) return@withLock latest
+        try {
+            store.save(api.refresh(RefreshRequest(previousRefreshToken)))
+        } catch (error: Throwable) {
+            store.clear()
+            throw error
+        }
+    }
+
+    companion object {
+        fun humanError(error: Throwable): String {
+            if (error is HttpException) {
+                val body = runCatching { error.response()?.errorBody()?.string() }.getOrNull()
+                val message = runCatching { JSONObject(body.orEmpty()).optString("message") }.getOrNull()
+                if (!message.isNullOrBlank()) return message
+                return "Error HTTP ${error.code()}"
+            }
+            return error.message ?: "Ocurrió un error inesperado"
+        }
+
+        fun newOperationId(): String = UUID.randomUUID().toString()
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/data/FieldFindingsMobile.kt

@@ -0,0 +1,160 @@
+package com.korexlabs.dhinspeccion.data
+
+import android.content.Context
+import com.korexlabs.dhinspeccion.BuildConfig
+import com.squareup.moshi.Moshi
+import com.squareup.moshi.kotlin.reflect.KotlinJsonAdapterFactory
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import okhttp3.OkHttpClient
+import retrofit2.HttpException
+import retrofit2.Retrofit
+import retrofit2.converter.moshi.MoshiConverterFactory
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Header
+import retrofit2.http.POST
+import retrofit2.http.Path
+
+data class FieldFindingAct(
+    val id: String,
+    val code: String,
+    val status: String,
+)
+
+data class FieldFindingCatalogItem(
+    val id: String,
+    val categoryId: String,
+    val code: String,
+    val sourceNumber: Int,
+    val title: String,
+    val legalBasis: String? = null,
+    val glossary: String? = null,
+    val suggestedSeverity: Int? = null,
+    val revision: Int = 1,
+    val categoryName: String? = null,
+)
+
+data class FieldFindingOther(
+    val enabled: Boolean = true,
+    val code: String = "OTHER",
+    val label: String = "OTROS",
+    val help: String? = null,
+)
+
+data class FieldFindingCatalog(
+    val typeConfigured: Boolean = false,
+    val configurationReason: String? = null,
+    val items: List<FieldFindingCatalogItem> = emptyList(),
+    val other: FieldFindingOther = FieldFindingOther(),
+)
+
+data class FieldFindingItem(
+    val id: String,
+    val actId: String,
+    val assetId: String,
+    val catalogItemId: String? = null,
+    val findingNumber: Int,
+    val code: String,
+    val status: String,
+    val title: String,
+    val description: String,
+    val severity: Int? = null,
+    val suggestedSeverity: Int? = null,
+    val correctionDueOn: String? = null,
+)
+
+data class FieldFindingOptionsResponse(
+    val act: FieldFindingAct,
+    val capture: CaptureStatus = CaptureStatus(),
+    val catalog: FieldFindingCatalog,
+    val findings: List<FieldFindingItem> = emptyList(),
+    val canAddAnother: Boolean = true,
+)
+
+data class CreateFieldFindingRequest(
+    val catalogItemId: String? = null,
+    val customTitle: String? = null,
+    val customLegalBasis: String? = null,
+    val description: String,
+    val severity: Int? = null,
+    val correctionDueOn: String? = null,
+)
+
+data class FieldFindingCreateResponse(
+    val act: FieldFindingAct,
+    val capture: CaptureStatus = CaptureStatus(),
+    val finding: FieldFindingItem,
+    val canAddAnother: Boolean = true,
+)
+
+private interface FieldFindingsApi {
+    @GET("inspection-visits/{visitId}/field-findings/{assetId}/options")
+    suspend fun options(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+    ): FieldFindingOptionsResponse
+
+    @POST("inspection-visits/{visitId}/field-findings/{assetId}")
+    suspend fun create(
+        @Header("Authorization") authorization: String,
+        @Path("visitId") visitId: String,
+        @Path("assetId") assetId: String,
+        @Body request: CreateFieldFindingRequest,
+    ): FieldFindingCreateResponse
+
+    @POST("auth/mobile/refresh")
+    suspend fun refresh(@Body request: RefreshRequest): MobileSessionResponse
+}
+
+/**
+ * Cliente separado para F2.3. Comparte el almacén cifrado de sesión de la APK,
+ * pero mantiene el contrato de Hallazgos desacoplado del cliente F2.2.
+ */
+class FieldFindingsRepository(context: Context) {
+    private val store = SecureSessionStore(context.applicationContext)
+    private val refreshMutex = Mutex()
+    private val moshi = Moshi.Builder().addLast(KotlinJsonAdapterFactory()).build()
+    private val api: FieldFindingsApi = Retrofit.Builder()
+        .baseUrl(BuildConfig.API_BASE_URL)
+        .client(OkHttpClient.Builder().build())
+        .addConverterFactory(MoshiConverterFactory.create(moshi))
+        .build()
+        .create(FieldFindingsApi::class.java)
+
+    suspend fun options(visitId: String, assetId: String): FieldFindingOptionsResponse =
+        authorized { session ->
+            api.options("Bearer ${session.accessToken}", visitId, assetId)
+        }
+
+    suspend fun create(
+        visitId: String,
+        assetId: String,
+        request: CreateFieldFindingRequest,
+    ): FieldFindingCreateResponse = authorized { session ->
+        api.create("Bearer ${session.accessToken}", visitId, assetId, request)
+    }
+
+    private suspend fun <T> authorized(block: suspend (StoredSession) -> T): T {
+        var session = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        try {
+            return block(session)
+        } catch (error: HttpException) {
+            if (error.code() != 401) throw error
+        }
+        session = refresh(session.refreshToken)
+        return block(session)
+    }
+
+    private suspend fun refresh(previousRefreshToken: String): StoredSession = refreshMutex.withLock {
+        val latest = store.load() ?: throw IllegalStateException("Sesión no iniciada")
+        if (latest.refreshToken != previousRefreshToken) return@withLock latest
+        try {
+            store.save(api.refresh(RefreshRequest(previousRefreshToken)))
+        } catch (error: Throwable) {
+            store.clear()
+            throw error
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/ui/DhApp.kt

@@ -0,0 +1,579 @@
+package com.korexlabs.dhinspeccion.ui
+
+import android.Manifest
+import android.content.Context
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Environment
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.LazyRow
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.AssistChip
+import androidx.compose.material3.Button
+import androidx.compose.material3.Card
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateMapOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import androidx.core.content.FileProvider
+import androidx.exifinterface.media.ExifInterface
+import com.google.android.gms.location.LocationServices
+import com.google.android.gms.location.Priority
+import com.google.android.gms.tasks.CancellationTokenSource
+import com.korexlabs.dhinspeccion.MainViewModel
+import com.korexlabs.dhinspeccion.data.FieldAttributeDefinition
+import com.korexlabs.dhinspeccion.data.FieldInventoryItem
+import com.korexlabs.dhinspeccion.data.FieldType
+import com.korexlabs.dhinspeccion.data.VisitDetail
+import com.korexlabs.dhinspeccion.data.VisitSummary
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.suspendCancellableCoroutine
+import java.io.File
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+
+private data class GeoSnapshot(
+    val latitude: Double,
+    val longitude: Double,
+    val accuracyM: Double?,
+)
+
+@Composable
+fun DhApp(model: MainViewModel) {
+    MaterialTheme {
+        Surface(modifier = Modifier.fillMaxSize()) {
+            when {
+                model.session == null -> LoginScreen(model)
+                model.visit == null -> VisitsScreen(model)
+                else -> VisitRouter(model)
+            }
+        }
+    }
+}
+
+@Composable
+private fun MessageStrip(model: MainViewModel) {
+    val error = model.error
+    val notice = model.notice
+    if (error != null || notice != null) {
+        Card(
+            modifier = Modifier.fillMaxWidth().padding(bottom = 12.dp),
+            colors = CardDefaults.cardColors(
+                containerColor = if (error != null) MaterialTheme.colorScheme.errorContainer
+                else MaterialTheme.colorScheme.secondaryContainer,
+            ),
+            onClick = { model.clearMessages() },
+        ) {
+            Text(
+                text = error ?: notice.orEmpty(),
+                modifier = Modifier.padding(12.dp),
+            )
+        }
+    }
+}
+
+@Composable
+private fun LoginScreen(model: MainViewModel) {
+    var identifier by rememberSaveable { mutableStateOf("") }
+    var password by rememberSaveable { mutableStateOf("") }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp)) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Aplicación de campo · Dirección de Hidrocarburos")
+            MessageStrip(model)
+            OutlinedTextField(
+                value = identifier,
+                onValueChange = { identifier = it },
+                label = { Text("Usuario o email") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+            )
+            OutlinedTextField(
+                value = password,
+                onValueChange = { password = it },
+                label = { Text("Contraseña") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+                visualTransformation = PasswordVisualTransformation(),
+            )
+            Button(
+                onClick = { model.login(identifier, password) },
+                modifier = Modifier.fillMaxWidth(),
+                enabled = !model.busy,
+            ) {
+                if (model.busy) CircularProgressIndicator(modifier = Modifier.width(20.dp).height(20.dp))
+                else Text("Ingresar")
+            }
+            Text(
+                "El acceso móvil está reservado a usuarios con rol Inspector.",
+                style = MaterialTheme.typography.bodySmall,
+            )
+        }
+    }
+}
+
+@Composable
+private fun VisitsScreen(model: MainViewModel) {
+    val session = model.session ?: return
+    Column(Modifier.fillMaxSize().padding(top = 28.dp)) {
+        Row(
+            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.SpaceBetween,
+        ) {
+            Column {
+                Text("Mis inspecciones", style = MaterialTheme.typography.headlineSmall, fontWeight = FontWeight.Bold)
+                Text(session.displayName, style = MaterialTheme.typography.bodySmall)
+            }
+            Row {
+                OutlinedButton(onClick = { model.loadVisits() }, enabled = !model.busy) { Text("Actualizar") }
+                Spacer(Modifier.width(8.dp))
+                OutlinedButton(onClick = { model.logout() }) { Text("Salir") }
+            }
+        }
+        Column(Modifier.padding(horizontal = 16.dp)) { MessageStrip(model) }
+        if (model.busy && model.visits.isEmpty()) {
+            Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) { CircularProgressIndicator() }
+        } else if (model.visits.isEmpty()) {
+            Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
+                Text("No tenés inspecciones asignadas.")
+            }
+        } else {
+            LazyColumn(
+                Modifier.fillMaxSize().padding(horizontal = 16.dp),
+                verticalArrangement = Arrangement.spacedBy(10.dp),
+            ) {
+                items(model.visits, key = { it.id }) { visit ->
+                    VisitCard(visit) { model.openVisit(visit.id) }
+                }
+                item { Spacer(Modifier.height(24.dp)) }
+            }
+        }
+    }
+}
+
+@Composable
+private fun VisitCard(visit: VisitSummary, onOpen: () -> Unit) {
+    Card(onClick = onOpen, modifier = Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(5.dp)) {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text(visit.code, fontWeight = FontWeight.Bold)
+                Text(visit.status)
+            }
+            Text(visit.operatorCompany?.name ?: "Operadora sin definir")
+            Text(visit.operationalArea?.name ?: "Área sin definir", style = MaterialTheme.typography.bodySmall)
+            visit.plannedStartAt?.let { Text("Prevista: ${shortDate(it)}", style = MaterialTheme.typography.bodySmall) }
+            Text("Inventario: ${visit.assetCount} · Equipo inspector: ${visit.memberCount}", style = MaterialTheme.typography.bodySmall)
+        }
+    }
+}
+
+@Composable
+private fun VisitRouter(model: MainViewModel) {
+    var inventoryMode by rememberSaveable(model.visit?.id) { mutableStateOf(false) }
+    if (inventoryMode) {
+        FieldInventoryScreen(model) { inventoryMode = false }
+    } else {
+        VisitScreen(model) { inventoryMode = true }
+    }
+}
+
+@Composable
+private fun VisitScreen(model: MainViewModel, onInventory: () -> Unit) {
+    val visit = model.visit ?: return
+    Column(
+        Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(top = 28.dp, start = 16.dp, end = 16.dp, bottom = 30.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween, verticalAlignment = Alignment.CenterVertically) {
+            OutlinedButton(onClick = { model.closeVisitView() }) { Text("Volver") }
+            Text(visit.status, fontWeight = FontWeight.Bold)
+        }
+        Text(visit.code, style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+        Text("${visit.operatorCompany?.name ?: "Sin operadora"} · ${visit.operationalArea?.name ?: "Sin área"}")
+        visit.instructions?.takeIf { it.isNotBlank() }?.let {
+            Card(Modifier.fillMaxWidth()) { Column(Modifier.padding(12.dp)) { Text("Instrucciones", fontWeight = FontWeight.Bold); Text(it) } }
+        }
+        MessageStrip(model)
+
+        if (visit.status == "PLANNED") {
+            Button(onClick = { model.startVisit() }, enabled = !model.busy, modifier = Modifier.fillMaxWidth()) {
+                Text("Iniciar inspección")
+            }
+        }
+        if (visit.status == "PLANNED" || visit.status == "IN_PROGRESS") {
+            OutlinedButton(onClick = onInventory, modifier = Modifier.fillMaxWidth()) { Text("Inventario de campo") }
+        }
+
+        ChecklistCard(visit)
+
+        Text("Inventario planificado", style = MaterialTheme.typography.titleMedium, fontWeight = FontWeight.Bold)
+        if (visit.planningAssets.isEmpty()) Text("Sin elementos planificados.")
+        visit.planningAssets.filter { it.included }.forEach { asset ->
+            Card(Modifier.fillMaxWidth()) {
+                Column(Modifier.padding(10.dp)) {
+                    Text(asset.name, fontWeight = FontWeight.SemiBold)
+                    Text("${asset.code} · ${asset.typeName.orEmpty()}", style = MaterialTheme.typography.bodySmall)
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun ChecklistCard(visit: VisitDetail) {
+    val checklist = visit.checklist
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            Text("Checklist de antecedentes", fontWeight = FontWeight.Bold)
+            Text("Vencidos empresa: ${checklist.companyOverdue} · Verificaciones vencidas: ${checklist.verificationOverdue}")
+            Text("Antecedentes: ${checklist.antecedents} · Próximos controles: ${checklist.upcomingControls}")
+            if (checklist.stale) Text("El checklist requiere revisión/actualización.", color = MaterialTheme.colorScheme.error)
+            checklist.items.take(10).forEach { item ->
+                HorizontalDivider()
+                Text(item.findingTitle ?: item.findingCode ?: "Hallazgo", fontWeight = FontWeight.SemiBold)
+                Text("${item.asset?.name.orEmpty()} · Gravedad ${item.severity ?: "s/d"}", style = MaterialTheme.typography.bodySmall)
+            }
+        }
+    }
+}
+
+@Composable
+private fun FieldInventoryScreen(model: MainViewModel, onBack: () -> Unit) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    val visit = model.visit ?: return
+    var search by rememberSaveable { mutableStateOf("") }
+    var showCreate by rememberSaveable { mutableStateOf(false) }
+    var parentId by rememberSaveable { mutableStateOf<String?>(null) }
+    var parentLabel by rememberSaveable { mutableStateOf("Área de la inspección") }
+    var name by rememberSaveable { mutableStateOf("") }
+    var commonName by rememberSaveable { mutableStateOf("") }
+    var selectedTypeId by rememberSaveable { mutableStateOf<String?>(null) }
+    val attributeValues = remember { mutableStateMapOf<String, String>() }
+
+    LaunchedEffect(visit.id) {
+        model.searchInventory("")
+        model.loadFieldTypes(null)
+    }
+    LaunchedEffect(model.fieldTypes) {
+        if (model.fieldTypes.none { it.id == selectedTypeId }) {
+            selectedTypeId = model.fieldTypes.firstOrNull()?.id
+            attributeValues.clear()
+        }
+    }
+
+    val selectedType = model.fieldTypes.firstOrNull { it.id == selectedTypeId }
+
+    val createWithLocation: () -> Unit = {
+        val type = selectedType
+        if (type != null) {
+            scope.launch {
+                runCatching { currentGeo(context) }
+                    .onSuccess { geo ->
+                        val values = buildAttributes(type, attributeValues)
+                        model.createFieldAsset(type, parentId, name, commonName, values, geo.latitude, geo.longitude, geo.accuracyM)
+                    }
+            }
+        }
+    }
+    val locationPermissionLauncher = rememberLauncherForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { result ->
+        val allowed = result[Manifest.permission.ACCESS_FINE_LOCATION] == true || result[Manifest.permission.ACCESS_COARSE_LOCATION] == true
+        if (allowed) createWithLocation()
+    }
+
+    var pendingPhotoFile by remember { mutableStateOf<File?>(null) }
+    var pendingPhotoGeo by remember { mutableStateOf<GeoSnapshot?>(null) }
+    val takePicture = rememberLauncherForActivityResult(ActivityResultContracts.TakePicture()) { success ->
+        val file = pendingPhotoFile
+        val geo = pendingPhotoGeo
+        if (success && file != null && geo != null) {
+            runCatching { writeExif(file, geo) }
+            model.uploadFieldPhoto(file, geo.latitude, geo.longitude, geo.accuracyM)
+        }
+        pendingPhotoFile = null
+        pendingPhotoGeo = null
+    }
+    val beginPhoto: () -> Unit = {
+        scope.launch {
+            runCatching { currentGeo(context) }.onSuccess { geo ->
+                val (file, uri) = newPhoto(context)
+                pendingPhotoFile = file
+                pendingPhotoGeo = geo
+                takePicture.launch(uri)
+            }
+        }
+    }
+    val photoPermissionLauncher = rememberLauncherForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { result ->
+        val camera = result[Manifest.permission.CAMERA] == true || hasPermission(context, Manifest.permission.CAMERA)
+        val location = result[Manifest.permission.ACCESS_FINE_LOCATION] == true || result[Manifest.permission.ACCESS_COARSE_LOCATION] == true || hasLocation(context)
+        if (camera && location) beginPhoto()
+    }
+
+    Column(Modifier.fillMaxSize().padding(top = 28.dp)) {
+        Row(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp), horizontalArrangement = Arrangement.SpaceBetween) {
+            OutlinedButton(onClick = onBack) { Text("Volver") }
+            Text("Inventario de campo", style = MaterialTheme.typography.titleLarge, fontWeight = FontWeight.Bold)
+        }
+        Column(Modifier.padding(horizontal = 16.dp)) { MessageStrip(model) }
+
+        val selectedCapture = model.selectedFieldAsset
+        if (selectedCapture != null) {
+            CaptureCard(
+                detailName = selectedCapture.asset.name,
+                captureRequired = selectedCapture.capture.captureRequired,
+                gps = selectedCapture.capture.creationGpsCaptured,
+                photos = selectedCapture.capture.fieldPhotoCount,
+                ready = selectedCapture.capture.readyForFinding,
+                onPhoto = {
+                    val permissions = arrayOf(Manifest.permission.CAMERA, Manifest.permission.ACCESS_FINE_LOCATION, Manifest.permission.ACCESS_COARSE_LOCATION)
+                    if (hasPermission(context, Manifest.permission.CAMERA) && hasLocation(context)) beginPhoto()
+                    else photoPermissionLauncher.launch(permissions)
+                },
+                onClose = { model.clearSelectedFieldAsset() },
+            )
+        }
+
+        Row(Modifier.fillMaxWidth().padding(horizontal = 16.dp), verticalAlignment = Alignment.CenterVertically) {
+            OutlinedTextField(
+                value = search,
+                onValueChange = { search = it },
+                label = { Text("Buscar por nombre, código o atributo") },
+                modifier = Modifier.weight(1f),
+                singleLine = true,
+            )
+            Spacer(Modifier.width(8.dp))
+            Button(onClick = { model.searchInventory(search) }, enabled = !model.busy) { Text("Buscar") }
+        }
+        if (visit.status == "IN_PROGRESS") {
+            Row(Modifier.fillMaxWidth().padding(16.dp), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text("Alta en campo", fontWeight = FontWeight.Bold)
+                OutlinedButton(onClick = {
+                    showCreate = !showCreate
+                    if (showCreate) model.loadFieldTypes(parentId)
+                }) { Text(if (showCreate) "Ocultar" else "Crear nuevo") }
+            }
+        }
+
+        if (showCreate && visit.status == "IN_PROGRESS") {
+            Column(
+                Modifier.fillMaxWidth().padding(horizontal = 16.dp).verticalScroll(rememberScrollState()).weight(1f, fill = false),
+                verticalArrangement = Arrangement.spacedBy(10.dp),
+            ) {
+                Text("Padre: $parentLabel", style = MaterialTheme.typography.bodySmall)
+                if (parentId != null) {
+                    OutlinedButton(onClick = {
+                        parentId = null
+                        parentLabel = "Área de la inspección"
+                        model.loadFieldTypes(null)
+                    }) { Text("Volver al Área") }
+                }
+                if (model.fieldTypes.isEmpty()) Text("No hay tipos habilitados debajo de este padre.")
+                LazyRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    items(model.fieldTypes, key = { it.id }) { type ->
+                        AssistChip(
+                            onClick = { selectedTypeId = type.id; attributeValues.clear() },
+                            label = { Text(if (type.id == selectedTypeId) "✓ ${type.name}" else type.name) },
+                        )
+                    }
+                }
+                OutlinedTextField(name, { name = it }, label = { Text("Nombre o código identificable *") }, modifier = Modifier.fillMaxWidth())
+                OutlinedTextField(commonName, { commonName = it }, label = { Text("Nombre común") }, modifier = Modifier.fillMaxWidth())
+                selectedType?.attributes?.forEach { definition ->
+                    OutlinedTextField(
+                        value = attributeValues[definition.code].orEmpty(),
+                        onValueChange = { attributeValues[definition.code] = it },
+                        label = { Text(definition.name + if (definition.isRequired) " *" else "") },
+                        supportingText = {
+                            val details = listOfNotNull(definition.unit, definition.options?.toString()).joinToString(" · ")
+                            if (details.isNotBlank()) Text(details)
+                        },
+                        keyboardOptions = KeyboardOptions(
+                            keyboardType = if (definition.dataType.uppercase() in setOf("NUMBER", "DECIMAL", "INTEGER", "FLOAT")) KeyboardType.Decimal else KeyboardType.Text,
+                        ),
+                        modifier = Modifier.fillMaxWidth(),
+                    )
+                }
+                val requiredReady = selectedType?.attributes?.filter { it.isRequired }?.all { attributeValues[it.code].orEmpty().isNotBlank() } ?: false
+                Button(
+                    onClick = {
+                        if (hasLocation(context)) createWithLocation()
+                        else locationPermissionLauncher.launch(arrayOf(Manifest.permission.ACCESS_FINE_LOCATION, Manifest.permission.ACCESS_COARSE_LOCATION))
+                    },
+                    enabled = selectedType != null && name.isNotBlank() && requiredReady && !model.busy,
+                    modifier = Modifier.fillMaxWidth(),
+                ) { Text("Capturar GPS y crear") }
+                HorizontalDivider()
+            }
+        }
+
+        Text("Resultados", modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp), fontWeight = FontWeight.Bold)
+        LazyColumn(
+            Modifier.fillMaxSize().padding(horizontal = 16.dp),
+            verticalArrangement = Arrangement.spacedBy(8.dp),
+        ) {
+            items(model.inventory, key = { it.id }) { item ->
+                InventoryCard(
+                    item = item,
+                    canModify = visit.status == "IN_PROGRESS",
+                    onSelect = { model.selectExisting(item) },
+                    onUseParent = {
+                        parentId = item.id
+                        parentLabel = "${item.name} (${item.code})"
+                        showCreate = true
+                        selectedTypeId = null
+                        model.loadFieldTypes(item.id)
+                    },
+                )
+            }
+            item { Spacer(Modifier.height(30.dp)) }
+        }
+    }
+}
+
+@Composable
+private fun CaptureCard(
+    detailName: String,
+    captureRequired: Boolean,
+    gps: Boolean,
+    photos: Int,
+    ready: Boolean,
+    onPhoto: () -> Unit,
+    onClose: () -> Unit,
+) {
+    Card(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp)) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
+                Text(detailName, fontWeight = FontWeight.Bold)
+                OutlinedButton(onClick = onClose) { Text("Cerrar") }
+            }
+            Text("GPS de alta: ${if (gps) "OK" else "pendiente"} · Fotos: $photos")
+            if (captureRequired && !ready) {
+                Text("El Hallazgo permanece bloqueado hasta completar GPS + foto.", color = MaterialTheme.colorScheme.error)
+                Button(onClick = onPhoto, modifier = Modifier.fillMaxWidth()) { Text("Tomar foto obligatoria") }
+            } else if (ready) {
+                Text("Captura completa · habilitado para Hallazgos", color = MaterialTheme.colorScheme.primary)
+            }
+        }
+    }
+}
+
+@Composable
+private fun InventoryCard(item: FieldInventoryItem, canModify: Boolean, onSelect: () -> Unit, onUseParent: () -> Unit) {
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+            Text(item.name, fontWeight = FontWeight.SemiBold)
+            Text("${item.code} · ${item.type?.name.orEmpty()}", style = MaterialTheme.typography.bodySmall)
+            item.commonName?.let { Text(it, style = MaterialTheme.typography.bodySmall) }
+            Text(
+                if (item.readyForFinding) "Listo" else "Captura incompleta: GPS/foto pendiente",
+                color = if (item.readyForFinding) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
+                style = MaterialTheme.typography.bodySmall,
+            )
+            if (canModify) {
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    OutlinedButton(onClick = onSelect) { Text(if (item.selectedInInspection) "Abrir" else "Seleccionar") }
+                    OutlinedButton(onClick = onUseParent) { Text("Crear hijo") }
+                }
+            }
+        }
+    }
+}
+
+private fun buildAttributes(type: FieldType, values: Map<String, String>): Map<String, Any?> =
+    type.attributes.mapNotNull { definition ->
+        val raw = values[definition.code]?.trim().orEmpty()
+        if (raw.isBlank()) return@mapNotNull null
+        definition.code to coerceAttribute(definition, raw)
+    }.toMap()
+
+private fun coerceAttribute(definition: FieldAttributeDefinition, raw: String): Any = when (definition.dataType.uppercase()) {
+    "INTEGER", "INT" -> raw.toLongOrNull() ?: raw
+    "NUMBER", "DECIMAL", "FLOAT", "DOUBLE" -> raw.replace(',', '.').toDoubleOrNull() ?: raw
+    "BOOLEAN", "BOOL" -> raw.lowercase() in setOf("true", "1", "si", "sí", "yes")
+    else -> raw
+}
+
+private fun hasPermission(context: Context, permission: String): Boolean =
+    ContextCompat.checkSelfPermission(context, permission) == PackageManager.PERMISSION_GRANTED
+
+private fun hasLocation(context: Context): Boolean =
+    hasPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) || hasPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION)
+
+private suspend fun currentGeo(context: Context): GeoSnapshot = suspendCancellableCoroutine { continuation ->
+    if (!hasLocation(context)) {
+        continuation.resumeWithException(SecurityException("Se necesita permiso de ubicación."))
+        return@suspendCancellableCoroutine
+    }
+    val source = CancellationTokenSource()
+    val client = LocationServices.getFusedLocationProviderClient(context)
+    client.getCurrentLocation(Priority.PRIORITY_HIGH_ACCURACY, source.token)
+        .addOnSuccessListener { location ->
+            if (!continuation.isActive) return@addOnSuccessListener
+            if (location == null) continuation.resumeWithException(IllegalStateException("No se pudo obtener una ubicación GPS actual."))
+            else continuation.resume(GeoSnapshot(location.latitude, location.longitude, location.accuracy.toDouble()))
+        }
+        .addOnFailureListener { if (continuation.isActive) continuation.resumeWithException(it) }
+    continuation.invokeOnCancellation { source.cancel() }
+}
+
+private fun newPhoto(context: Context): Pair<File, Uri> {
+    val directory = context.getExternalFilesDir(Environment.DIRECTORY_PICTURES)
+        ?: throw IllegalStateException("No se pudo acceder al almacenamiento de fotografías.")
+    directory.mkdirs()
+    val file = File.createTempFile("DH_${System.currentTimeMillis()}_", ".jpg", directory)
+    val uri = FileProvider.getUriForFile(context, "${context.packageName}.files", file)
+    return file to uri
+}
+
+private fun writeExif(file: File, geo: GeoSnapshot) {
+    val now = Instant.now()
+    val exif = ExifInterface(file)
+    exif.setLatLong(geo.latitude, geo.longitude)
+    val formatter = DateTimeFormatter.ofPattern("yyyy:MM:dd HH:mm:ss").withZone(ZoneId.systemDefault())
+    exif.setAttribute(ExifInterface.TAG_DATETIME_ORIGINAL, formatter.format(now))
+    exif.setAttribute(ExifInterface.TAG_DATETIME_DIGITIZED, formatter.format(now))
+    exif.saveAttributes()
+}
+
+private fun shortDate(value: String): String = value.replace('T', ' ').take(16)

android-app/app/src/main/java/com/korexlabs/dhinspeccion/ui/FieldFindingScreen.kt

@@ -0,0 +1,254 @@
+package com.korexlabs.dhinspeccion.ui
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Card
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Text
+import androidx.compose.material3.Button
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.ui.unit.dp
+import com.korexlabs.dhinspeccion.MainViewModel
+
+@Composable
+fun FieldFindingScreen(model: MainViewModel) {
+    val options = model.fieldFindingOptions ?: return
+    val asset = model.selectedFieldAsset?.asset ?: return
+    var search by rememberSaveable(asset.id) { mutableStateOf("") }
+    var selectedCatalogId by rememberSaveable(asset.id) { mutableStateOf<String?>(null) }
+    var other by rememberSaveable(asset.id) { mutableStateOf(false) }
+    var customTitle by rememberSaveable(asset.id) { mutableStateOf("") }
+    var customLegalBasis by rememberSaveable(asset.id) { mutableStateOf("") }
+    var description by rememberSaveable(asset.id) { mutableStateOf("") }
+    var severityText by rememberSaveable(asset.id) { mutableStateOf("") }
+    var correctionDueOn by rememberSaveable(asset.id) { mutableStateOf("") }
+
+    val selected = options.catalog.items.firstOrNull { it.id == selectedCatalogId }
+    val filtered = options.catalog.items.filter {
+        search.isBlank() ||
+            it.title.contains(search, ignoreCase = true) ||
+            it.code.contains(search, ignoreCase = true) ||
+            it.categoryName.orEmpty().contains(search, ignoreCase = true)
+    }
+
+    LaunchedEffect(selectedCatalogId, other) {
+        if (!other && selected != null && severityText.isBlank() && selected.suggestedSeverity != null) {
+            severityText = selected.suggestedSeverity.toString()
+        }
+    }
+    LaunchedEffect(model.lastCreatedFinding?.id) {
+        if (model.lastCreatedFinding != null) {
+            selectedCatalogId = null
+            other = false
+            customTitle = ""
+            customLegalBasis = ""
+            description = ""
+            severityText = ""
+            correctionDueOn = ""
+            search = ""
+        }
+    }
+
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .verticalScroll(rememberScrollState())
+            .padding(top = 30.dp, start = 16.dp, end = 16.dp, bottom = 36.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
+            OutlinedButton(onClick = { model.clearFindingFlow() }, enabled = !model.busy) {
+                Text("Volver")
+            }
+            Text("Hallazgo de campo", style = MaterialTheme.typography.titleLarge, fontWeight = FontWeight.Bold)
+        }
+
+        Card(Modifier.fillMaxWidth()) {
+            Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                Text(asset.name, fontWeight = FontWeight.Bold)
+                Text("${asset.code} · Acta ${options.act.code}", style = MaterialTheme.typography.bodySmall)
+                Text(
+                    "GPS + foto: ${if (options.capture.readyForFinding) "OK" else "pendiente"}",
+                    color = if (options.capture.readyForFinding) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
+                    style = MaterialTheme.typography.bodySmall,
+                )
+            }
+        }
+
+        model.error?.let {
+            Card(colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.errorContainer)) {
+                Text(it, Modifier.padding(12.dp))
+            }
+        }
+        model.notice?.let {
+            Card(colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.secondaryContainer)) {
+                Text(it, Modifier.padding(12.dp))
+            }
+        }
+
+        if (options.findings.isNotEmpty()) {
+            Text("Hallazgos ya registrados en este Inventario", fontWeight = FontWeight.Bold)
+            options.findings.forEach { finding ->
+                Card(Modifier.fillMaxWidth()) {
+                    Column(Modifier.padding(10.dp)) {
+                        Text("${finding.code} · ${finding.title}", fontWeight = FontWeight.SemiBold)
+                        Text("Gravedad: ${finding.severity ?: "s/d"} · ${finding.status}", style = MaterialTheme.typography.bodySmall)
+                    }
+                }
+            }
+            HorizontalDivider()
+        }
+
+        Text("1. Elegí el tipo de Hallazgo", style = MaterialTheme.typography.titleMedium, fontWeight = FontWeight.Bold)
+        if (!options.catalog.typeConfigured) {
+            Text(
+                options.catalog.configurationReason
+                    ?: "Este tipo de Inventario todavía no tiene un catálogo contextual configurado. Podés usar OTROS.",
+                color = MaterialTheme.colorScheme.secondary,
+            )
+        }
+        OutlinedTextField(
+            value = search,
+            onValueChange = { search = it },
+            label = { Text("Buscar en catálogo") },
+            modifier = Modifier.fillMaxWidth(),
+            singleLine = true,
+        )
+
+        filtered.forEach { item ->
+            val chosen = !other && selectedCatalogId == item.id
+            Card(
+                modifier = Modifier.fillMaxWidth().clickable {
+                    selectedCatalogId = item.id
+                    other = false
+                    severityText = item.suggestedSeverity?.toString().orEmpty()
+                },
+                colors = if (chosen) {
+                    CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.primaryContainer)
+                } else {
+                    CardDefaults.cardColors()
+                },
+            ) {
+                Column(Modifier.padding(10.dp), verticalArrangement = Arrangement.spacedBy(3.dp)) {
+                    Text(if (chosen) "✓ ${item.title}" else item.title, fontWeight = FontWeight.SemiBold)
+                    Text(
+                        listOfNotNull(item.categoryName, item.code, item.suggestedSeverity?.let { "Gravedad sugerida $it" })
+                            .joinToString(" · "),
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+            }
+        }
+
+        OutlinedButton(
+            onClick = {
+                other = true
+                selectedCatalogId = null
+                severityText = ""
+            },
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(if (other) "✓ OTROS · Hallazgo no catalogado" else "OTROS · No está en el catálogo")
+        }
+        if (other) {
+            options.catalog.other.help?.let { Text(it, style = MaterialTheme.typography.bodySmall) }
+            OutlinedTextField(
+                value = customTitle,
+                onValueChange = { customTitle = it },
+                label = { Text("Título del nuevo Hallazgo *") },
+                modifier = Modifier.fillMaxWidth(),
+            )
+            OutlinedTextField(
+                value = customLegalBasis,
+                onValueChange = { customLegalBasis = it },
+                label = { Text("Base legal / normativa (opcional)") },
+                modifier = Modifier.fillMaxWidth(),
+            )
+        }
+
+        Text("2. Describí lo observado", style = MaterialTheme.typography.titleMedium, fontWeight = FontWeight.Bold)
+        selected?.let {
+            Card(Modifier.fillMaxWidth()) {
+                Column(Modifier.padding(10.dp), verticalArrangement = Arrangement.spacedBy(3.dp)) {
+                    Text(it.title, fontWeight = FontWeight.SemiBold)
+                    it.legalBasis?.takeIf(String::isNotBlank)?.let { basis -> Text(basis, style = MaterialTheme.typography.bodySmall) }
+                    it.glossary?.takeIf(String::isNotBlank)?.let { glossary -> Text(glossary, style = MaterialTheme.typography.bodySmall) }
+                }
+            }
+        }
+        OutlinedTextField(
+            value = description,
+            onValueChange = { description = it },
+            label = { Text("Descripción del Hallazgo *") },
+            modifier = Modifier.fillMaxWidth(),
+            minLines = 3,
+        )
+        OutlinedTextField(
+            value = severityText,
+            onValueChange = { value -> severityText = value.filter(Char::isDigit).take(2) },
+            label = { Text("Gravedad 1 a 10") },
+            modifier = Modifier.fillMaxWidth(),
+            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Number),
+            singleLine = true,
+        )
+        OutlinedTextField(
+            value = correctionDueOn,
+            onValueChange = { correctionDueOn = it },
+            label = { Text("Fecha de corrección AAAA-MM-DD (opcional)") },
+            modifier = Modifier.fillMaxWidth(),
+            singleLine = true,
+        )
+
+        val severity = severityText.toIntOrNull()
+        val choiceReady = selectedCatalogId != null || (other && customTitle.isNotBlank())
+        Button(
+            onClick = {
+                model.createFieldFinding(
+                    catalogItemId = if (other) null else selectedCatalogId,
+                    customTitle = if (other) customTitle else null,
+                    customLegalBasis = if (other) customLegalBasis else null,
+                    description = description,
+                    severity = severity,
+                    correctionDueOn = correctionDueOn,
+                )
+            },
+            enabled = choiceReady && description.isNotBlank() && (severity == null || severity in 1..10) && !model.busy,
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(if (model.busy) "Guardando…" else "Guardar Hallazgo")
+        }
+
+        model.lastCreatedFinding?.let { finding ->
+            Card(
+                Modifier.fillMaxWidth(),
+                colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.primaryContainer),
+            ) {
+                Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                    Text("Hallazgo registrado", fontWeight = FontWeight.Bold)
+                    Text("${finding.code} · ${finding.title}")
+                    Text("Podés registrar otro Hallazgo sobre el mismo Inventario.", style = MaterialTheme.typography.bodySmall)
+                }
+            }
+        }
+    }
+}

android-app/app/src/main/java/com/korexlabs/dhinspeccion/ui/LoginGate.kt

@@ -0,0 +1,203 @@
+package com.korexlabs.dhinspeccion.ui
+
+import android.content.Context
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Visibility
+import androidx.compose.material.icons.filled.VisibilityOff
+import androidx.compose.material3.Button
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.FragmentActivity
+import com.korexlabs.dhinspeccion.MainViewModel
+
+private const val BIOMETRIC_PREFS = "dh_v2_biometric"
+private const val BIOMETRIC_ENABLED = "enabled"
+
+private fun biometricAvailable(context: Context): Boolean =
+    BiometricManager.from(context).canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG) ==
+        BiometricManager.BIOMETRIC_SUCCESS
+
+private fun biometricEnabled(context: Context): Boolean =
+    context.getSharedPreferences(BIOMETRIC_PREFS, Context.MODE_PRIVATE)
+        .getBoolean(BIOMETRIC_ENABLED, false)
+
+private fun setBiometricEnabled(context: Context, enabled: Boolean) {
+    context.getSharedPreferences(BIOMETRIC_PREFS, Context.MODE_PRIVATE)
+        .edit().putBoolean(BIOMETRIC_ENABLED, enabled).apply()
+}
+
+@Composable
+fun DhRoot(model: MainViewModel, activity: FragmentActivity) {
+    val context = LocalContext.current
+    val capable = remember { biometricAvailable(context) }
+    var unlocked by rememberSaveable { mutableStateOf(false) }
+    var passwordLoginInFlight by rememberSaveable { mutableStateOf(false) }
+    var enabled by remember { mutableStateOf(biometricEnabled(context)) }
+
+    LaunchedEffect(model.session) {
+        if (model.session != null && passwordLoginInFlight) {
+            if (capable) {
+                setBiometricEnabled(context, true)
+                enabled = true
+            }
+            unlocked = true
+            passwordLoginInFlight = false
+        }
+        if (model.session == null) unlocked = false
+    }
+
+    MaterialTheme {
+        Surface(Modifier.fillMaxSize()) {
+            when {
+                model.session == null -> EnhancedLoginScreen(model) {
+                    passwordLoginInFlight = true
+                }
+                enabled && capable && !unlocked -> BiometricUnlockScreen(
+                    activity = activity,
+                    displayName = model.session?.displayName.orEmpty(),
+                    onAuthenticated = { unlocked = true },
+                    onUsePassword = {
+                        setBiometricEnabled(context, false)
+                        enabled = false
+                        model.logout()
+                    },
+                )
+                model.fieldFindingOptions != null -> FieldFindingScreen(model)
+                else -> DhApp(model)
+            }
+        }
+    }
+}
+
+@Composable
+private fun EnhancedLoginScreen(model: MainViewModel, onPasswordLogin: () -> Unit) {
+    var identifier by rememberSaveable { mutableStateOf("") }
+    var password by rememberSaveable { mutableStateOf("") }
+    var passwordVisible by rememberSaveable { mutableStateOf(false) }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp)) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Aplicación de campo · Dirección de Hidrocarburos")
+            model.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+            model.notice?.let { Text(it, color = MaterialTheme.colorScheme.primary) }
+            OutlinedTextField(
+                value = identifier,
+                onValueChange = { identifier = it },
+                label = { Text("Usuario o email") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+            )
+            OutlinedTextField(
+                value = password,
+                onValueChange = { password = it },
+                label = { Text("Contraseña") },
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+                visualTransformation = if (passwordVisible) VisualTransformation.None else PasswordVisualTransformation(),
+                trailingIcon = {
+                    IconButton(onClick = { passwordVisible = !passwordVisible }) {
+                        Icon(
+                            imageVector = if (passwordVisible) Icons.Filled.VisibilityOff else Icons.Filled.Visibility,
+                            contentDescription = if (passwordVisible) "Ocultar contraseña" else "Mostrar contraseña",
+                        )
+                    }
+                },
+            )
+            Button(
+                onClick = {
+                    onPasswordLogin()
+                    model.login(identifier, password)
+                },
+                modifier = Modifier.fillMaxWidth(),
+                enabled = !model.busy,
+            ) { Text(if (model.busy) "Ingresando…" else "Ingresar") }
+            Text(
+                "Después del primer ingreso correcto, si la tablet tiene una huella fuerte configurada, se habilita el acceso biométrico. La contraseña no se almacena.",
+                style = MaterialTheme.typography.bodySmall,
+            )
+        }
+    }
+}
+
+@Composable
+private fun BiometricUnlockScreen(
+    activity: FragmentActivity,
+    displayName: String,
+    onAuthenticated: () -> Unit,
+    onUsePassword: () -> Unit,
+) {
+    var error by rememberSaveable { mutableStateOf<String?>(null) }
+
+    fun authenticate() {
+        val executor = ContextCompat.getMainExecutor(activity)
+        val prompt = BiometricPrompt(
+            activity,
+            executor,
+            object : BiometricPrompt.AuthenticationCallback() {
+                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                    super.onAuthenticationSucceeded(result)
+                    error = null
+                    onAuthenticated()
+                }
+
+                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                    super.onAuthenticationError(errorCode, errString)
+                    error = errString.toString()
+                }
+
+                override fun onAuthenticationFailed() {
+                    super.onAuthenticationFailed()
+                    error = "Huella no reconocida."
+                }
+            },
+        )
+        val info = BiometricPrompt.PromptInfo.Builder()
+            .setTitle("Ingresar a DH Inspección")
+            .setSubtitle(if (displayName.isBlank()) "Validá tu identidad" else "Hola, $displayName")
+            .setNegativeButtonText("Usar contraseña")
+            .setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)
+            .build()
+        prompt.authenticate(info)
+    }
+
+    LaunchedEffect(Unit) { authenticate() }
+
+    Box(Modifier.fillMaxSize().padding(24.dp), contentAlignment = Alignment.Center) {
+        Column(Modifier.fillMaxWidth(), verticalArrangement = Arrangement.spacedBy(14.dp), horizontalAlignment = Alignment.CenterHorizontally) {
+            Text("DH Inspección", style = MaterialTheme.typography.headlineMedium, fontWeight = FontWeight.Bold)
+            Text("Ingresá con tu huella")
+            error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+            Button(onClick = { authenticate() }, modifier = Modifier.fillMaxWidth()) { Text("Usar huella") }
+            OutlinedButton(onClick = onUsePassword, modifier = Modifier.fillMaxWidth()) { Text("Ingresar con contraseña") }
+        }
+    }
+}

android-app/app/src/main/res/values/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">DH Inspección</string>
+</resources>

android-app/app/src/main/res/values/styles.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <style name="Theme.DHInspeccion" parent="android:style/Theme.Material.Light.NoActionBar">
+        <item name="android:fontFamily">sans</item>
+        <item name="android:windowActionModeOverlay">true</item>
+        <item name="android:colorAccent">#1B5E20</item>
+        <item name="android:navigationBarColor">#FFFFFF</item>
+        <item name="android:statusBarColor">#FFFFFF</item>
+        <item name="android:windowLightStatusBar">true</item>
+    </style>
+</resources>

android-app/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+    <external-files-path name="inspection_photos" path="Pictures/" />
+</paths>

android-app/build.gradle.kts

@@ -0,0 +1,5 @@
+plugins {
+    id("com.android.application") version "8.13.2" apply false
+    id("org.jetbrains.kotlin.android") version "2.2.20" apply false
+    id("org.jetbrains.kotlin.plugin.compose") version "2.2.20" apply false
+}

android-app/gradle.properties

@@ -0,0 +1,4 @@
+org.gradle.jvmargs=-Xmx3g -Dfile.encoding=UTF-8
+android.useAndroidX=true
+kotlin.code.style=official
+android.nonTransitiveRClass=true

android-app/settings.gradle.kts

@@ -0,0 +1,18 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "DHInspeccion"
+include(":app")

api-v3/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dhv2-api",
-  "version": "0.19.6-4",
+  "version": "0.20.0-2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dhv2-api",
-      "version": "0.19.6-4",
+      "version": "0.20.0-2",
       "license": "UNLICENSED",
       "dependencies": {
         "@nestjs/common": "^11.0.0",

api-v3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dhv2-api",
-  "version": "0.19.6-4",
+  "version": "0.23.0-1",
   "private": true,
   "license": "UNLICENSED",
   "scripts": {

api-v3/src/act-administration/act-administration.controller.ts

@@ -0,0 +1,47 @@
+
+import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post, Query, Req, Res, UploadedFile, UseInterceptors } from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import type { Response } from 'express';
+import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
+import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import { ActAdministrationService, MAX_ACT_RESPONSE_BYTES, type UploadedActResponseFile } from './act-administration.service';
+import { CreateActCompanyResponseDto } from './dto/create-act-company-response.dto';
+import { ListActAdministrationQueryDto } from './dto/list-act-administration-query.dto';
+import { SetActResponseDeadlineDto } from './dto/set-act-response-deadline.dto';
+
+@Controller('act-administration')
+export class ActAdministrationQueueController {
+  constructor(private readonly administration: ActAdministrationService) {}
+  @Get('queue') @RequirePermissions('inspection_acts.read') queue(@Query() query: ListActAdministrationQueryDto) { return this.administration.queue(query); }
+  @Get('calendar') @RequirePermissions('inspection_acts.read') calendar(@Query('from') from?: string, @Query('to') to?: string) { return this.administration.calendar(from, to); }
+}
+
+@Controller('inspection-acts/:actId/administration')
+export class ActAdministrationController {
+  constructor(private readonly administration: ActAdministrationService) {}
+  @Get() @RequirePermissions('inspection_acts.read') get(@Param('actId', new ParseUUIDPipe({ version: '4' })) actId: string) { return this.administration.detail(actId); }
+  @Patch('deadline') @RequirePermissions('inspection_findings.follow_up')
+  setDeadline(@Param('actId', new ParseUUIDPipe({ version: '4' })) actId: string, @Body() dto: SetActResponseDeadlineDto, @CurrentAuth() principal: AuthPrincipal, @Req() request: RequestWithContext) { return this.administration.setDeadline(actId, dto, principal, request); }
+  @Post('responses') @RequirePermissions('inspection_findings.follow_up')
+  @UseInterceptors(FileInterceptor('file', { limits: { fileSize: MAX_ACT_RESPONSE_BYTES, files: 1 } }))
+  addResponse(@Param('actId', new ParseUUIDPipe({ version: '4' })) actId: string, @Body() dto: CreateActCompanyResponseDto, @UploadedFile() file: UploadedActResponseFile | undefined, @CurrentAuth() principal: AuthPrincipal, @Req() request: RequestWithContext) { return this.administration.addResponse(actId, dto, file, principal, request); }
+}
+
+@Controller('act-company-responses')
+export class ActCompanyResponseContentController {
+  constructor(private readonly administration: ActAdministrationService) {}
+  @Get(':responseId/content') @RequirePermissions('inspection_acts.read')
+  async content(@Param('responseId', new ParseUUIDPipe({ version: '4' })) responseId: string, @Query('download') download: string | undefined, @Res() response: Response): Promise<void> {
+    const item = await this.administration.responseContent(responseId);
+    const disposition = download === '1' ? 'attachment' : 'inline';
+    const fallbackName = item.originalName.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+    response.setHeader('Content-Type', 'application/pdf');
+    response.setHeader('Content-Length', String(item.sizeBytes));
+    response.setHeader('Content-Disposition', `${disposition}; filename="${fallbackName}"; filename*=UTF-8''${encodeURIComponent(item.originalName)}`);
+    response.setHeader('Cache-Control', 'private, no-store');
+    response.setHeader('X-Content-Type-Options', 'nosniff');
+    response.setHeader('Content-Security-Policy', "sandbox; default-src 'none'");
+    await new Promise<void>((resolveSend, rejectSend) => response.sendFile(item.filePath, (error) => error ? rejectSend(error) : resolveSend()));
+  }
+}

api-v3/src/act-administration/act-administration.module.ts

@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import { AuditModule } from '../audit/audit.module';
+import {
+  ActAdministrationController,
+  ActAdministrationQueueController,
+  ActCompanyResponseContentController,
+} from './act-administration.controller';
+import { ActAdministrationService } from './act-administration.service';
+import { FieldBriefingController } from './field-briefing.controller';
+import { FieldBriefingService } from './field-briefing.service';
+
+@Module({
+  imports: [AuditModule],
+  controllers: [
+    ActAdministrationQueueController,
+    ActAdministrationController,
+    ActCompanyResponseContentController,
+    FieldBriefingController,
+  ],
+  providers: [ActAdministrationService, FieldBriefingService],
+})
+export class ActAdministrationModule {}

api-v3/src/act-administration/act-administration.service.ts

@@ -0,0 +1,180 @@
+
+import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
+import { createHash, randomUUID } from 'crypto';
+import { mkdir, stat, unlink, writeFile } from 'fs/promises';
+import { join, resolve } from 'path';
+import { DataSource } from 'typeorm';
+import { AuditService } from '../audit/audit.service';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import { CreateActCompanyResponseDto } from './dto/create-act-company-response.dto';
+import { ListActAdministrationQueryDto } from './dto/list-act-administration-query.dto';
+import { SetActResponseDeadlineDto } from './dto/set-act-response-deadline.dto';
+
+export const MAX_ACT_RESPONSE_BYTES = 15 * 1024 * 1024;
+export interface UploadedActResponseFile { originalname: string; mimetype: string; size: number; buffer: Buffer }
+
+const STORAGE = resolve(process.env.ACT_COMPANY_RESPONSE_STORAGE_DIR ?? '/app/storage/act-company-responses');
+
+@Injectable()
+export class ActAdministrationService {
+  constructor(private readonly dataSource: DataSource, private readonly audit: AuditService) {}
+
+  private baseCte() {
+    return `
+      WITH act_rows AS (
+        SELECT ia.id AS "actId", ia.code AS "actCode", ia.status AS "actStatus", ia.occurred_at AS "occurredAt",
+               ia.closed_at AS "closedAt", v.id AS "visitId", v.code AS "visitCode",
+               v.operational_area_id AS "areaId", v.operator_company_id AS "companyId",
+               area.name AS "areaName", COALESCE(op.legal_name, company.name) AS "companyName",
+               dl.id AS "deadlineEventId", dl.response_due_on AS "responseDueOn", dl.reason AS "deadlineReason",
+               dl.created_at AS "deadlineSetAt", rsp.id AS "latestResponseId", rsp.received_on AS "responseReceivedOn",
+               rsp.committed_correction_on AS "committedCorrectionOn",
+               COALESCE(fc.finding_count, 0)::int AS "findingCount",
+               COALESCE(fc.open_count, 0)::int AS "openFindingCount",
+               COALESCE(fc.scheduled_control_count, 0)::int AS "scheduledControlCount"
+        FROM inspection_acts ia
+        JOIN inspection_visits v ON v.id = ia.visit_id
+        LEFT JOIN assets area ON area.id = v.operational_area_id
+        LEFT JOIN assets company ON company.id = v.operator_company_id
+        LEFT JOIN organization_profiles op ON op.asset_id = v.operator_company_id
+        LEFT JOIN LATERAL (
+          SELECT d.* FROM inspection_act_deadline_events d WHERE d.act_id = ia.id ORDER BY d.created_at DESC, d.id DESC LIMIT 1
+        ) dl ON true
+        LEFT JOIN LATERAL (
+          SELECT r.* FROM inspection_act_company_responses r WHERE r.act_id = ia.id ORDER BY r.received_on DESC, r.created_at DESC, r.id DESC LIMIT 1
+        ) rsp ON true
+        LEFT JOIN LATERAL (
+          SELECT COUNT(*) FILTER (WHERE f.status <> 'VOIDED') AS finding_count,
+                 COUNT(*) FILTER (WHERE f.status = 'OPEN') AS open_count,
+                 COUNT(*) FILTER (WHERE f.status = 'OPEN' AND f.next_control_on IS NOT NULL) AS scheduled_control_count
+          FROM inspection_findings f WHERE f.act_id = ia.id
+        ) fc ON true
+        WHERE ia.status IN ('CLOSED', 'RECTIFIED')
+      ), classified AS (
+        SELECT *, CASE
+          WHEN "findingCount" > 0 AND "openFindingCount" = 0 THEN 'REGULARIZED'
+          WHEN "latestResponseId" IS NOT NULL AND "committedCorrectionOn" IS NOT NULL AND "committedCorrectionOn" < CURRENT_DATE AND "openFindingCount" > 0 THEN 'COMMITMENT_OVERDUE'
+          WHEN "latestResponseId" IS NOT NULL AND "openFindingCount" > 0 AND "scheduledControlCount" = 0 THEN 'VERIFICATION_PENDING'
+          WHEN "latestResponseId" IS NOT NULL THEN 'RESPONSE_RECEIVED'
+          WHEN "responseDueOn" IS NULL THEN 'NEW'
+          WHEN "responseDueOn" < CURRENT_DATE THEN 'OVERDUE'
+          WHEN "responseDueOn" <= CURRENT_DATE + 3 THEN 'DUE_SOON'
+          ELSE 'WAITING_RESPONSE'
+        END AS "adminState"
+        FROM act_rows
+      )`;
+  }
+
+  async queue(query: ListActAdministrationQueryDto) {
+    const page = query.page ?? 1;
+    const pageSize = query.pageSize ?? 25;
+    const filters: string[] = [];
+    const args: unknown[] = [];
+    const add = (sql: string, value: unknown) => { args.push(value); filters.push(sql.replace('?', `$${args.length}`)); };
+    if (query.areaId) add('"areaId" = ?', query.areaId);
+    if (query.companyId) add('"companyId" = ?', query.companyId);
+    if (query.state && query.state !== 'ALL') add('"adminState" = ?', query.state);
+    const where = filters.length ? `WHERE ${filters.join(' AND ')}` : '';
+    const rows = await this.dataSource.query(
+      `${this.baseCte()} SELECT *, COUNT(*) OVER()::int AS "totalRows" FROM classified ${where} ORDER BY "responseDueOn" ASC NULLS FIRST, "occurredAt" DESC LIMIT $${args.length + 1} OFFSET $${args.length + 2}`,
+      [...args, pageSize, (page - 1) * pageSize],
+    ) as Array<Record<string, unknown>>;
+    const total = Number(rows[0]?.totalRows ?? 0);
+    const counterFilters: string[] = [];
+    const counterArgs: unknown[] = [];
+    if (query.areaId) { counterArgs.push(query.areaId); counterFilters.push(`"areaId" = $${counterArgs.length}`); }
+    if (query.companyId) { counterArgs.push(query.companyId); counterFilters.push(`"companyId" = $${counterArgs.length}`); }
+    const countersRaw = await this.dataSource.query(
+      `${this.baseCte()} SELECT "adminState" AS state, COUNT(*)::int AS count FROM classified ${counterFilters.length ? `WHERE ${counterFilters.join(' AND ')}` : ''} GROUP BY "adminState"`,
+      counterArgs,
+    ) as Array<{ state: string; count: number }>;
+    const counters = Object.fromEntries(countersRaw.map((r) => [r.state, Number(r.count)]));
+    return {
+      data: rows.map(({ totalRows: _ignored, ...row }) => row),
+      counters,
+      meta: { page, pageSize, total, totalPages: Math.ceil(total / pageSize) },
+    };
+  }
+
+  async detail(actId: string) {
+    const rows = await this.dataSource.query(`${this.baseCte()} SELECT * FROM classified WHERE "actId" = $1`, [actId]);
+    const act = rows[0];
+    if (!act) throw new NotFoundException({ code: 'ACT_ADMIN_NOT_FOUND', message: 'El Acta no está disponible para seguimiento administrativo.' });
+    const deadlines = await this.dataSource.query(`SELECT id, response_due_on AS "responseDueOn", reason, created_by AS "createdBy", created_at AS "createdAt" FROM inspection_act_deadline_events WHERE act_id = $1 ORDER BY created_at DESC`, [actId]);
+    const responses = await this.dataSource.query(`SELECT id, received_on AS "receivedOn", details, committed_correction_on AS "committedCorrectionOn", contact_name AS "contactName", contact_email AS "contactEmail", original_name AS "originalName", mime_type AS "mimeType", size_bytes AS "sizeBytes", sha256, created_by AS "createdBy", created_at AS "createdAt" FROM inspection_act_company_responses WHERE act_id = $1 ORDER BY received_on DESC, created_at DESC`, [actId]);
+    const findings = await this.dataSource.query(`SELECT id, code, title, status, next_control_on AS "nextControlOn" FROM inspection_findings WHERE act_id = $1 AND status <> 'VOIDED' ORDER BY finding_number`, [actId]);
+    return { act, deadlines, responses, findings };
+  }
+
+  private async ensureClosedAct(actId: string) {
+    const rows = await this.dataSource.query(`SELECT id, code, status FROM inspection_acts WHERE id = $1`, [actId]);
+    const act = rows[0];
+    if (!act) throw new NotFoundException({ code: 'ACT_NOT_FOUND', message: 'Acta inexistente.' });
+    if (!['CLOSED', 'RECTIFIED'].includes(act.status)) throw new BadRequestException({ code: 'ACT_ADMIN_REQUIRES_CLOSED', message: 'El seguimiento administrativo comienza cuando el Acta está cerrada.' });
+    return act;
+  }
+
+  async setDeadline(actId: string, dto: SetActResponseDeadlineDto, principal: AuthPrincipal, request: RequestWithContext) {
+    const act = await this.ensureClosedAct(actId);
+    const rows = await this.dataSource.query(
+      `INSERT INTO inspection_act_deadline_events (id, act_id, response_due_on, reason, created_by) VALUES ($1,$2,$3,$4,$5) RETURNING id, response_due_on AS "responseDueOn", reason, created_at AS "createdAt"`,
+      [randomUUID(), actId, dto.responseDueOn, dto.reason, principal.userId],
+    );
+    await this.audit.record({ actorUserId: principal.userId, actorUsername: principal.username, action: 'ACT_RESPONSE_DEADLINE_SET', entityType: 'inspection_act', entityId: actId, requestId: request.requestId, afterData: { actCode: act.code, responseDueOn: dto.responseDueOn, reason: dto.reason } });
+    return rows[0];
+  }
+
+  async addResponse(actId: string, dto: CreateActCompanyResponseDto, file: UploadedActResponseFile | undefined, principal: AuthPrincipal, request: RequestWithContext) {
+    const act = await this.ensureClosedAct(actId);
+    let storedName: string | null = null;
+    let sha256: string | null = null;
+    if (file) {
+      if (file.size <= 0 || file.size > MAX_ACT_RESPONSE_BYTES) throw new BadRequestException({ code: 'ACT_RESPONSE_FILE_SIZE', message: 'El PDF supera el límite permitido.' });
+      if (file.mimetype !== 'application/pdf' || file.buffer.subarray(0, 5).toString('ascii') !== '%PDF-') throw new BadRequestException({ code: 'ACT_RESPONSE_FILE_TYPE', message: 'La respuesta adjunta debe ser un PDF válido.' });
+      await mkdir(STORAGE, { recursive: true });
+      sha256 = createHash('sha256').update(file.buffer).digest('hex');
+      storedName = `${randomUUID()}.pdf`;
+      await writeFile(join(STORAGE, storedName), file.buffer, { flag: 'wx' });
+    }
+    try {
+      const rows = await this.dataSource.query(
+        `INSERT INTO inspection_act_company_responses (id, act_id, received_on, details, committed_correction_on, contact_name, contact_email, original_name, stored_name, mime_type, size_bytes, sha256, created_by)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)
+         RETURNING id, received_on AS "receivedOn", details, committed_correction_on AS "committedCorrectionOn", contact_name AS "contactName", contact_email AS "contactEmail", original_name AS "originalName", size_bytes AS "sizeBytes", sha256, created_at AS "createdAt"`,
+        [randomUUID(), actId, dto.receivedOn, dto.details ?? null, dto.committedCorrectionOn ?? null, dto.contactName ?? null, dto.contactEmail ?? null, file?.originalname ?? null, storedName, file ? 'application/pdf' : null, file?.size ?? null, sha256, principal.userId],
+      );
+      await this.audit.record({ actorUserId: principal.userId, actorUsername: principal.username, action: 'ACT_COMPANY_RESPONSE_RECORDED', entityType: 'inspection_act', entityId: actId, requestId: request.requestId, afterData: { actCode: act.code, receivedOn: dto.receivedOn, committedCorrectionOn: dto.committedCorrectionOn ?? null, hasPdf: Boolean(file), sha256 } });
+      return rows[0];
+    } catch (error) {
+      if (storedName) await unlink(join(STORAGE, storedName)).catch(() => undefined);
+      throw error;
+    }
+  }
+
+  async responseContent(responseId: string) {
+    const rows = await this.dataSource.query(`SELECT original_name AS "originalName", stored_name AS "storedName", size_bytes AS "sizeBytes" FROM inspection_act_company_responses WHERE id = $1 AND stored_name IS NOT NULL`, [responseId]);
+    const row = rows[0];
+    if (!row) throw new NotFoundException({ code: 'ACT_RESPONSE_FILE_NOT_FOUND', message: 'PDF de respuesta inexistente.' });
+    const filePath = join(STORAGE, row.storedName);
+    const info = await stat(filePath).catch(() => null);
+    if (!info?.isFile()) throw new NotFoundException({ code: 'ACT_RESPONSE_FILE_NOT_FOUND', message: 'El archivo de respuesta no está disponible.' });
+    return { originalName: row.originalName as string, sizeBytes: Number(row.sizeBytes), filePath };
+  }
+
+  async calendar(from?: string, to?: string) {
+    const dateRe = /^\d{4}-\d{2}-\d{2}$/;
+    if ((from && !dateRe.test(from)) || (to && !dateRe.test(to))) throw new BadRequestException({ code: 'INVALID_DATE_RANGE', message: 'Las fechas deben usar YYYY-MM-DD.' });
+    const start = from ?? new Date().toISOString().slice(0, 10);
+    const endDate = new Date(`${to ?? start}T00:00:00Z`);
+    if (!to) endDate.setUTCDate(endDate.getUTCDate() + 60);
+    const end = endDate.toISOString().slice(0, 10);
+    if (start > end) throw new BadRequestException({ code: 'INVALID_DATE_RANGE', message: 'El rango de fechas es inválido.' });
+    const rows = await this.dataSource.query(`${this.baseCte()} SELECT * FROM classified WHERE ("responseDueOn" BETWEEN $1 AND $2) OR ("committedCorrectionOn" BETWEEN $1 AND $2) ORDER BY COALESCE("responseDueOn", "committedCorrectionOn")`, [start, end]);
+    const events: Array<Record<string, unknown>> = [];
+    for (const row of rows) {
+      if (row.responseDueOn && row.responseDueOn >= start && row.responseDueOn <= end) events.push({ type: 'RESPONSE_DUE', date: row.responseDueOn, actId: row.actId, actCode: row.actCode, areaName: row.areaName, companyName: row.companyName, state: row.adminState });
+      if (row.committedCorrectionOn && row.committedCorrectionOn >= start && row.committedCorrectionOn <= end) events.push({ type: 'COMMITMENT_DUE', date: row.committedCorrectionOn, actId: row.actId, actCode: row.actCode, areaName: row.areaName, companyName: row.companyName, state: row.adminState });
+    }
+    return { from: start, to: end, data: events.sort((a, b) => String(a.date).localeCompare(String(b.date))) };
+  }
+}

api-v3/src/act-administration/dto/create-act-company-response.dto.ts

@@ -0,0 +1,31 @@
+
+import { Transform } from 'class-transformer';
+import { IsDateString, IsEmail, IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
+
+export class CreateActCompanyResponseDto {
+  @IsDateString()
+  receivedOn!: string;
+
+  @IsOptional()
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MinLength(3)
+  @MaxLength(8000)
+  details?: string;
+
+  @IsOptional()
+  @IsDateString()
+  committedCorrectionOn?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MaxLength(200)
+  contactName?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsEmail()
+  @MaxLength(320)
+  contactEmail?: string;
+}

api-v3/src/act-administration/dto/list-act-administration-query.dto.ts

@@ -0,0 +1,17 @@
+
+import { Transform } from 'class-transformer';
+import { IsIn, IsInt, IsOptional, IsUUID, Max, Min } from 'class-validator';
+
+export const ACT_ADMIN_STATES = [
+  'ALL', 'NEW', 'WAITING_RESPONSE', 'DUE_SOON', 'OVERDUE',
+  'RESPONSE_RECEIVED', 'VERIFICATION_PENDING', 'COMMITMENT_OVERDUE', 'REGULARIZED',
+] as const;
+export type ActAdministrationState = typeof ACT_ADMIN_STATES[number];
+
+export class ListActAdministrationQueryDto {
+  @IsOptional() @IsIn(ACT_ADMIN_STATES) state?: ActAdministrationState;
+  @IsOptional() @IsUUID('4') areaId?: string;
+  @IsOptional() @IsUUID('4') companyId?: string;
+  @IsOptional() @Transform(({ value }) => Number(value)) @IsInt() @Min(1) page?: number;
+  @IsOptional() @Transform(({ value }) => Number(value)) @IsInt() @Min(1) @Max(100) pageSize?: number;
+}

api-v3/src/act-administration/dto/set-act-response-deadline.dto.ts

@@ -0,0 +1,14 @@
+
+import { Transform } from 'class-transformer';
+import { IsDateString, IsString, MaxLength, MinLength } from 'class-validator';
+
+export class SetActResponseDeadlineDto {
+  @IsDateString()
+  responseDueOn!: string;
+
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MinLength(3)
+  @MaxLength(1000)
+  reason!: string;
+}

api-v3/src/act-administration/field-briefing.controller.ts

@@ -0,0 +1,14 @@
+import { Controller, Get, Param, ParseUUIDPipe } from '@nestjs/common';
+import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import { FieldBriefingService } from './field-briefing.service';
+
+@Controller('inspection-visits/:visitId/field-briefing')
+export class FieldBriefingController {
+  constructor(private readonly briefing: FieldBriefingService) {}
+
+  @Get()
+  @RequirePermissions('inspections.read')
+  get(@Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string) {
+    return this.briefing.forVisit(visitId);
+  }
+}

api-v3/src/act-administration/field-briefing.service.ts

@@ -0,0 +1,242 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+
+export type FieldBriefingActState =
+  | 'ACT_RESPONSE_OVERDUE'
+  | 'ACT_RESPONSE_DUE_SOON'
+  | 'WAITING_RESPONSE'
+  | 'COMPANY_COMMITMENT_OVERDUE'
+  | 'VERIFICATION_PENDING'
+  | 'RESPONSE_RECEIVED';
+
+export interface FieldBriefingFinding {
+  id: string;
+  code: string;
+  title: string;
+  status: string;
+  severity: number | null;
+  nextControlOn: string | null;
+  asset: {
+    id: string;
+    code: string;
+    name: string;
+    typeName: string;
+  };
+}
+
+export interface FieldBriefingAct {
+  actId: string;
+  actCode: string;
+  occurredAt: Date;
+  adminState: FieldBriefingActState;
+  responseDueOn: string | null;
+  responseReceivedOn: string | null;
+  committedCorrectionOn: string | null;
+  latestResponseId: string | null;
+  findings: FieldBriefingFinding[];
+}
+
+@Injectable()
+export class FieldBriefingService {
+  constructor(private readonly dataSource: DataSource) {}
+
+  async forVisit(visitId: string) {
+    const [visit] = (await this.dataSource.query(`
+      SELECT
+        visit.id,
+        visit.code,
+        visit.status,
+        visit.planned_start_at AS "plannedStartAt",
+        visit.operational_area_id AS "areaId",
+        visit.operator_company_id AS "companyId",
+        area.code AS "areaCode",
+        area.name AS "areaName",
+        company.code AS "companyCode",
+        COALESCE(profile.legal_name, company.name) AS "companyName"
+      FROM inspection_visits visit
+      LEFT JOIN assets area ON area.id = visit.operational_area_id
+      LEFT JOIN assets company ON company.id = visit.operator_company_id
+      LEFT JOIN organization_profiles profile ON profile.asset_id = company.id
+      WHERE visit.id = $1
+    `, [visitId])) as Array<Record<string, unknown>>;
+
+    if (!visit) {
+      throw new NotFoundException({
+        code: 'INSPECTION_VISIT_NOT_FOUND',
+        message: 'Inspección no encontrada',
+      });
+    }
+
+    const plannedOn = String(visit.plannedStartAt ?? new Date().toISOString()).slice(0, 10);
+
+    const rows = (await this.dataSource.query(`
+      WITH prior_acts AS (
+        SELECT
+          act.id AS act_id,
+          act.code AS act_code,
+          act.occurred_at,
+          deadline.response_due_on,
+          response.id AS latest_response_id,
+          response.received_on AS response_received_on,
+          response.committed_correction_on,
+          finding.id AS finding_id,
+          finding.code AS finding_code,
+          finding.title AS finding_title,
+          finding.status AS finding_status,
+          finding.severity,
+          finding.next_control_on,
+          asset.id AS asset_id,
+          asset.code AS asset_code,
+          asset.name AS asset_name,
+          asset_type.name AS asset_type_name,
+          CASE
+            WHEN response.id IS NULL
+              AND deadline.response_due_on IS NOT NULL
+              AND deadline.response_due_on < $4::date
+              THEN 'ACT_RESPONSE_OVERDUE'
+            WHEN response.id IS NULL
+              AND deadline.response_due_on IS NOT NULL
+              AND deadline.response_due_on BETWEEN $4::date AND ($4::date + 3)
+              THEN 'ACT_RESPONSE_DUE_SOON'
+            WHEN response.id IS NOT NULL
+              AND response.committed_correction_on IS NOT NULL
+              AND response.committed_correction_on < $4::date
+              THEN 'COMPANY_COMMITMENT_OVERDUE'
+            WHEN response.id IS NOT NULL
+              AND finding.next_control_on IS NULL
+              THEN 'VERIFICATION_PENDING'
+            WHEN response.id IS NOT NULL
+              THEN 'RESPONSE_RECEIVED'
+            ELSE 'WAITING_RESPONSE'
+          END AS admin_state
+        FROM inspection_acts act
+        INNER JOIN inspection_visits source_visit ON source_visit.id = act.visit_id
+        INNER JOIN inspection_findings finding ON finding.act_id = act.id
+          AND finding.status = 'OPEN'
+        INNER JOIN assets asset ON asset.id = finding.asset_id
+        INNER JOIN asset_types asset_type ON asset_type.id = asset.asset_type_id
+        LEFT JOIN LATERAL (
+          SELECT event.response_due_on
+          FROM inspection_act_deadline_events event
+          WHERE event.act_id = act.id
+          ORDER BY event.created_at DESC, event.id DESC
+          LIMIT 1
+        ) deadline ON true
+        LEFT JOIN LATERAL (
+          SELECT company_response.id, company_response.received_on, company_response.committed_correction_on
+          FROM inspection_act_company_responses company_response
+          WHERE company_response.act_id = act.id
+          ORDER BY company_response.received_on DESC, company_response.created_at DESC, company_response.id DESC
+          LIMIT 1
+        ) response ON true
+        WHERE act.status IN ('CLOSED', 'RECTIFIED')
+          AND source_visit.id <> $1
+          AND source_visit.operational_area_id = $2::uuid
+          AND source_visit.operator_company_id = $3::uuid
+      )
+      SELECT *
+      FROM prior_acts
+      WHERE admin_state IN (
+        'ACT_RESPONSE_OVERDUE',
+        'ACT_RESPONSE_DUE_SOON',
+        'COMPANY_COMMITMENT_OVERDUE',
+        'VERIFICATION_PENDING',
+        'RESPONSE_RECEIVED'
+      )
+         OR next_control_on IS NOT NULL
+      ORDER BY
+        CASE admin_state
+          WHEN 'ACT_RESPONSE_OVERDUE' THEN 1
+          WHEN 'COMPANY_COMMITMENT_OVERDUE' THEN 2
+          WHEN 'VERIFICATION_PENDING' THEN 3
+          WHEN 'ACT_RESPONSE_DUE_SOON' THEN 4
+          ELSE 5
+        END,
+        response_due_on NULLS LAST,
+        occurred_at,
+        act_code,
+        finding_code
+    `, [visitId, visit.areaId, visit.companyId, plannedOn])) as Array<{
+      act_id: string;
+      act_code: string;
+      occurred_at: Date;
+      response_due_on: string | null;
+      latest_response_id: string | null;
+      response_received_on: string | null;
+      committed_correction_on: string | null;
+      finding_id: string;
+      finding_code: string;
+      finding_title: string;
+      finding_status: string;
+      severity: number | null;
+      next_control_on: string | null;
+      asset_id: string;
+      asset_code: string;
+      asset_name: string;
+      asset_type_name: string;
+      admin_state: FieldBriefingActState;
+    }>;
+
+    const byAct = new Map<string, FieldBriefingAct>();
+    for (const row of rows) {
+      let act = byAct.get(row.act_id);
+      if (!act) {
+        act = {
+          actId: row.act_id,
+          actCode: row.act_code,
+          occurredAt: row.occurred_at,
+          adminState: row.admin_state,
+          responseDueOn: row.response_due_on,
+          responseReceivedOn: row.response_received_on,
+          committedCorrectionOn: row.committed_correction_on,
+          latestResponseId: row.latest_response_id,
+          findings: [],
+        };
+        byAct.set(row.act_id, act);
+      }
+      act.findings.push({
+        id: row.finding_id,
+        code: row.finding_code,
+        title: row.finding_title,
+        status: row.finding_status,
+        severity: row.severity,
+        nextControlOn: row.next_control_on,
+        asset: {
+          id: row.asset_id,
+          code: row.asset_code,
+          name: row.asset_name,
+          typeName: row.asset_type_name,
+        },
+      });
+    }
+
+    const acts = [...byAct.values()];
+    const assetIds = new Set<string>();
+    let findingCount = 0;
+    for (const act of acts) {
+      findingCount += act.findings.length;
+      for (const finding of act.findings) assetIds.add(finding.asset.id);
+    }
+
+    return {
+      inspection: {
+        id: visit.id,
+        code: visit.code,
+        status: visit.status,
+        plannedStartAt: visit.plannedStartAt,
+        area: visit.areaId ? { id: visit.areaId, code: visit.areaCode, name: visit.areaName } : null,
+        operatorCompany: visit.companyId ? { id: visit.companyId, code: visit.companyCode, name: visit.companyName } : null,
+      },
+      plannedOn,
+      summary: {
+        acts: acts.length,
+        findings: findingCount,
+        inventoryItems: assetIds.size,
+        responseOverdue: acts.filter((item) => item.adminState === 'ACT_RESPONSE_OVERDUE').length,
+        commitmentOverdue: acts.filter((item) => item.adminState === 'COMPANY_COMMITMENT_OVERDUE').length,
+        verificationPending: acts.filter((item) => item.adminState === 'VERIFICATION_PENDING').length,
+      },
+      acts,
+    };
+  }
+}

api-v3/src/app.module.ts

@@ -24,6 +24,7 @@ import { InspectionClosingModule } from './inspection-closing/inspection-closing
 import { AssetImportsModule } from './asset-imports/asset-imports.module';
 import { InspectionReportsModule } from './inspection-reports/inspection-reports.module';
 import { InspectionVerificationsModule } from './inspection-verifications/inspection-verifications.module';
+import { ActAdministrationModule } from './act-administration/act-administration.module';
 
 function required(config: ConfigService, key: string): string {
   const value = config.get<string>(key);
@@ -76,6 +77,7 @@ function required(config: ConfigService, key: string): string {
     InspectionClosingModule,
     InspectionReportsModule,
     InspectionVerificationsModule,
+    ActAdministrationModule,
     AssetImportsModule,
   ],
   controllers: [HealthController],

api-v3/src/asset-master/asset-master.module.ts

@@ -49,6 +49,12 @@ import { FieldDiscoveryInspectionLinkService } from '../inspection-operations/fi
     AssetRegistryService,
     FieldDiscoveryInspectionLinkService,
   ],
-  exports: [AssetHistoryService],
+  exports: [
+    AssetHistoryService,
+    AssetsService,
+    AssetGeometriesService,
+    AssetMediaService,
+    FieldDiscoveryInspectionLinkService,
+  ],
 })
 export class AssetMasterModule {}

api-v3/src/auth/auth.module.ts

@@ -5,6 +5,8 @@ import { AuthorizationModule } from '../authorization/authorization.module';
 import { PhaseADataModule } from '../core-data/phase-a-data.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
+import { MobileAuthController } from './mobile-auth.controller';
+import { MobileAuthService } from './mobile-auth.service';
 import { AccessTokenGuard } from './guards/access-token.guard';
 import { CsrfGuard } from './guards/csrf.guard';
 import { AuthConfigService } from '../common/config/auth-config.service';
@@ -18,6 +20,7 @@ const providers = [
   PasswordService,
   TokenService,
   AuthService,
+  MobileAuthService,
   AccessTokenGuard,
   CsrfGuard,
 ];
@@ -29,7 +32,7 @@ const providers = [
     AuditModule,
     AuthorizationModule,
   ],
-  controllers: [AuthController],
+  controllers: [AuthController, MobileAuthController],
   providers,
   exports: [
     AuthConfigService,

api-v3/src/auth/dto/mobile-refresh.dto.ts

@@ -0,0 +1,8 @@
+import { IsString, MaxLength, MinLength } from 'class-validator';
+
+export class MobileRefreshDto {
+  @IsString()
+  @MinLength(32)
+  @MaxLength(256)
+  refreshToken!: string;
+}

api-v3/src/auth/mobile-auth.controller.ts

@@ -0,0 +1,56 @@
+import {
+  Body,
+  Controller,
+  HttpCode,
+  Post,
+  Req,
+} from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import type {
+  AuthPrincipal,
+  RequestWithContext,
+} from '../common/http/request-context';
+import { CurrentAuth } from './decorators/current-auth.decorator';
+import { Public } from './decorators/public.decorator';
+import { SkipCsrf } from './decorators/skip-csrf.decorator';
+import { LoginDto } from './dto/login.dto';
+import { MobileRefreshDto } from './dto/mobile-refresh.dto';
+import { MobileAuthService } from './mobile-auth.service';
+
+@Controller('auth/mobile')
+export class MobileAuthController {
+  constructor(private readonly mobileAuth: MobileAuthService) {}
+
+  @Post('login')
+  @HttpCode(200)
+  @Public()
+  @SkipCsrf()
+  @Throttle({ default: { limit: 5, ttl: 60_000, blockDuration: 60_000 } })
+  login(
+    @Body() dto: LoginDto,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.login(dto, request);
+  }
+
+  @Post('refresh')
+  @HttpCode(200)
+  @Public()
+  @SkipCsrf()
+  @Throttle({ default: { limit: 20, ttl: 60_000 } })
+  refresh(
+    @Body() dto: MobileRefreshDto,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.refresh(dto.refreshToken, request);
+  }
+
+  @Post('logout')
+  @HttpCode(200)
+  logout(
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.logout(principal, request);
+  }
+}

api-v3/src/auth/mobile-auth.service.ts

@@ -0,0 +1,386 @@
+import { isIP } from 'node:net';
+import {
+  ForbiddenException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { AuditService } from '../audit/audit.service';
+import type {
+  AuthPrincipal,
+  RequestWithContext,
+} from '../common/http/request-context';
+import { AuthSessionsRepository } from '../core-data/repositories/auth-sessions.repository';
+import { RolesRepository } from '../core-data/repositories/roles.repository';
+import { UsersRepository } from '../core-data/repositories/users.repository';
+import {
+  AuditAction,
+  AuditSource,
+  AuthSession,
+  User,
+  UserStatus,
+} from '../database/entities';
+import type { LoginDto } from './dto/login.dto';
+import { PasswordService } from './services/password.service';
+import {
+  IssuedRefreshToken,
+  TokenService,
+} from './services/token.service';
+
+interface RequestMetadata {
+  ip: string | null;
+  userAgent: string | null;
+}
+
+interface SuccessfulAuthentication {
+  user: User;
+  accessToken: string;
+  refreshToken: IssuedRefreshToken;
+}
+
+type LoginOutcome = SuccessfulAuthentication | null;
+type RefreshOutcome =
+  | ({ kind: 'ok' } & SuccessfulAuthentication)
+  | { kind: 'reuse' }
+  | { kind: 'invalid' };
+
+function invalidCredentials(): UnauthorizedException {
+  return new UnauthorizedException({
+    code: 'INVALID_CREDENTIALS',
+    message: 'Credenciales inválidas',
+  });
+}
+
+function invalidSession(): UnauthorizedException {
+  return new UnauthorizedException({
+    code: 'INVALID_SESSION',
+    message: 'Sesión móvil inválida o vencida',
+  });
+}
+
+function inspectorRequired(): ForbiddenException {
+  return new ForbiddenException({
+    code: 'INSPECTION_INSPECTOR_ROLE_REQUIRED',
+    message: 'Sólo un usuario con rol inspector puede ingresar a la aplicación móvil',
+  });
+}
+
+function requestMetadata(request: RequestWithContext): RequestMetadata {
+  const candidateIp = request.ip || request.socket.remoteAddress || '';
+  const ip = isIP(candidateIp) ? candidateIp : null;
+  const rawUserAgent = request.header('user-agent')?.trim();
+  return {
+    ip,
+    userAgent: rawUserAgent ? rawUserAgent.slice(0, 2048) : null,
+  };
+}
+
+@Injectable()
+export class MobileAuthService {
+  constructor(
+    private readonly dataSource: DataSource,
+    private readonly users: UsersRepository,
+    private readonly sessions: AuthSessionsRepository,
+    private readonly roles: RolesRepository,
+    private readonly passwords: PasswordService,
+    private readonly tokens: TokenService,
+    private readonly audit: AuditService,
+  ) {}
+
+  async login(dto: LoginDto, request: RequestWithContext) {
+    const identifier = dto.identifier.trim().toLowerCase();
+    const candidate = await this.users.findForAuthentication(identifier);
+    const metadata = requestMetadata(request);
+
+    if (!candidate) {
+      await this.passwords.verifyUnknown(dto.password);
+      await this.audit.record({
+        action: AuditAction.AUTH_LOGIN_FAILED,
+        requestId: request.requestId,
+        source: AuditSource.ANDROID,
+        ...metadata,
+        metadata: { identifier, reason: 'UNKNOWN_IDENTIFIER' },
+      });
+      throw invalidCredentials();
+    }
+
+    const outcome = await this.dataSource.transaction<LoginOutcome>(
+      async (manager) => {
+        const user = await manager
+          .getRepository(User)
+          .createQueryBuilder('user')
+          .addSelect('user.passwordHash')
+          .where('user.id = :id', { id: candidate.id })
+          .setLock('pessimistic_write')
+          .getOne();
+        if (!user) return null;
+
+        const now = new Date();
+        const passwordMatches = await this.passwords.verify(
+          user.passwordHash,
+          dto.password,
+        );
+        const locked = Boolean(user.lockedUntil && user.lockedUntil > now);
+        const active = user.status === UserStatus.ACTIVE;
+
+        if (!passwordMatches || locked || !active) {
+          if (!passwordMatches && active && !locked) {
+            await manager.query(
+              `
+                UPDATE users
+                SET
+                  failed_login_attempts = failed_login_attempts + 1,
+                  locked_until = CASE
+                    WHEN failed_login_attempts + 1 >= $2
+                      THEN CURRENT_TIMESTAMP + ($3 * INTERVAL '1 second')
+                    ELSE locked_until
+                  END,
+                  updated_at = CURRENT_TIMESTAMP
+                WHERE id = $1
+              `,
+              [
+                user.id,
+                this.tokens.maxLoginAttempts,
+                this.tokens.lockoutSeconds,
+              ],
+            );
+          }
+
+          await this.audit.record(
+            {
+              actorUserId: user.id,
+              actorUsername: user.username,
+              action: AuditAction.AUTH_LOGIN_FAILED,
+              entityType: 'user',
+              entityId: user.id,
+              requestId: request.requestId,
+              source: AuditSource.ANDROID,
+              ...metadata,
+              metadata: {
+                reason: !active
+                  ? 'INACTIVE_USER'
+                  : locked
+                    ? 'LOCKED_USER'
+                    : 'INVALID_PASSWORD',
+              },
+            },
+            manager,
+          );
+          return null;
+        }
+
+        if (this.passwords.needsRehash(user.passwordHash)) {
+          user.passwordHash = await this.passwords.hash(dto.password);
+        }
+        user.failedLoginAttempts = 0;
+        user.lockedUntil = null;
+        user.lastLoginAt = now;
+        await manager.getRepository(User).save(user);
+
+        const refreshToken = this.tokens.issueRefreshToken();
+        const session = manager.getRepository(AuthSession).create({
+          id: refreshToken.sessionId,
+          userId: user.id,
+          refreshTokenHash: refreshToken.tokenHash,
+          expiresAt: this.tokens.refreshExpiresAt(now),
+          lastUsedAt: now,
+          revokedAt: null,
+          replacedBySessionId: null,
+          ip: metadata.ip,
+          userAgent: metadata.userAgent,
+          deviceLabel: dto.deviceLabel?.trim() || 'DH Android',
+        });
+        await manager.getRepository(AuthSession).save(session);
+
+        const accessToken = await this.tokens.issueAccessToken({
+          userId: user.id,
+          sessionId: session.id,
+          username: user.username,
+        });
+
+        await this.audit.record(
+          {
+            actorUserId: user.id,
+            actorUsername: user.username,
+            action: AuditAction.AUTH_LOGIN_SUCCESS,
+            entityType: 'auth_session',
+            entityId: session.id,
+            requestId: request.requestId,
+            source: AuditSource.ANDROID,
+            ...metadata,
+            metadata: { deviceLabel: session.deviceLabel },
+          },
+          manager,
+        );
+
+        return { user, accessToken, refreshToken };
+      },
+    );
+
+    if (!outcome) throw invalidCredentials();
+    return this.complete(outcome);
+  }
+
+  async refresh(rawToken: string, request: RequestWithContext) {
+    const parsed = this.tokens.parseRefreshToken(rawToken);
+    if (!parsed) throw invalidSession();
+
+    const metadata = requestMetadata(request);
+    const outcome = await this.dataSource.transaction<RefreshOutcome>(
+      async (manager) => {
+        const session = await manager
+          .getRepository(AuthSession)
+          .createQueryBuilder('session')
+          .addSelect('session.refreshTokenHash')
+          .where('session.id = :id', { id: parsed.sessionId })
+          .setLock('pessimistic_write')
+          .getOne();
+
+        if (
+          !session ||
+          !this.tokens.verifyRefreshToken(rawToken, session.refreshTokenHash)
+        ) {
+          return { kind: 'invalid' };
+        }
+
+        const user = await manager.getRepository(User).findOne({
+          where: { id: session.userId },
+        });
+
+        if (session.revokedAt) {
+          await this.sessions.revokeSessionFamily(session.id, manager);
+          await this.audit.record(
+            {
+              actorUserId: user?.id ?? null,
+              actorUsername: user?.username ?? null,
+              action: AuditAction.AUTH_REFRESH_REUSE_DETECTED,
+              entityType: 'auth_session',
+              entityId: session.id,
+              requestId: request.requestId,
+              source: AuditSource.ANDROID,
+              ...metadata,
+            },
+            manager,
+          );
+          return { kind: 'reuse' };
+        }
+
+        const now = new Date();
+        if (!user || user.status !== UserStatus.ACTIVE || session.expiresAt <= now) {
+          session.revokedAt = now;
+          session.lastUsedAt = now;
+          await manager.getRepository(AuthSession).save(session);
+          if (user?.status === UserStatus.INACTIVE) {
+            await this.sessions.revokeUserSessions(user.id, undefined, manager);
+          }
+          return { kind: 'invalid' };
+        }
+
+        const refreshToken = this.tokens.issueRefreshToken();
+        const replacement = manager.getRepository(AuthSession).create({
+          id: refreshToken.sessionId,
+          userId: user.id,
+          refreshTokenHash: refreshToken.tokenHash,
+          expiresAt: this.tokens.refreshExpiresAt(now),
+          lastUsedAt: now,
+          revokedAt: null,
+          replacedBySessionId: null,
+          ip: metadata.ip,
+          userAgent: metadata.userAgent,
+          deviceLabel: session.deviceLabel,
+        });
+        await manager.getRepository(AuthSession).save(replacement);
+
+        session.revokedAt = now;
+        session.lastUsedAt = now;
+        session.replacedBySessionId = replacement.id;
+        await manager.getRepository(AuthSession).save(session);
+
+        const accessToken = await this.tokens.issueAccessToken({
+          userId: user.id,
+          sessionId: replacement.id,
+          username: user.username,
+        });
+
+        await this.audit.record(
+          {
+            actorUserId: user.id,
+            actorUsername: user.username,
+            action: AuditAction.AUTH_REFRESH,
+            entityType: 'auth_session',
+            entityId: replacement.id,
+            requestId: request.requestId,
+            source: AuditSource.ANDROID,
+            ...metadata,
+            metadata: { replacedSessionId: session.id },
+          },
+          manager,
+        );
+
+        return { kind: 'ok', user, accessToken, refreshToken };
+      },
+    );
+
+    if (outcome.kind !== 'ok') throw invalidSession();
+    return this.complete(outcome);
+  }
+
+  async logout(
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ) {
+    const metadata = requestMetadata(request);
+    await this.dataSource.transaction(async (manager) => {
+      await this.sessions.revokeSession(
+        principal.sessionId,
+        principal.userId,
+        manager,
+      );
+      await this.audit.record(
+        {
+          actorUserId: principal.userId,
+          actorUsername: principal.username,
+          action: AuditAction.AUTH_LOGOUT,
+          entityType: 'auth_session',
+          entityId: principal.sessionId,
+          requestId: request.requestId,
+          source: AuditSource.ANDROID,
+          ...metadata,
+        },
+        manager,
+      );
+    });
+    return { status: 'ok' };
+  }
+
+  private async complete(authentication: SuccessfulAuthentication) {
+    const [roleCodes, permissionCodes] = await Promise.all([
+      this.roles.findRoleCodesForUser(authentication.user.id),
+      this.roles.findPermissionCodesForUser(authentication.user.id),
+    ]);
+
+    if (!roleCodes.includes('inspector')) {
+      await this.sessions.revokeSession(
+        authentication.refreshToken.sessionId,
+        authentication.user.id,
+      );
+      throw inspectorRequired();
+    }
+
+    return {
+      user: {
+        id: authentication.user.id,
+        username: authentication.user.username,
+        firstName: authentication.user.firstName,
+        lastName: authentication.user.lastName,
+        email: authentication.user.email,
+        mustChangePassword: authentication.user.mustChangePassword,
+        roles: roleCodes,
+        permissions: permissionCodes,
+      },
+      accessToken: authentication.accessToken,
+      refreshToken: authentication.refreshToken.token,
+      accessExpiresInSeconds: this.tokens.accessTokenTtlSeconds,
+    };
+  }
+}

api-v3/src/database/entities/index.ts

@@ -93,6 +93,7 @@ export {
   InspectionActSignatureSource,
   InspectionActSignatureStatus,
   InspectionActSignerType,
+  InspectionCompanySignatureManifestation,
 } from './inspection-act-signature.entity';
 export { FindingCategory } from './finding-category.entity';
 export { FindingCatalogItem } from './finding-catalog-item.entity';

api-v3/src/database/entities/inspection-act-signature.entity.ts

@@ -17,6 +17,11 @@ export enum InspectionActSignatureSource {
   ANDROID = 'ANDROID',
 }
 
+export enum InspectionCompanySignatureManifestation {
+  CONFORMITY = 'CONFORMITY',
+  DISSENT = 'DISSENT',
+}
+
 @Entity({ name: 'inspection_act_signatures' })
 @Index('idx_inspection_act_signatures_act_created', ['actId', 'createdAt'])
 @Index('idx_inspection_act_signatures_sha256', ['signaturePayloadSha256'])
@@ -51,6 +56,12 @@ export class InspectionActSignature {
   @Column({ type: 'text', nullable: true })
   reason!: string | null;
 
+  @Column({ name: 'company_manifestation', type: 'varchar', length: 20, nullable: true })
+  companyManifestation!: InspectionCompanySignatureManifestation | null;
+
+  @Column({ name: 'company_statement', type: 'text', nullable: true })
+  companyStatement!: string | null;
+
   @Column({ name: 'original_name', type: 'varchar', length: 255, nullable: true })
   originalName!: string | null;
 

api-v3/src/database/entities/inspection-act.entity.ts

@@ -10,7 +10,7 @@ export enum InspectionActStatus {
 }
 
 @Entity({ name: 'inspection_acts' })
-@Index('uq_inspection_acts_visit', ['visitId'], { unique: true })
+@Index('uq_inspection_acts_one_draft_per_visit', ['visitId'], { unique: true, where: "status = 'DRAFT'" })
 @Index('uq_inspection_acts_year_number', ['actYear', 'actNumber'], { unique: true })
 @Index('uq_inspection_acts_code', ['code'], { unique: true })
 @Index('idx_inspection_acts_visit_status', ['visitId', 'status'])

api-v3/src/database/entities/inspection-report.entity.ts

@@ -25,7 +25,7 @@ export enum InspectionReportReviewStatus {
 }
 
 @Entity({ name: 'inspection_reports' })
-@Index('uq_inspection_reports_visit', ['visitId'], { unique: true })
+@Index('idx_inspection_reports_visit_id', ['visitId'])
 @Index('uq_inspection_reports_act', ['actId'], { unique: true })
 @Index('uq_inspection_reports_year_number', ['reportYear', 'reportNumber'], { unique: true })
 @Index('uq_inspection_reports_code', ['code'], { unique: true })

api-v3/src/database/migrations/1788652800000-reset-production-operational-data.ts

@@ -0,0 +1,173 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * One-time production reset requested before the first clean Android rollout.
+ *
+ * Keeps only structural product configuration plus the single `admin` account.
+ * Operational/business data is removed. Recovery is intentionally performed
+ * from the deploy PRE backup, not through a synthetic down migration.
+ */
+export class ResetProductionOperationalData1788652800000 implements MigrationInterface {
+  name = 'ResetProductionOperationalData1788652800000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const adminRows: Array<{ id: string; username: string }> = await queryRunner.query(`
+      SELECT id, username
+      FROM users
+      WHERE lower(trim(username)) = 'admin'
+      ORDER BY id
+    `);
+
+    if (adminRows.length !== 1) {
+      throw new Error(
+        `Production reset aborted: expected exactly one username admin, found ${adminRows.length}`,
+      );
+    }
+
+    const adminId = adminRows[0].id;
+
+    const structuralTables = [
+      'roles',
+      'permissions',
+      'role_permissions',
+      'asset_types',
+      'asset_attribute_definitions',
+      'asset_type_parent_rules',
+      'finding_categories',
+      'finding_catalog_items',
+      'finding_catalog_item_asset_types',
+      'finding_catalog_asset_type_profiles',
+    ];
+
+    // Snapshot structural row counts so TRUNCATE ... CASCADE can never silently
+    // remove product configuration while still leaving operational tables empty.
+    const structuralCounts = new Map<string, string>();
+    for (const table of structuralTables) {
+      const safeTable = `"${table.replace(/"/g, '""')}"`;
+      const rows: Array<{ total: string }> = await queryRunner.query(
+        `SELECT count(*)::text AS total FROM ${safeTable}`,
+      );
+      structuralCounts.set(table, rows[0]?.total ?? '0');
+    }
+
+    const adminRolesBefore: Array<{ total: string }> = await queryRunner.query(
+      `SELECT count(*)::text AS total FROM user_roles WHERE user_id = $1`,
+      [adminId],
+    );
+    const adminRoleCount = adminRolesBefore[0]?.total ?? '0';
+    if (adminRoleCount === '0') {
+      throw new Error('Production reset aborted: admin has no assigned role');
+    }
+
+    // Product configuration that must survive a clean operational start.
+    const preservedTables = new Set([
+      'typeorm_migrations',
+      'users',
+      'user_roles',
+      ...structuralTables,
+    ]);
+
+    const tableRows: Array<{ table_name: string }> = await queryRunner.query(`
+      SELECT table_name
+      FROM information_schema.tables
+      WHERE table_schema = 'public'
+        AND table_type = 'BASE TABLE'
+      ORDER BY table_name
+    `);
+
+    const operationalTables = tableRows
+      .map((row) => row.table_name)
+      .filter((table) => !preservedTables.has(table));
+
+    if (operationalTables.length > 0) {
+      const quoted = operationalTables
+        .map((table) => `"${table.replace(/"/g, '""')}"`)
+        .join(', ');
+      await queryRunner.query(`TRUNCATE TABLE ${quoted} RESTART IDENTITY CASCADE`);
+    }
+
+    // Remove every user except the explicitly validated administrator.
+    // user_roles for removed users follow their FK cascade.
+    await queryRunner.query(`DELETE FROM users WHERE id <> $1`, [adminId]);
+
+    // A reset must invalidate every prior login token, including admin's.
+    // auth_sessions is operational and was truncated above; admin simply logs in again.
+    await queryRunner.query(
+      `
+      UPDATE users
+      SET failed_login_attempts = 0,
+          locked_until = NULL,
+          last_login_at = NULL,
+          updated_at = CURRENT_TIMESTAMP
+      WHERE id = $1
+    `,
+      [adminId],
+    );
+
+    const finalUsers: Array<{ total: string; admins: string }> = await queryRunner.query(`
+      SELECT
+        count(*)::text AS total,
+        count(*) FILTER (WHERE lower(trim(username)) = 'admin')::text AS admins
+      FROM users
+    `);
+
+    if (finalUsers[0]?.total !== '1' || finalUsers[0]?.admins !== '1') {
+      throw new Error('Production reset verification failed: users table is not admin-only');
+    }
+
+    const finalAdminRoles: Array<{ total: string; foreign_users: string }> = await queryRunner.query(
+      `
+      SELECT
+        count(*) FILTER (WHERE user_id = $1)::text AS total,
+        count(*) FILTER (WHERE user_id <> $1)::text AS foreign_users
+      FROM user_roles
+    `,
+      [adminId],
+    );
+
+    if (
+      finalAdminRoles[0]?.total !== adminRoleCount ||
+      finalAdminRoles[0]?.foreign_users !== '0'
+    ) {
+      throw new Error('Production reset verification failed: admin role assignments changed');
+    }
+
+    // Assert every structural table kept exactly the same number of rows.
+    for (const table of structuralTables) {
+      const safeTable = `"${table.replace(/"/g, '""')}"`;
+      const rows: Array<{ total: string }> = await queryRunner.query(
+        `SELECT count(*)::text AS total FROM ${safeTable}`,
+      );
+      const before = structuralCounts.get(table) ?? '0';
+      if (rows[0]?.total !== before) {
+        throw new Error(
+          `Production reset verification failed: structural table ${table} changed (${before} -> ${rows[0]?.total ?? 'unknown'})`,
+        );
+      }
+    }
+
+    // Assert that every operational table is empty. This makes the migration
+    // fail atomically if a table was repopulated during the reset transaction.
+    for (const table of operationalTables) {
+      const safeTable = `"${table.replace(/"/g, '""')}"`;
+      const rows: Array<{ total: string }> = await queryRunner.query(
+        `SELECT count(*)::text AS total FROM ${safeTable}`,
+      );
+      if (rows[0]?.total !== '0') {
+        throw new Error(`Production reset verification failed: ${table} is not empty`);
+      }
+    }
+
+    // Keep a concise server-side record in the migration log for deploy diagnostics.
+    // eslint-disable-next-line no-console
+    console.log(
+      `[production-reset] kept admin=${adminRows[0].username} (${adminId}); preserved ${structuralTables.length} structural tables; cleared ${operationalTables.length} operational tables`,
+    );
+  }
+
+  public async down(): Promise<void> {
+    throw new Error(
+      'ResetProductionOperationalData is irreversible by migration; restore the deploy PRE database backup instead.',
+    );
+  }
+}

api-v3/src/database/migrations/1789495200000-phase-f1-1-multi-act-inspections.ts

@@ -0,0 +1,108 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF11MultiActInspections1789495200000 implements MigrationInterface {
+  name = 'PhaseF11MultiActInspections1789495200000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE inspection_acts
+      DROP CONSTRAINT IF EXISTS uq_inspection_acts_visit
+    `);
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX uq_inspection_acts_one_draft_per_visit
+      ON inspection_acts (visit_id)
+      WHERE status = 'DRAFT'
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE inspection_reports
+      DROP CONSTRAINT IF EXISTS uq_inspection_reports_visit
+    `);
+    await queryRunner.query(`
+      CREATE INDEX idx_inspection_reports_visit_id
+      ON inspection_reports (visit_id)
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE inspection_act_signatures
+        ADD COLUMN company_manifestation varchar(20),
+        ADD COLUMN company_statement text
+    `);
+    await queryRunner.query(`
+      UPDATE inspection_act_signatures
+      SET company_manifestation = 'CONFORMITY'
+      WHERE signer_type = 'COMPANY_RESPONSIBLE'
+        AND status = 'SIGNED'
+    `);
+    await queryRunner.query(`
+      ALTER TABLE inspection_act_signatures
+      ADD CONSTRAINT chk_inspection_act_signatures_company_manifestation CHECK (
+        (
+          signer_type = 'COMPANY_RESPONSIBLE'
+          AND status = 'SIGNED'
+          AND company_manifestation IN ('CONFORMITY', 'DISSENT')
+          AND (
+            (company_manifestation = 'CONFORMITY' AND company_statement IS NULL)
+            OR
+            (company_manifestation = 'DISSENT' AND LENGTH(TRIM(COALESCE(company_statement, ''))) >= 10)
+          )
+        )
+        OR
+        (
+          NOT (signer_type = 'COMPANY_RESPONSIBLE' AND status = 'SIGNED')
+          AND company_manifestation IS NULL
+          AND company_statement IS NULL
+        )
+      )
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DO $$
+      BEGIN
+        IF EXISTS (
+          SELECT visit_id FROM inspection_acts
+          GROUP BY visit_id HAVING COUNT(*) > 1
+        ) THEN
+          RAISE EXCEPTION 'F1.1 no puede revertirse: existen inspecciones con múltiples actas';
+        END IF;
+        IF EXISTS (
+          SELECT visit_id FROM inspection_reports
+          GROUP BY visit_id HAVING COUNT(*) > 1
+        ) THEN
+          RAISE EXCEPTION 'F1.1 no puede revertirse: existen inspecciones con múltiples informes';
+        END IF;
+        IF EXISTS (
+          SELECT 1 FROM inspection_act_signatures
+          WHERE company_manifestation = 'DISSENT'
+        ) THEN
+          RAISE EXCEPTION 'F1.1 no puede revertirse: existen firmas en disidencia';
+        END IF;
+      END
+      $$
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE inspection_act_signatures
+      DROP CONSTRAINT chk_inspection_act_signatures_company_manifestation
+    `);
+    await queryRunner.query(`
+      ALTER TABLE inspection_act_signatures
+        DROP COLUMN company_statement,
+        DROP COLUMN company_manifestation
+    `);
+
+    await queryRunner.query(`DROP INDEX idx_inspection_reports_visit_id`);
+    await queryRunner.query(`
+      ALTER TABLE inspection_reports
+      ADD CONSTRAINT uq_inspection_reports_visit UNIQUE (visit_id)
+    `);
+
+    await queryRunner.query(`DROP INDEX uq_inspection_acts_one_draft_per_visit`);
+    await queryRunner.query(`
+      ALTER TABLE inspection_acts
+      ADD CONSTRAINT uq_inspection_acts_visit UNIQUE (visit_id)
+    `);
+  }
+}

api-v3/src/database/migrations/1789581600000-phase-f1-2-act-administration.ts

@@ -0,0 +1,39 @@
+
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF12ActAdministration1789581600000 implements MigrationInterface {
+  name = 'PhaseF12ActAdministration1789581600000';
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`CREATE TABLE inspection_act_deadline_events (
+      id uuid PRIMARY KEY, act_id uuid NOT NULL REFERENCES inspection_acts(id) ON DELETE RESTRICT,
+      response_due_on date NOT NULL, reason text NOT NULL, created_by uuid NULL REFERENCES users(id) ON DELETE SET NULL,
+      created_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )`);
+    await queryRunner.query(`CREATE INDEX idx_act_deadline_events_act_created ON inspection_act_deadline_events (act_id, created_at DESC)`);
+    await queryRunner.query(`CREATE INDEX idx_act_deadline_events_due ON inspection_act_deadline_events (response_due_on)`);
+    await queryRunner.query(`CREATE TABLE inspection_act_company_responses (
+      id uuid PRIMARY KEY, act_id uuid NOT NULL REFERENCES inspection_acts(id) ON DELETE RESTRICT,
+      received_on date NOT NULL, details text NULL, committed_correction_on date NULL,
+      contact_name varchar(200) NULL, contact_email varchar(320) NULL,
+      original_name varchar(255) NULL, stored_name varchar(100) NULL, mime_type varchar(120) NULL,
+      size_bytes bigint NULL, sha256 char(64) NULL, created_by uuid NULL REFERENCES users(id) ON DELETE SET NULL,
+      created_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      CONSTRAINT chk_act_company_response_file CHECK ((stored_name IS NULL AND original_name IS NULL AND mime_type IS NULL AND size_bytes IS NULL AND sha256 IS NULL) OR (stored_name IS NOT NULL AND original_name IS NOT NULL AND mime_type = 'application/pdf' AND size_bytes > 0 AND sha256 IS NOT NULL))
+    )`);
+    await queryRunner.query(`CREATE INDEX idx_act_company_responses_act_received ON inspection_act_company_responses (act_id, received_on DESC, created_at DESC)`);
+    await queryRunner.query(`CREATE INDEX idx_act_company_responses_commitment ON inspection_act_company_responses (committed_correction_on)`);
+    await queryRunner.query(`INSERT INTO inspection_act_deadline_events (id, act_id, response_due_on, reason, created_by, created_at)
+      SELECT gen_random_uuid(), act_id, MIN(correction_due_on), 'Migrado desde plazo histórico coincidente de hallazgos', NULL, CURRENT_TIMESTAMP
+      FROM inspection_findings WHERE correction_due_on IS NOT NULL GROUP BY act_id HAVING COUNT(DISTINCT correction_due_on) = 1`);
+    await queryRunner.query(`CREATE OR REPLACE FUNCTION prevent_f12_append_only_mutation() RETURNS trigger AS $$ BEGIN RAISE EXCEPTION 'F1.2 append-only: update/delete no permitido'; END; $$ LANGUAGE plpgsql`);
+    await queryRunner.query(`CREATE TRIGGER trg_act_deadline_events_append_only BEFORE UPDATE OR DELETE ON inspection_act_deadline_events FOR EACH ROW EXECUTE FUNCTION prevent_f12_append_only_mutation()`);
+    await queryRunner.query(`CREATE TRIGGER trg_act_company_responses_append_only BEFORE UPDATE OR DELETE ON inspection_act_company_responses FOR EACH ROW EXECUTE FUNCTION prevent_f12_append_only_mutation()`);
+  }
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TRIGGER IF EXISTS trg_act_company_responses_append_only ON inspection_act_company_responses`);
+    await queryRunner.query(`DROP TRIGGER IF EXISTS trg_act_deadline_events_append_only ON inspection_act_deadline_events`);
+    await queryRunner.query(`DROP FUNCTION IF EXISTS prevent_f12_append_only_mutation()`);
+    await queryRunner.query(`DROP TABLE inspection_act_company_responses`);
+    await queryRunner.query(`DROP TABLE inspection_act_deadline_events`);
+  }
+}

api-v3/src/database/migrations/1789668000000-phase-f2-1-field-inventory.ts

@@ -0,0 +1,197 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+function quoteIdentifier(identifier: string): string {
+  return `"${identifier.replaceAll('"', '""')}"`;
+}
+
+export class PhaseF21FieldInventory1789668000000 implements MigrationInterface {
+  name = 'PhaseF21FieldInventory1789668000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE field_inventory_code_sequences (
+        year integer PRIMARY KEY,
+        last_value integer NOT NULL DEFAULT 0,
+        CONSTRAINT chk_field_inventory_code_sequences_year CHECK (year BETWEEN 2000 AND 9999),
+        CONSTRAINT chk_field_inventory_code_sequences_value CHECK (last_value >= 0)
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE TABLE asset_field_capture_events (
+        id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+        visit_id uuid NOT NULL,
+        asset_id uuid NOT NULL,
+        media_id uuid,
+        event_type varchar(24) NOT NULL,
+        device_latitude numeric(9, 6) NOT NULL,
+        device_longitude numeric(9, 6) NOT NULL,
+        device_accuracy_m numeric(12, 3),
+        device_captured_at timestamptz NOT NULL,
+        device_label varchar(255),
+        exif_latitude numeric(9, 6),
+        exif_longitude numeric(9, 6),
+        exif_captured_at timestamptz,
+        created_by uuid NOT NULL,
+        created_at timestamptz NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        CONSTRAINT fk_asset_field_capture_visit FOREIGN KEY (visit_id)
+          REFERENCES inspection_visits(id) ON DELETE RESTRICT,
+        CONSTRAINT fk_asset_field_capture_asset FOREIGN KEY (asset_id)
+          REFERENCES assets(id) ON DELETE RESTRICT,
+        CONSTRAINT fk_asset_field_capture_media FOREIGN KEY (media_id)
+          REFERENCES asset_media(id) ON DELETE RESTRICT,
+        CONSTRAINT fk_asset_field_capture_created_by FOREIGN KEY (created_by)
+          REFERENCES users(id) ON DELETE RESTRICT,
+        CONSTRAINT chk_asset_field_capture_event_type CHECK (event_type IN ('CREATED','PHOTO')),
+        CONSTRAINT chk_asset_field_capture_device_coordinates CHECK (
+          device_latitude BETWEEN -90 AND 90
+          AND device_longitude BETWEEN -180 AND 180
+        ),
+        CONSTRAINT chk_asset_field_capture_accuracy CHECK (
+          device_accuracy_m IS NULL OR device_accuracy_m BETWEEN 0 AND 100000
+        ),
+        CONSTRAINT chk_asset_field_capture_exif_coordinates CHECK (
+          (exif_latitude IS NULL AND exif_longitude IS NULL)
+          OR (
+            exif_latitude IS NOT NULL
+            AND exif_longitude IS NOT NULL
+            AND exif_latitude BETWEEN -90 AND 90
+            AND exif_longitude BETWEEN -180 AND 180
+          )
+        ),
+        CONSTRAINT chk_asset_field_capture_media_event CHECK (
+          (event_type = 'CREATED' AND media_id IS NULL)
+          OR (event_type = 'PHOTO' AND media_id IS NOT NULL)
+        )
+      )
+    `);
+    await queryRunner.query(`CREATE INDEX idx_asset_field_capture_visit ON asset_field_capture_events (visit_id, created_at, id)`);
+    await queryRunner.query(`CREATE INDEX idx_asset_field_capture_asset ON asset_field_capture_events (asset_id, created_at, id)`);
+    await queryRunner.query(`CREATE UNIQUE INDEX uq_asset_field_capture_media ON asset_field_capture_events (media_id) WHERE media_id IS NOT NULL`);
+
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_assets
+      DROP CONSTRAINT chk_inspection_visit_assets_planning_source
+    `);
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_assets
+      ADD CONSTRAINT chk_inspection_visit_assets_planning_source CHECK (
+        planning_source IN ('LEGACY','AUTOMATIC','PREVENTIVE','VERIFICATION','FIELD')
+      )
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_asset_events
+      DROP CONSTRAINT chk_inspection_visit_asset_events_type
+    `);
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_asset_events
+      ADD CONSTRAINT chk_inspection_visit_asset_events_type CHECK (
+        event_type IN ('LEGACY_INCLUDED','AUTO_INCLUDED','PREVENTIVE_INCLUDED','VERIFICATION_INCLUDED','FIELD_INCLUDED','EXCLUDED','REINCLUDED')
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE OR REPLACE FUNCTION enforce_field_inventory_capture_before_finding()
+      RETURNS trigger
+      LANGUAGE plpgsql
+      AS $$
+      DECLARE
+        finding_visit_id uuid;
+      BEGIN
+        SELECT act.visit_id INTO finding_visit_id
+        FROM inspection_acts act
+        WHERE act.id = NEW.act_id;
+
+        IF finding_visit_id IS NULL THEN
+          RETURN NEW;
+        END IF;
+
+        IF EXISTS (
+          SELECT 1
+          FROM asset_field_discoveries discovery
+          WHERE discovery.visit_id = finding_visit_id
+            AND discovery.asset_id = NEW.asset_id
+        ) THEN
+          IF NOT EXISTS (
+            SELECT 1
+            FROM asset_field_capture_events capture
+            WHERE capture.visit_id = finding_visit_id
+              AND capture.asset_id = NEW.asset_id
+              AND capture.event_type = 'CREATED'
+          ) THEN
+            RAISE EXCEPTION USING
+              ERRCODE = '23514',
+              MESSAGE = 'FIELD_INVENTORY_GPS_REQUIRED';
+          END IF;
+
+          IF NOT EXISTS (
+            SELECT 1
+            FROM asset_field_capture_events capture
+            WHERE capture.visit_id = finding_visit_id
+              AND capture.asset_id = NEW.asset_id
+              AND capture.event_type = 'PHOTO'
+          ) THEN
+            RAISE EXCEPTION USING
+              ERRCODE = '23514',
+              MESSAGE = 'FIELD_INVENTORY_PHOTO_REQUIRED';
+          END IF;
+        END IF;
+
+        RETURN NEW;
+      END
+      $$
+    `);
+    await queryRunner.query(`
+      CREATE TRIGGER trg_inspection_findings_field_capture
+      BEFORE INSERT OR UPDATE OF act_id, asset_id ON inspection_findings
+      FOR EACH ROW
+      EXECUTE FUNCTION enforce_field_inventory_capture_before_finding()
+    `);
+
+    const appRole = process.env.DB_APP_USER;
+    if (!appRole) throw new Error('Missing required environment variable: DB_APP_USER');
+    const applicationRole = quoteIdentifier(appRole);
+    await queryRunner.query(`GRANT SELECT, INSERT, UPDATE ON TABLE field_inventory_code_sequences TO ${applicationRole}`);
+    await queryRunner.query(`GRANT SELECT, INSERT ON TABLE asset_field_capture_events TO ${applicationRole}`);
+    await queryRunner.query(`REVOKE UPDATE, DELETE ON TABLE asset_field_capture_events FROM ${applicationRole}`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DO $$
+      BEGIN
+        IF EXISTS (SELECT 1 FROM asset_field_capture_events LIMIT 1) THEN
+          RAISE EXCEPTION 'F2.1 no puede revertirse: existen capturas GPS/EXIF de campo';
+        END IF;
+        IF EXISTS (SELECT 1 FROM inspection_visit_assets WHERE planning_source = 'FIELD' LIMIT 1) THEN
+          RAISE EXCEPTION 'F2.1 no puede revertirse: existen registros seleccionados o creados en campo';
+        END IF;
+        IF EXISTS (SELECT 1 FROM inspection_visit_asset_events WHERE event_type = 'FIELD_INCLUDED' LIMIT 1) THEN
+          RAISE EXCEPTION 'F2.1 no puede revertirse: existen eventos de Inventario de campo';
+        END IF;
+      END
+      $$
+    `);
+
+    await queryRunner.query(`DROP TRIGGER IF EXISTS trg_inspection_findings_field_capture ON inspection_findings`);
+    await queryRunner.query(`DROP FUNCTION IF EXISTS enforce_field_inventory_capture_before_finding()`);
+
+    await queryRunner.query(`ALTER TABLE inspection_visit_asset_events DROP CONSTRAINT chk_inspection_visit_asset_events_type`);
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_asset_events
+      ADD CONSTRAINT chk_inspection_visit_asset_events_type CHECK (
+        event_type IN ('LEGACY_INCLUDED','AUTO_INCLUDED','PREVENTIVE_INCLUDED','VERIFICATION_INCLUDED','EXCLUDED','REINCLUDED')
+      )
+    `);
+    await queryRunner.query(`ALTER TABLE inspection_visit_assets DROP CONSTRAINT chk_inspection_visit_assets_planning_source`);
+    await queryRunner.query(`
+      ALTER TABLE inspection_visit_assets
+      ADD CONSTRAINT chk_inspection_visit_assets_planning_source CHECK (
+        planning_source IN ('LEGACY','AUTOMATIC','PREVENTIVE','VERIFICATION')
+      )
+    `);
+    await queryRunner.query(`DROP TABLE asset_field_capture_events`);
+    await queryRunner.query(`DROP TABLE field_inventory_code_sequences`);
+  }
+}

api-v3/src/database/migrations/1789754300000-phase-f2-2-1-base-operational-types.ts

@@ -0,0 +1,50 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221BaseOperationalTypes1789754300000 implements MigrationInterface {
+  name = 'PhaseF221BaseOperationalTypes1789754300000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      UPDATE asset_types
+      SET operational_role='AREA', can_be_root=true, is_active=true, updated_at=CURRENT_TIMESTAMP
+      WHERE lower(code)='area'
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'area','Área',
+        'Área hidrocarburífera administrada como ancla territorial.',
+        true,true,'AREA'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE operational_role='AREA')
+        AND NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='area')
+    `);
+
+    await queryRunner.query(`
+      UPDATE asset_types
+      SET operational_role='COMPANY', can_be_root=true, is_active=true, updated_at=CURRENT_TIMESTAMP
+      WHERE lower(code) IN ('empresa','organizacion')
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'empresa','Organización',
+        'Entidad jurídica u organización administrada. Su rol operativo se registra mediante relaciones históricas.',
+        true,true,'COMPANY'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE operational_role='COMPANY')
+        AND NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='empresa')
+    `);
+
+    const rows = (await queryRunner.query(`
+      SELECT
+        count(*) FILTER (WHERE operational_role='AREA')::text AS areas,
+        count(*) FILTER (WHERE operational_role='COMPANY')::text AS companies
+      FROM asset_types
+    `)) as Array<{ areas: string; companies: string }>;
+
+    if (Number(rows[0]?.areas ?? 0) < 1 || Number(rows[0]?.companies ?? 0) < 1) {
+      throw new Error('F2.2.1 could not guarantee AREA and COMPANY asset types');
+    }
+  }
+
+  public async down(): Promise<void> {
+    throw new Error('F2.2.1 base operational types are structural and are not removed automatically');
+  }
+}

api-v3/src/database/migrations/1789754350000-phase-f2-2-1-long-reference-labels.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221LongReferenceLabels1789754350000 implements MigrationInterface {
+  name = 'PhaseF221LongReferenceLabels1789754350000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // La matriz APLICACION APP contiene denominaciones técnicas descriptivas que
+    // legítimamente superan el límite histórico de 160 caracteres. No se recorta
+    // información de la fuente: ampliamos sólo columnas descriptivas.
+    await queryRunner.query(`ALTER TABLE asset_types ALTER COLUMN name TYPE varchar(500)`);
+    await queryRunner.query(`ALTER TABLE asset_attribute_definitions ALTER COLUMN name TYPE varchar(500)`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const rows = (await queryRunner.query(`
+      SELECT
+        coalesce(max(length(name)),0)::integer AS max_type_name,
+        (SELECT coalesce(max(length(name)),0)::integer FROM asset_attribute_definitions) AS max_attribute_name
+      FROM asset_types
+    `)) as Array<{ max_type_name: number; max_attribute_name: number }>;
+
+    if ((rows[0]?.max_type_name ?? 0) > 160 || (rows[0]?.max_attribute_name ?? 0) > 160) {
+      throw new Error('F2.2.1 no puede reducir etiquetas a 160 caracteres sin pérdida de información');
+    }
+    await queryRunner.query(`ALTER TABLE asset_types ALTER COLUMN name TYPE varchar(160)`);
+    await queryRunner.query(`ALTER TABLE asset_attribute_definitions ALTER COLUMN name TYPE varchar(160)`);
+  }
+}

api-v3/src/database/migrations/1789754400000-phase-f2-2-1-reference-excel-data.ts

@@ -0,0 +1,615 @@
+import { createHash } from 'node:crypto';
+import { MigrationInterface, QueryRunner } from 'typeorm';
+import { loadF221ExcelSource } from '../../reference-data/f2-2-1-excel-source';
+
+function slug(value: string, max = 70): string {
+  const normalized = value
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '');
+  return (normalized || 'item').slice(0, max);
+}
+
+function stableCode(prefix: string, ...parts: string[]): string {
+  const hash = createHash('sha1').update(parts.join('|')).digest('hex').slice(0, 8).toUpperCase();
+  const readable = slug(parts[0] ?? 'item', 72).toUpperCase();
+  return `${prefix}-${readable}-${hash}`.slice(0, 120);
+}
+
+function legalRightType(value: string): string {
+  const normalized = slug(value);
+  if (normalized.includes('explot')) return 'EXPLOITATION_CONCESSION';
+  if (normalized.includes('explor')) return 'EXPLORATION_PERMIT';
+  if (normalized.includes('transport')) return 'TRANSPORT_CONCESSION';
+  return 'OTHER';
+}
+
+const groupTargets: Record<string, string[]> = {
+  tanques: ['tanque'],
+  separadores: ['separador'],
+  bomba_zona_de_bombas: ['bomba'],
+  calderas: ['caldera'],
+  drenaje: ['drenaje'],
+  antorcha: ['antorcha'],
+  colectores: ['colector'],
+  sist_electrico_iluminacion: ['sistema_electrico_iluminacion'],
+  defensa_contra_incendios: ['defensa_contra_incendios'],
+  cargadero_y_descargadero_de_camiones: ['cargadero_descargadero'],
+  filtros: ['filtro'],
+  eq_flotacion: ['equipo_flotacion'],
+  baterias_y_plantas: ['bateria', 'planta'],
+  fwko_tratadores_calentadores: ['fwo', 'fwko', 'calentador', 'tratador_termico'],
+  bombeo_mecanico: ['bombeo_mecanico'],
+  bombeo_electreosumergible: ['bombeo_electreosumergible'],
+  bombeo_cavidad_progresiva_pcp: ['bombeo_cavidad_progresiva_pcp'],
+  pozos_surgentes_prod_gas: ['pozos_surgentes_prod_gas'],
+  pozos_inyectores_agua: ['pozos_inyectores_agua'],
+};
+
+const referenceAliases: Record<string, string> = {
+  tanque: 'tanque',
+  tanques: 'tanque',
+  separador: 'separador',
+  separadores: 'separador',
+  bombas: 'bomba',
+  bomba: 'bomba',
+  fwo: 'fwo',
+  fwko: 'fwko',
+  calentador: 'calentador',
+  piletas: 'drenaje',
+  pileta: 'drenaje',
+  cargadero_descargadero: 'cargadero_descargadero',
+  generador: 'generador',
+};
+
+type IdRow = { id: string };
+type CountRow = { total: string };
+
+async function assetIdByCode(queryRunner: QueryRunner, code: string): Promise<string | null> {
+  const rows = (await queryRunner.query(
+    `SELECT id FROM assets WHERE lower(code)=lower($1::text) LIMIT 1`,
+    [code],
+  )) as IdRow[];
+  return rows[0]?.id ?? null;
+}
+
+async function assetTypeIdByCode(queryRunner: QueryRunner, code: string): Promise<string | null> {
+  const rows = (await queryRunner.query(
+    `SELECT id FROM asset_types WHERE lower(code)=lower($1::text) LIMIT 1`,
+    [code],
+  )) as IdRow[];
+  return rows[0]?.id ?? null;
+}
+
+export class PhaseF221ReferenceExcelData1789754400000 implements MigrationInterface {
+  name = 'PhaseF221ReferenceExcelData1789754400000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const source = loadF221ExcelSource();
+
+    await queryRunner.query(`
+      INSERT INTO source_documents (document_type,document_number,title,issuer,notes)
+      SELECT 'SPREADSHEET','DH-F221-TERRITORIO','Tablas de yacimiento(1).xlsx','Dirección de Hidrocarburos',
+        'Fuente F2.2.1: maestro territorial y operativo. Hoja normalizada cr26e_tabla1.'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM source_documents
+        WHERE document_number='DH-F221-TERRITORIO' AND issuer='Dirección de Hidrocarburos'
+      )
+    `);
+    await queryRunner.query(`
+      INSERT INTO source_documents (document_type,document_number,title,issuer,notes)
+      SELECT 'SPREADSHEET','DH-F221-APP','APLICACION APP(1).xlsx','Dirección de Hidrocarburos',
+        'Fuente F2.2.1: matriz de jerarquía, información y catálogo contextual de hallazgos. Hojas Hoja1 y Hoja2.'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM source_documents
+        WHERE document_number='DH-F221-APP' AND issuer='Dirección de Hidrocarburos'
+      )
+    `);
+
+    const territoryDocuments = (await queryRunner.query(
+      `SELECT id FROM source_documents
+       WHERE document_number='DH-F221-TERRITORIO' AND issuer='Dirección de Hidrocarburos' LIMIT 1`,
+    )) as IdRow[];
+    const appDocuments = (await queryRunner.query(
+      `SELECT id FROM source_documents
+       WHERE document_number='DH-F221-APP' AND issuer='Dirección de Hidrocarburos' LIMIT 1`,
+    )) as IdRow[];
+    const territoryDocumentId = territoryDocuments[0]?.id;
+    const appDocumentId = appDocuments[0]?.id;
+    if (!territoryDocumentId || !appDocumentId) {
+      throw new Error('F2.2.1 source documents could not be resolved');
+    }
+
+    await queryRunner.query(
+      `UPDATE asset_types SET can_be_root=true WHERE operational_role IN ('AREA','COMPANY')`,
+    );
+    await queryRunner.query(`
+      INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+      SELECT 'yacimiento','Yacimiento',
+        'Yacimiento físico/operativo perteneciente a un Área. Su operadora se determina por contexto histórico.',
+        false,true,'GENERIC'
+      WHERE NOT EXISTS (SELECT 1 FROM asset_types WHERE lower(code)='yacimiento')
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+      SELECT child.id,parent.id
+      FROM asset_types child CROSS JOIN asset_types parent
+      WHERE lower(child.code)='yacimiento' AND parent.operational_role='AREA'
+      ON CONFLICT DO NOTHING
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_attribute_definitions
+        (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+      SELECT type.id,definition.code,definition.name,'TEXT',false,true,definition.sort_order
+      FROM asset_types type
+      CROSS JOIN (VALUES
+        ('departamento_fuente','Departamento informado por la fuente',10),
+        ('tipo_concesion_fuente','Tipo de concesión informado por la fuente',20)
+      ) definition(code,name,sort_order)
+      WHERE lower(type.code)='yacimiento'
+      ON CONFLICT DO NOTHING
+    `);
+    await queryRunner.query(`
+      INSERT INTO asset_attribute_definitions
+        (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+      SELECT type.id,'tipo_concesion_fuente','Tipo de concesión informado por la fuente',
+        'TEXT',false,true,40
+      FROM asset_types type
+      WHERE type.operational_role='AREA'
+      ON CONFLICT DO NOTHING
+    `);
+
+    const areaCache = new Map<string, string>();
+    const companyCache = new Map<string, string>();
+    const seenRights = new Set<string>();
+
+    for (const row of source.territory) {
+      const areaKey = row.area.trim().toLocaleLowerCase('es');
+      let areaId = areaCache.get(areaKey) ?? null;
+      if (!areaId) {
+        const areaCode = stableCode('AREA', row.area);
+        areaId = await assetIdByCode(queryRunner, areaCode);
+        if (!areaId) {
+          const inserted = (await queryRunner.query(
+            `INSERT INTO assets (
+               asset_type_id,parent_id,code,name,description,information_status,operational_status,
+               data_origin,source_name,source_reference,source_notes,current_version
+             )
+             SELECT type.id,NULL,$1::varchar,$2::varchar,$3::text,
+               'VALIDATED','IN_SERVICE','IMPORT',$4::varchar,$5::varchar,$6::text,0
+             FROM asset_types type
+             WHERE type.operational_role='AREA'
+             LIMIT 1
+             RETURNING id`,
+            [
+              areaCode,
+              row.area,
+              `Área importada desde Tablas de yacimiento. Departamento: ${row.department}.`,
+              'Tablas de yacimiento(1).xlsx',
+              `cr26e_tabla1|AREA|${row.area}`,
+              `Departamento=${row.department}; TipoConcesion=${row.concessionType}`,
+            ],
+          )) as IdRow[];
+          areaId = inserted[0]?.id ?? null;
+        }
+        if (!areaId) throw new Error(`Could not resolve area ${row.area}`);
+        areaCache.set(areaKey, areaId);
+
+        await queryRunner.query(
+          `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+           VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+           ON CONFLICT DO NOTHING`,
+          [areaId, territoryDocumentId],
+        );
+      }
+
+      for (const [definitionCode, value] of [
+        ['departamento', row.department],
+        ['tipo_concesion_fuente', row.concessionType],
+      ] as const) {
+        await queryRunner.query(
+          `INSERT INTO asset_attribute_values (asset_id,definition_id,value)
+           SELECT $1::uuid,definition.id,to_jsonb($3::text)
+           FROM asset_attribute_definitions definition
+           JOIN asset_types type ON type.id=definition.asset_type_id
+           WHERE type.operational_role='AREA'
+             AND lower(definition.code)=lower($2::text)
+           ON CONFLICT (asset_id,definition_id)
+           DO UPDATE SET value=EXCLUDED.value,updated_at=CURRENT_TIMESTAMP`,
+          [areaId, definitionCode, value],
+        );
+      }
+
+      const noOperator = slug(row.operator) === 'sin_empresa_operadora';
+      let companyId: string | null = null;
+      if (!noOperator) {
+        const companyKey = row.operator.trim().toLocaleLowerCase('es');
+        companyId = companyCache.get(companyKey) ?? null;
+        if (!companyId) {
+          const companyCode = stableCode('ORG', row.operator);
+          companyId = await assetIdByCode(queryRunner, companyCode);
+          if (!companyId) {
+            const inserted = (await queryRunner.query(
+              `INSERT INTO assets (
+                 asset_type_id,parent_id,code,name,description,information_status,operational_status,
+                 data_origin,source_name,source_reference,source_notes,current_version
+               )
+               SELECT type.id,NULL,$1::varchar,$2::varchar,
+                 'Organización operadora importada desde Tablas de yacimiento.',
+                 'VALIDATED','IN_SERVICE','IMPORT',$3::varchar,$4::varchar,
+                 'Empresa/Operadora informada por la fuente',0
+               FROM asset_types type
+               WHERE type.operational_role='COMPANY'
+               LIMIT 1
+               RETURNING id`,
+              [
+                companyCode,
+                row.operator,
+                'Tablas de yacimiento(1).xlsx',
+                `cr26e_tabla1|OPERADORA|${row.operator}`,
+              ],
+            )) as IdRow[];
+            companyId = inserted[0]?.id ?? null;
+          }
+          if (!companyId) throw new Error(`Could not resolve operator ${row.operator}`);
+          companyCache.set(companyKey, companyId);
+
+          await queryRunner.query(
+            `INSERT INTO organization_profiles (asset_id,organization_kind,legal_name)
+             SELECT $1::uuid,
+               CASE WHEN lower($2::text) LIKE 'ute %' OR lower($2::text) LIKE 'ute(%'
+                 THEN 'UTE'::organization_kind ELSE 'COMPANY'::organization_kind END,
+               $2::varchar
+             WHERE NOT EXISTS (SELECT 1 FROM organization_profiles WHERE asset_id=$1::uuid)`,
+            [companyId, row.operator],
+          );
+          await queryRunner.query(
+            `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+             VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+             ON CONFLICT DO NOTHING`,
+            [companyId, territoryDocumentId],
+          );
+        }
+
+        await queryRunner.query(
+          `INSERT INTO area_company_relations
+             (area_id,company_id,relation_role,valid_from,start_reason,source_document_id)
+           SELECT $1::uuid,$2::uuid,'OPERATOR',CURRENT_TIMESTAMP,
+             'Importado desde Tablas de yacimiento(1).xlsx',$3::uuid
+           WHERE NOT EXISTS (
+             SELECT 1 FROM area_company_relations
+             WHERE area_id=$1::uuid AND company_id=$2::uuid
+               AND relation_role='OPERATOR' AND valid_until IS NULL
+           )`,
+          [areaId, companyId, territoryDocumentId],
+        );
+      }
+
+      const fieldCode = stableCode('YAC', row.field, row.area);
+      let fieldId = await assetIdByCode(queryRunner, fieldCode);
+      if (!fieldId) {
+        // The operational context is intentionally all-or-nothing. A source row
+        // that explicitly says "Sin Empresa Operadora" stays physically under
+        // its Área but receives no fabricated operator and no half context.
+        const operationalAreaId = companyId ? areaId : null;
+        const inserted = (await queryRunner.query(
+          `INSERT INTO assets (
+             asset_type_id,parent_id,operational_area_id,operator_company_id,code,name,description,
+             information_status,operational_status,data_origin,source_name,source_reference,
+             source_notes,current_version
+           )
+           SELECT type.id,$1::uuid,$2::uuid,$3::uuid,$4::varchar,$5::varchar,$6::text,
+             'VALIDATED','IN_SERVICE','IMPORT',$7::varchar,$8::varchar,$9::text,0
+           FROM asset_types type
+           WHERE lower(type.code)='yacimiento'
+           LIMIT 1
+           RETURNING id`,
+          [
+            areaId,
+            operationalAreaId,
+            companyId,
+            fieldCode,
+            row.field,
+            `Yacimiento del Área ${row.area}.`,
+            'Tablas de yacimiento(1).xlsx',
+            `cr26e_tabla1|YACIMIENTO|${row.field}|AREA|${row.area}`,
+            `Departamento=${row.department}; TipoConcesion=${row.concessionType}; OperadoraFuente=${row.operator}`,
+          ],
+        )) as IdRow[];
+        fieldId = inserted[0]?.id ?? null;
+      }
+      if (!fieldId) throw new Error(`Could not resolve field ${row.field} / ${row.area}`);
+
+      await queryRunner.query(
+        `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+         VALUES ($1::uuid,$2::uuid,'SOURCE','Importación F2.2.1 · cr26e_tabla1')
+         ON CONFLICT DO NOTHING`,
+        [fieldId, territoryDocumentId],
+      );
+      for (const [definitionCode, value] of [
+        ['departamento_fuente', row.department],
+        ['tipo_concesion_fuente', row.concessionType],
+      ] as const) {
+        await queryRunner.query(
+          `INSERT INTO asset_attribute_values (asset_id,definition_id,value)
+           SELECT $1::uuid,definition.id,to_jsonb($3::text)
+           FROM asset_attribute_definitions definition
+           JOIN asset_types type ON type.id=definition.asset_type_id
+           WHERE lower(type.code)='yacimiento'
+             AND lower(definition.code)=lower($2::text)
+           ON CONFLICT (asset_id,definition_id)
+           DO UPDATE SET value=EXCLUDED.value,updated_at=CURRENT_TIMESTAMP`,
+          [fieldId, definitionCode, value],
+        );
+      }
+
+      const rightName = `Tipo informado: ${row.concessionType}`;
+      const rightKey = `${areaId}|${slug(row.concessionType)}`;
+      if (!seenRights.has(rightKey)) {
+        seenRights.add(rightKey);
+        const existing = (await queryRunner.query(
+          `SELECT id FROM area_legal_rights
+           WHERE area_id=$1::uuid AND lower(name)=lower($2::text)
+             AND source_document_id=$3::uuid LIMIT 1`,
+          [areaId, rightName, territoryDocumentId],
+        )) as IdRow[];
+        if (!existing[0]?.id) {
+          await queryRunner.query(
+            `INSERT INTO area_legal_rights
+               (area_id,right_type,name,status,source_document_id,notes)
+             VALUES ($1::uuid,$2::area_legal_right_type,$3::varchar,'ACTIVE',$4::uuid,$5::text)`,
+            [
+              areaId,
+              legalRightType(row.concessionType),
+              rightName,
+              territoryDocumentId,
+              `Importado desde cr26e_tabla1. Departamento: ${row.department}.`,
+            ],
+          );
+        }
+      }
+    }
+
+    const topLevelTypes = new Set(source.types.map((entry) => entry.code));
+    for (const pair of source.parentPairs) topLevelTypes.delete(pair.child);
+
+    const allTypeDefinitions = new Map(source.types.map((entry) => [entry.code, entry.name]));
+    for (const targets of Object.values(groupTargets)) {
+      for (const target of targets) {
+        if (!allTypeDefinitions.has(target)) {
+          allTypeDefinitions.set(target, target.replaceAll('_', ' '));
+        }
+      }
+    }
+
+    for (const [typeCode, typeName] of allTypeDefinitions) {
+      if (!(await assetTypeIdByCode(queryRunner, typeCode))) {
+        await queryRunner.query(
+          `INSERT INTO asset_types (code,name,description,can_be_root,is_active,operational_role)
+           VALUES ($1::varchar,$2::varchar,
+             'Tipo incorporado desde APLICACION APP(1).xlsx · F2.2.1',false,true,'GENERIC')`,
+          [typeCode, typeName],
+        );
+      }
+      await queryRunner.query(
+        `INSERT INTO finding_catalog_asset_type_profiles (asset_type_id,reason)
+         SELECT id,'Aplicabilidad inicial importada desde APLICACION APP(1).xlsx'
+         FROM asset_types WHERE lower(code)=lower($1::text)
+         ON CONFLICT (asset_type_id) DO NOTHING`,
+        [typeCode],
+      );
+    }
+
+    for (const typeCode of topLevelTypes) {
+      await queryRunner.query(
+        `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+         SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+         WHERE lower(child.code)=lower($1::text) AND lower(parent.code)='yacimiento'
+         ON CONFLICT DO NOTHING`,
+        [typeCode],
+      );
+    }
+    for (const pair of source.parentPairs) {
+      if (pair.child === pair.parent) continue;
+      await queryRunner.query(
+        `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+         SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+         WHERE lower(child.code)=lower($1::text) AND lower(parent.code)=lower($2::text)
+         ON CONFLICT DO NOTHING`,
+        [pair.child, pair.parent],
+      );
+    }
+    for (const targets of Object.values(groupTargets)) {
+      for (const typeCode of targets) {
+        await queryRunner.query(
+          `INSERT INTO asset_type_parent_rules (child_type_id,parent_type_id)
+           SELECT child.id,parent.id FROM asset_types child CROSS JOIN asset_types parent
+           WHERE lower(child.code)=lower($1::text) AND lower(parent.code)='yacimiento'
+           ON CONFLICT DO NOTHING`,
+          [typeCode],
+        );
+      }
+    }
+
+    for (const entry of source.attributes) {
+      let sortOrder = 100;
+      for (const label of entry.labels) {
+        const attributeCode = slug(label, 72);
+        const typeId = await assetTypeIdByCode(queryRunner, entry.type);
+        if (!typeId) continue;
+        const existing = (await queryRunner.query(
+          `SELECT id FROM asset_attribute_definitions
+           WHERE asset_type_id=$1::uuid AND lower(code)=lower($2::text) LIMIT 1`,
+          [typeId, attributeCode],
+        )) as IdRow[];
+        if (!existing[0]?.id) {
+          await queryRunner.query(
+            `INSERT INTO asset_attribute_definitions
+               (asset_type_id,code,name,data_type,is_required,is_active,sort_order)
+             VALUES ($1::uuid,$2::varchar,$3::varchar,'TEXT',false,true,$4::integer)`,
+            [typeId, attributeCode, label, sortOrder],
+          );
+        }
+        sortOrder += 10;
+      }
+    }
+
+    await queryRunner.query(`
+      INSERT INTO finding_categories (code,name,sort_order,is_active)
+      SELECT 'APP26','Aplicación APP 2026',260,true
+      WHERE NOT EXISTS (SELECT 1 FROM finding_categories WHERE lower(code)='app26')
+    `);
+    const categoryRows = (await queryRunner.query(
+      `SELECT id FROM finding_categories WHERE lower(code)='app26' LIMIT 1`,
+    )) as IdRow[];
+    const categoryId = categoryRows[0]?.id;
+    if (!categoryId) throw new Error('Could not resolve APP26 finding category');
+
+    const titlesByType = new Map<string, Set<string>>();
+    const addTitle = (typeCode: string, title: string): void => {
+      const cleanTitle = title.trim();
+      if (!cleanTitle || /^idem\b/i.test(cleanTitle)) return;
+      const set = titlesByType.get(typeCode) ?? new Set<string>();
+      set.add(cleanTitle);
+      titlesByType.set(typeCode, set);
+    };
+
+    for (const entry of source.directFindings) {
+      for (const title of entry.titles) addTitle(entry.type, title);
+    }
+    for (const group of source.groups) {
+      const targets = groupTargets[slug(group.name)] ?? [slug(group.name)];
+      for (const target of targets) {
+        for (const item of group.items) addTitle(target, item.title);
+      }
+    }
+    for (let pass = 0; pass < 3; pass += 1) {
+      for (const entry of source.idemRefs) {
+        for (const rawReference of entry.refs) {
+          const reference = referenceAliases[slug(rawReference)] ?? slug(rawReference);
+          for (const title of titlesByType.get(reference) ?? []) addTitle(entry.type, title);
+        }
+      }
+    }
+
+    const allTitles = [
+      ...new Set([...titlesByType.values()].flatMap((titles) => [...titles])),
+    ].sort((a, b) => a.localeCompare(b, 'es'));
+
+    const itemIdByTitle = new Map<string, string>();
+    let sourceNumber = 1;
+    for (const title of allTitles) {
+      const itemCode = `APP26-${createHash('sha1').update(title).digest('hex').slice(0, 12).toUpperCase()}`;
+      let itemRows = (await queryRunner.query(
+        `SELECT id FROM finding_catalog_items WHERE lower(code)=lower($1::text) LIMIT 1`,
+        [itemCode],
+      )) as IdRow[];
+      if (!itemRows[0]?.id) {
+        itemRows = (await queryRunner.query(
+          `INSERT INTO finding_catalog_items
+             (category_id,code,source_number,title,import_note,revision,is_active)
+           VALUES ($1::uuid,$2::varchar,$3::integer,$4::varchar,
+             'Importado desde APLICACION APP(1).xlsx · F2.2.1',1,true)
+           RETURNING id`,
+          [categoryId, itemCode, sourceNumber, title],
+        )) as IdRow[];
+      }
+      const itemId = itemRows[0]?.id;
+      if (itemId) {
+        itemIdByTitle.set(title, itemId);
+        await queryRunner.query(
+          `INSERT INTO finding_catalog_item_versions
+             (item_id,revision,snapshot,actor_username)
+           SELECT item.id,item.revision,
+             jsonb_build_object(
+               'id',item.id,'categoryId',category.id,'categoryCode',category.code,
+               'categoryName',category.name,'code',item.code,'sourceNumber',item.source_number,
+               'title',item.title,'legalBasis',item.legal_basis,'glossary',item.glossary,
+               'importNote',item.import_note,'revision',item.revision,'isActive',item.is_active
+             ),
+             'migration:F2.2.1'
+           FROM finding_catalog_items item
+           JOIN finding_categories category ON category.id=item.category_id
+           WHERE item.id=$1::uuid
+             AND NOT EXISTS (
+               SELECT 1 FROM finding_catalog_item_versions version
+               WHERE version.item_id=item.id AND version.revision=item.revision
+             )`,
+          [itemId],
+        );
+      }
+      sourceNumber += 1;
+    }
+
+    for (const [typeCode, titles] of titlesByType) {
+      const assetTypeId = await assetTypeIdByCode(queryRunner, typeCode);
+      if (!assetTypeId) continue;
+      for (const title of titles) {
+        const catalogItemId = itemIdByTitle.get(title);
+        if (!catalogItemId) continue;
+        await queryRunner.query(
+          `INSERT INTO finding_catalog_item_asset_types (catalog_item_id,asset_type_id)
+           VALUES ($1::uuid,$2::uuid) ON CONFLICT DO NOTHING`,
+          [catalogItemId, assetTypeId],
+        );
+      }
+    }
+
+    await queryRunner.query(
+      `INSERT INTO asset_source_documents (asset_id,document_id,relation_type,notes)
+       SELECT asset.id,$1::uuid,'MENTIONS',
+         'El tipo/hallazgo del elemento se definió con la matriz APLICACION APP(1).xlsx'
+       FROM assets asset
+       JOIN asset_types type ON type.id=asset.asset_type_id
+       WHERE lower(type.code)='yacimiento'
+       ON CONFLICT DO NOTHING`,
+      [appDocumentId],
+    );
+
+    const importedYacimientos = (await queryRunner.query(
+      `SELECT count(*)::text AS total
+       FROM assets asset JOIN asset_types type ON type.id=asset.asset_type_id
+       WHERE asset.data_origin='IMPORT'
+         AND asset.source_name='Tablas de yacimiento(1).xlsx'
+         AND lower(type.code)='yacimiento'`,
+    )) as CountRow[];
+    if (Number(importedYacimientos[0]?.total ?? 0) !== source.territory.length) {
+      throw new Error(
+        `F2.2.1 verification failed: expected ${source.territory.length} imported yacimientos, found ${importedYacimientos[0]?.total ?? '0'}`,
+      );
+    }
+
+    const importedCatalog = (await queryRunner.query(
+      `SELECT count(*)::text AS total
+       FROM finding_catalog_items item
+       JOIN finding_categories category ON category.id=item.category_id
+       WHERE lower(category.code)='app26'`,
+    )) as CountRow[];
+    if (Number(importedCatalog[0]?.total ?? 0) !== allTitles.length) {
+      throw new Error(
+        `F2.2.1 verification failed: expected ${allTitles.length} APP26 findings, found ${importedCatalog[0]?.total ?? '0'}`,
+      );
+    }
+
+    const halfContexts = (await queryRunner.query(
+      `SELECT count(*)::text AS total FROM assets
+       WHERE (operational_area_id IS NULL) <> (operator_company_id IS NULL)`,
+    )) as CountRow[];
+    if (Number(halfContexts[0]?.total ?? 0) !== 0) {
+      throw new Error('F2.2.1 verification failed: an imported asset has an incomplete operational context');
+    }
+
+    // eslint-disable-next-line no-console
+    console.log(
+      `[F2.2.1] imported territory=${source.territory.length}; yacimientos=${importedYacimientos[0]?.total}; catalog=${importedCatalog[0]?.total}; halfContexts=0`,
+    );
+  }
+
+  public async down(): Promise<void> {
+    throw new Error(
+      'F2.2.1 contiene maestros territoriales y catálogo de referencia; no se revierte destructivamente. Restaurar backup PRE si fuera necesario.',
+    );
+  }
+}

api-v3/src/database/migrations/1789758000000-phase-f2-2-1-reference-baselines.ts

@@ -0,0 +1,57 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class PhaseF221ReferenceBaselines1789758000000 implements MigrationInterface {
+  name = 'PhaseF221ReferenceBaselines1789758000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO asset_versions (
+        asset_id,version_number,change_type,changed_fields,snapshot,source
+      )
+      SELECT
+        asset.id,
+        1,
+        'BASELINE',
+        ARRAY['assetTypeId','parentId','operationalAreaId','operatorCompanyId','code','name','informationStatus','operationalStatus','dataOrigin','sourceName','sourceReference'],
+        jsonb_build_object(
+          'id',asset.id,
+          'assetTypeId',asset.asset_type_id,
+          'parentId',asset.parent_id,
+          'operationalAreaId',asset.operational_area_id,
+          'operatorCompanyId',asset.operator_company_id,
+          'code',asset.code,
+          'name',asset.name,
+          'commonName',asset.common_name,
+          'description',asset.description,
+          'informationStatus',asset.information_status,
+          'operationalStatus',asset.operational_status,
+          'dataOrigin',asset.data_origin,
+          'sourceName',asset.source_name,
+          'sourceReference',asset.source_reference,
+          'sourceNotes',asset.source_notes
+        ),
+        'SYSTEM'
+      FROM assets asset
+      WHERE asset.data_origin='IMPORT'
+        AND asset.source_name='Tablas de yacimiento(1).xlsx'
+        AND NOT EXISTS (
+          SELECT 1 FROM asset_versions version
+          WHERE version.asset_id=asset.id AND version.version_number=1
+        )
+    `);
+    await queryRunner.query(`
+      UPDATE assets asset
+      SET current_version=GREATEST(asset.current_version,1),updated_at=CURRENT_TIMESTAMP
+      WHERE asset.data_origin='IMPORT'
+        AND asset.source_name='Tablas de yacimiento(1).xlsx'
+        AND EXISTS (
+          SELECT 1 FROM asset_versions version
+          WHERE version.asset_id=asset.id AND version.version_number=1
+        )
+    `);
+  }
+
+  public async down(): Promise<void> {
+    throw new Error('F2.2.1 no elimina baselines históricos del maestro importado. Restaurar backup PRE si fuera necesario.');
+  }
+}

api-v3/src/inspection-acts/inspection-acts.service.ts

@@ -308,7 +308,7 @@ export class InspectionActsService {
       const visit = await this.lockVisit(manager, visitId);
       this.assertVisitOpen(visit);
       await this.assertActorAssigned(manager, visitId, principal);
-      await this.assertVisitHasNoAct(manager, visitId);
+      await this.assertVisitHasNoDraftAct(manager, visitId);
       await this.assertVisitAssets(manager, visitId, dto.assetIds);
       const occurredAt = new Date(dto.occurredAt);
       const actYear = await this.yearAtProjectTimezone(manager, occurredAt);
@@ -632,20 +632,20 @@ export class InspectionActsService {
     }
   }
 
-  private async assertVisitHasNoAct(
+  private async assertVisitHasNoDraftAct(
     manager: EntityManager,
     visitId: string,
   ): Promise<void> {
     const rows = (await manager.query(`
       SELECT code
       FROM inspection_acts
-      WHERE visit_id = $1
+      WHERE visit_id = $1 AND status = 'DRAFT'
       LIMIT 1
     `, [visitId])) as Array<{ code: string }>;
     if (rows.length > 0) {
       throw new ConflictException({
-        code: 'INSPECTION_VISIT_ACT_ALREADY_EXISTS',
-        message: 'La visita ya tiene un acta; cada visita admite una única acta',
+        code: 'INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS',
+        message: 'La inspección ya tiene un acta en borrador; preparala o cancelala antes de crear otra',
       });
     }
   }

api-v3/src/inspection-closing/dto/create-company-signature.dto.ts

@@ -0,0 +1,19 @@
+import { Transform } from 'class-transformer';
+import { IsEnum, IsOptional, IsString, MaxLength, MinLength, ValidateIf } from 'class-validator';
+import { InspectionCompanySignatureManifestation } from '../../database/entities';
+import { CreateInspectionSignatureDto } from './create-inspection-signature.dto';
+
+export class CreateCompanySignatureDto extends CreateInspectionSignatureDto {
+  @IsOptional()
+  @IsEnum(InspectionCompanySignatureManifestation)
+  manifestation?: InspectionCompanySignatureManifestation;
+
+  @ValidateIf((dto: CreateCompanySignatureDto) =>
+    dto.manifestation === InspectionCompanySignatureManifestation.DISSENT,
+  )
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MinLength(10)
+  @MaxLength(4000)
+  statement?: string;
+}

api-v3/src/inspection-closing/inspection-closing.controller.ts

@@ -19,6 +19,7 @@ import type { AuthPrincipal, RequestWithContext } from '../common/http/request-c
 import { CloseInspectionActDto } from './dto/close-inspection-act.dto';
 import { CreateCompanyOutcomeDto } from './dto/create-company-outcome.dto';
 import { CreateInspectionSignatureDto } from './dto/create-inspection-signature.dto';
+import { CreateCompanySignatureDto } from './dto/create-company-signature.dto';
 import { UpsertInspectionResponsibleDto } from './dto/upsert-inspection-responsible.dto';
 import { InspectionClosingService } from './inspection-closing.service';
 import {
@@ -89,7 +90,7 @@ export class InspectionClosingController {
   }))
   companySignature(
     @Param('actId', new ParseUUIDPipe({ version: '4' })) actId: string,
-    @Body() dto: CreateInspectionSignatureDto,
+    @Body() dto: CreateCompanySignatureDto,
     @UploadedFile() file: UploadedInspectionSignatureFile | undefined,
     @CurrentAuth() principal: AuthPrincipal,
     @Req() request: RequestWithContext,

api-v3/src/inspection-closing/inspection-closing.service.ts

@@ -21,6 +21,7 @@ import {
   InspectionActSignatureSource,
   InspectionActSignatureStatus,
   InspectionActSignerType,
+  InspectionCompanySignatureManifestation,
   InspectionActStatus,
   InspectionActUploadMode,
   InspectionActVersionEvent,
@@ -33,6 +34,7 @@ import type { CloseInspectionActDto } from './dto/close-inspection-act.dto';
 import { InspectionReportsService } from '../inspection-reports/inspection-reports.service';
 import type { CreateCompanyOutcomeDto } from './dto/create-company-outcome.dto';
 import type { CreateInspectionSignatureDto } from './dto/create-inspection-signature.dto';
+import type { CreateCompanySignatureDto } from './dto/create-company-signature.dto';
 import type { UpsertInspectionResponsibleDto } from './dto/upsert-inspection-responsible.dto';
 import {
   inspectInspectionSignatureFile,
@@ -70,6 +72,8 @@ interface SignatureView {
   position: string | null;
   status: InspectionActSignatureStatus;
   reason: string | null;
+  companyManifestation: InspectionCompanySignatureManifestation | null;
+  companyStatement: string | null;
   mimeType: string | null;
   sizeBytes: number | null;
   imageSha256: string | null;
@@ -429,7 +433,7 @@ export class InspectionClosingService {
 
   async signCompany(
     actId: string,
-    dto: CreateInspectionSignatureDto,
+    dto: CreateCompanySignatureDto,
     file: UploadedInspectionSignatureFile | undefined,
     principal: AuthPrincipal,
     request: RequestWithContext,
@@ -447,7 +451,7 @@ export class InspectionClosingService {
     assertMobileInspector(principal);
     return this.dataSource.transaction(async (manager) => {
       const { act, visit } = await this.lockContext(manager, actId);
-      this.assertReadyInProgress(act, visit);
+      this.assertReadyForCompanyOutcome(act, visit);
       await this.assertActorAssigned(manager, visit.id, principal, true);
       const responsible = await this.requireResponsible(manager, actId);
       if (
@@ -540,7 +544,8 @@ export class InspectionClosingService {
     assertMobileInspector(principal);
     const closed = await this.dataSource.transaction(async (manager) => {
       const { act, visit } = await this.lockContext(manager, actId);
-      this.assertReadyInProgress(act, visit);
+      this.assertReadyForFinalClosure(act, visit);
+      await this.assertActorAssigned(manager, visit.id, principal, true);
       const closure = await this.requireClosure(manager, actId);
       const signatures = await this.loadSignatures(manager, actId);
       if (!signatures.some((item) => (
@@ -576,6 +581,8 @@ export class InspectionClosingService {
         position: item.position,
         status: item.status,
         reason: item.reason,
+        companyManifestation: item.companyManifestation,
+        companyStatement: item.companyStatement,
         imageSha256: item.imageSha256,
         consentText: item.consentText,
         consentVersion: item.consentVersion,
@@ -636,14 +643,6 @@ export class InspectionClosingService {
         WHERE id = $1
         RETURNING current_version AS "versionNumber"
       `, [actId, serverClosedAt, principal.userId, finalSha256])) as Array<{ versionNumber: number }>;
-      await manager.query(`
-        UPDATE inspection_visits
-        SET status = 'CLOSED',
-            actual_closed_at = $2,
-            updated_by = $3,
-            updated_at = $2
-        WHERE id = $1
-      `, [visit.id, serverClosedAt, principal.userId]);
       await manager.query(`
         INSERT INTO inspection_act_versions (
           act_id, version_number, event, snapshot, actor_user_id, actor_username
@@ -672,6 +671,7 @@ export class InspectionClosingService {
           visitId: visit.id,
           versionNumber: Number(updated.versionNumber),
           findingsRemainOpen: true,
+          visitRemainsIndependent: true,
         },
       }, manager);
       await this.reports.ensureFrozenReport(manager, actId, principal, request);
@@ -710,7 +710,7 @@ export class InspectionClosingService {
 
   private async createSignedSignature(
     actId: string,
-    dto: CreateInspectionSignatureDto,
+    dto: CreateInspectionSignatureDto | CreateCompanySignatureDto,
     file: UploadedInspectionSignatureFile | undefined,
     fixedIdentity: null | {
       signerType: InspectionActSignerType;
@@ -737,7 +737,8 @@ export class InspectionClosingService {
     try {
       return await this.dataSource.transaction(async (manager) => {
         const { act, visit } = await this.lockContext(manager, actId);
-        this.assertReadyInProgress(act, visit);
+        if (fixedIdentity) this.assertReadyInProgress(act, visit);
+        else this.assertReadyForCompanyOutcome(act, visit);
         await this.assertActorAssigned(manager, visit.id, principal, !requireSelfAssignment);
         const closure = await this.requireClosure(manager, actId);
         const responsible = fixedIdentity ? null : await this.requireResponsible(manager, actId);
@@ -778,6 +779,13 @@ export class InspectionClosingService {
         const source = this.signatureSource(principal);
         const signedAt = new Date();
         const clientSignedAt = dto.clientSignedAt ? new Date(dto.clientSignedAt) : null;
+        const companyDto = fixedIdentity ? null : dto as CreateCompanySignatureDto;
+        const companyManifestation = fixedIdentity
+          ? null
+          : companyDto?.manifestation ?? InspectionCompanySignatureManifestation.CONFORMITY;
+        const companyStatement = companyManifestation === InspectionCompanySignatureManifestation.DISSENT
+          ? companyDto?.statement?.trim() ?? null
+          : null;
         const payload = {
           actId,
           preparedSha256: closure.preparedSha256,
@@ -788,6 +796,8 @@ export class InspectionClosingService {
           documentNumber: identity.documentNumber,
           position: identity.position,
           status: InspectionActSignatureStatus.SIGNED,
+          companyManifestation,
+          companyStatement,
           imageSha256,
           consentText: identity.consentText,
           consentVersion: CONSENT_VERSION,
@@ -806,6 +816,7 @@ export class InspectionClosingService {
           INSERT INTO inspection_act_signatures (
             id, act_id, signer_type, signer_user_id, signer_name,
             document_type, document_number, position, status,
+            company_manifestation, company_statement,
             original_name, stored_name, mime_type, size_bytes, image_sha256,
             consent_text, consent_version, consent_accepted_at,
             client_signed_at, signed_at, latitude, longitude, accuracy_m,
@@ -814,11 +825,12 @@ export class InspectionClosingService {
           ) VALUES (
             $1, $2, $3, $4, $5,
             $6, $7, $8, 'SIGNED',
-            $9, $10, $11, $12, $13,
-            $14, $15, $16,
-            $17, $18, $19, $20, $21,
-            $22, $23, $24, $25,
-            $26, $18
+            $9, $10,
+            $11, $12, $13, $14, $15,
+            $16, $17, $18,
+            $19, $20, $21, $22, $23,
+            $24, $25, $26, $27,
+            $28, $20
           )
         `, [
           id,
@@ -829,6 +841,8 @@ export class InspectionClosingService {
           identity.documentType,
           identity.documentNumber,
           identity.position,
+          companyManifestation,
+          companyStatement,
           inspected.originalName,
           storedName,
           inspected.mimeType,
@@ -1266,6 +1280,8 @@ export class InspectionClosingService {
         signature.position,
         signature.status,
         signature.reason,
+        signature.company_manifestation AS "companyManifestation",
+        signature.company_statement AS "companyStatement",
         signature.original_name AS "originalName",
         signature.stored_name AS "storedName",
         signature.mime_type AS "mimeType",
@@ -1365,6 +1381,26 @@ export class InspectionClosingService {
     }
   }
 
+  private assertReadyForCompanyOutcome(act: InspectionAct, visit: InspectionVisit): void {
+    if (act.status !== InspectionActStatus.READY
+      || ![InspectionVisitStatus.IN_PROGRESS, InspectionVisitStatus.CLOSED].includes(visit.status)) {
+      throw new ConflictException({
+        code: 'INSPECTION_ACT_NOT_READY_FOR_COMPANY',
+        message: 'El acta debe estar preparada; la firma de empresa puede completarse durante la inspección o después de su cierre',
+      });
+    }
+  }
+
+  private assertReadyForFinalClosure(act: InspectionAct, visit: InspectionVisit): void {
+    if (act.status !== InspectionActStatus.READY
+      || ![InspectionVisitStatus.IN_PROGRESS, InspectionVisitStatus.CLOSED].includes(visit.status)) {
+      throw new ConflictException({
+        code: 'INSPECTION_ACT_NOT_READY',
+        message: 'El acta debe estar preparada para completar su cierre definitivo',
+      });
+    }
+  }
+
   private async assertActorAssigned(
     manager: EntityManager,
     visitId: string,

api-v3/src/inspection-findings/inspection-findings.module.ts

@@ -29,5 +29,6 @@ import { InspectionEvidenceService } from './inspection-evidence.service';
     InspectionFindingsService,
     InspectionEvidenceService,
   ],
+  exports: [FindingCatalogService, InspectionFindingsService],
 })
 export class InspectionFindingsModule {}

api-v3/src/inspection-operations/field-discovery-inspection-link.service.ts

@@ -1,4 +1,4 @@
-import { ConflictException, Injectable } from '@nestjs/common';
+import { Injectable } from '@nestjs/common';
 import type { EntityManager } from 'typeorm';
 
 export interface FieldDiscoveryInspectionLinkResult {
@@ -18,7 +18,7 @@ export class FieldDiscoveryInspectionLinkService {
         SELECT id, status
         FROM inspection_acts
         WHERE visit_id = $1
-          AND status <> 'CANCELLED'
+          AND status = 'DRAFT'
         ORDER BY created_at DESC
         LIMIT 1
         FOR UPDATE
@@ -26,25 +26,60 @@ export class FieldDiscoveryInspectionLinkService {
       [visitId],
     )) as Array<{ id: string; status: string }>;
 
-    if (act && act.status !== 'DRAFT') {
-      throw new ConflictException({
-        code: 'FIELD_DISCOVERY_ACT_NOT_EDITABLE',
-        message: 'El Acta ya no admite nuevos elementos ni Hallazgos',
-      });
-    }
+    const [existing] = (await manager.query(
+      `
+        SELECT included, planning_source AS "planningSource"
+        FROM inspection_visit_assets
+        WHERE visit_id = $1 AND asset_id = $2
+        FOR UPDATE
+      `,
+      [visitId, assetId],
+    )) as Array<{ included: boolean; planningSource: string }>;
 
     await manager.query(
       `
-        INSERT INTO inspection_visit_assets (visit_id, asset_id, included, added_by)
-        VALUES ($1, $2, true, $3)
+        INSERT INTO inspection_visit_assets (
+          visit_id, asset_id, included, planning_source, added_by,
+          exclusion_reason, excluded_by, excluded_at
+        )
+        VALUES ($1, $2, true, 'FIELD', $3, NULL, NULL, NULL)
         ON CONFLICT (visit_id, asset_id) DO UPDATE SET
           included = true,
+          planning_source = CASE
+            WHEN inspection_visit_assets.planning_source IN ('AUTOMATIC','VERIFICATION')
+              THEN inspection_visit_assets.planning_source
+            ELSE 'FIELD'
+          END,
           added_by = EXCLUDED.added_by,
+          exclusion_reason = NULL,
+          excluded_by = NULL,
+          excluded_at = NULL,
           updated_at = CURRENT_TIMESTAMP
       `,
       [visitId, assetId, userId],
     );
 
+    const eventType = existing && existing.included ? null : 'FIELD_INCLUDED';
+    if (eventType) {
+      await manager.query(
+        `
+          INSERT INTO inspection_visit_asset_events (
+            visit_id, asset_id, event_type, actor_user_id, metadata
+          )
+          VALUES ($1, $2, 'FIELD_INCLUDED', $3, $4::jsonb)
+        `,
+        [
+          visitId,
+          assetId,
+          userId,
+          JSON.stringify({
+            fieldSelection: true,
+            previousPlanningSource: existing?.planningSource ?? null,
+          }),
+        ],
+      );
+    }
+
     if (act) {
       await manager.query(
         `

api-v3/src/inspection-reports/inspection-act-pdf-builder.ts

@@ -16,6 +16,8 @@ function lines(snapshot: Record<string, unknown>): string[] {
   const team=asArray(prepared.team);
   const assets=asArray(prepared.assets);
   const findings=asArray(prepared.findings);
+  const signatures=asArray(snapshot.signatures);
+  const companySignature=signatures.find(item=>text(item.signerType,'')==='COMPANY_RESPONSIBLE');
   const companies=[...new Set(assets.map(x=>text(asRecord(x.operatorCompany).name,'')).filter(Boolean))];
   const areas=[...new Set(assets.map(x=>text(asRecord(x.operationalArea).name,'')).filter(Boolean))];
   const inspectors=team.map(x=>`${text(x.firstName,'')} ${text(x.lastName,'')}`.trim()).filter(Boolean);
@@ -42,6 +44,15 @@ function lines(snapshot: Record<string, unknown>): string[] {
   out.push('', 'HALLAZGOS');
   if(!findings.length) out.push('Sin hallazgos registrados.');
   for(const item of findings){ out.push(...wrap(`${text(item.code)} | ${text(item.title)} | Vencimiento: ${date(item.correctionDueOn)}`)); out.push(...wrap(text(item.description))); }
+  out.push('', 'CONSTANCIA DE LA EMPRESA');
+  if(!companySignature) out.push('Firma o constancia pendiente.');
+  else if(text(companySignature.status,'')==='SIGNED'){
+    const manifestation=text(companySignature.companyManifestation,'CONFORMITY');
+    out.push(manifestation==='DISSENT'?'Firma en disidencia':'Firma en conformidad');
+    if(manifestation==='DISSENT') out.push(...wrap(text(companySignature.companyStatement)));
+  } else {
+    out.push(...wrap(`${text(companySignature.status)}: ${text(companySignature.reason)}`));
+  }
   out.push('', 'INTEGRIDAD', `Hash de cierre: ${text(asRecord(snapshot).finalSha256 ?? asRecord(snapshot).preparedSha256)}`);
   return out;
 }

api-v3/src/inspection-visits/dto/close-inspection-visit.dto.ts

@@ -0,0 +1,6 @@
+import { IsISO8601 } from 'class-validator';
+
+export class CloseInspectionVisitDto {
+  @IsISO8601({ strict: true })
+  clientClosedAt!: string;
+}

api-v3/src/inspection-visits/dto/create-field-finding.dto.ts

@@ -0,0 +1,58 @@
+import { Transform, Type } from 'class-transformer';
+import {
+  IsInt,
+  IsOptional,
+  IsString,
+  IsUUID,
+  Matches,
+  Max,
+  MaxLength,
+  Min,
+  MinLength,
+  ValidateIf,
+} from 'class-validator';
+
+const optionalText = ({ value }: { value: unknown }) =>
+  typeof value === 'string' && value.trim() ? value.trim() : null;
+
+/**
+ * Hallazgo capturado desde la APK sobre un Inventario ya seleccionado.
+ * El assetId se toma de la URL para evitar inconsistencias entre pantalla y payload.
+ */
+export class CreateFieldFindingDto {
+  @IsOptional()
+  @Transform(optionalText)
+  @IsUUID('4')
+  catalogItemId?: string | null;
+
+  @ValidateIf((value: CreateFieldFindingDto) => !value.catalogItemId)
+  @Transform(optionalText)
+  @IsString()
+  @MinLength(1)
+  @MaxLength(500)
+  customTitle?: string | null;
+
+  @IsOptional()
+  @Transform(optionalText)
+  @IsString()
+  @MaxLength(12000)
+  customLegalBasis?: string | null;
+
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MinLength(1)
+  @MaxLength(20000)
+  description!: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(10)
+  severity?: number;
+
+  @IsOptional()
+  @Transform(optionalText)
+  @Matches(/^\d{4}-\d{2}-\d{2}$/)
+  correctionDueOn?: string | null;
+}

api-v3/src/inspection-visits/dto/create-field-inventory.dto.ts

@@ -0,0 +1,85 @@
+import { Transform, Type } from 'class-transformer';
+import {
+  IsISO8601,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  IsUUID,
+  Matches,
+  Max,
+  MaxLength,
+  Min,
+  MinLength,
+} from 'class-validator';
+
+export class CreateFieldInventoryDto {
+  @IsUUID('4')
+  typeId!: string;
+
+  @IsOptional()
+  @IsUUID('4')
+  parentId?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim().toUpperCase() : undefined)
+  @IsString()
+  @MaxLength(120)
+  @Matches(/^[A-Z0-9][A-Z0-9._/-]*$/)
+  code?: string;
+
+  @Transform(({ value }) => typeof value === 'string' ? value.trim() : value)
+  @IsString()
+  @MinLength(1)
+  @MaxLength(200)
+  name!: string;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(200)
+  commonName?: string | null;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(4000)
+  description?: string | null;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(4000)
+  discoveryNotes?: string | null;
+
+  @IsObject()
+  attributes!: Record<string, unknown>;
+
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-90)
+  @Max(90)
+  deviceLatitude!: number;
+
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-180)
+  @Max(180)
+  deviceLongitude!: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 3 })
+  @Min(0)
+  @Max(100000)
+  deviceAccuracyM?: number;
+
+  @IsISO8601({ strict: true })
+  deviceCapturedAt!: string;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(255)
+  deviceLabel?: string | null;
+}

api-v3/src/inspection-visits/dto/list-field-inventory-query.dto.ts

@@ -0,0 +1,25 @@
+import { Transform, Type } from 'class-transformer';
+import { IsInt, IsOptional, IsString, IsUUID, Max, MaxLength, Min } from 'class-validator';
+
+export class ListFieldInventoryQueryDto {
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : undefined)
+  @IsString()
+  @MaxLength(200)
+  search?: string;
+
+  @IsOptional()
+  @IsUUID('4')
+  parentId?: string;
+
+  @IsOptional()
+  @IsUUID('4')
+  typeId?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit = 50;
+}

api-v3/src/inspection-visits/dto/upload-field-inventory-photo.dto.ts

@@ -0,0 +1,70 @@
+import { Transform, Type } from 'class-transformer';
+import {
+  IsISO8601,
+  IsNumber,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+} from 'class-validator';
+
+export class UploadFieldInventoryPhotoDto {
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(200)
+  title?: string | null;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(4000)
+  description?: string | null;
+
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-90)
+  @Max(90)
+  deviceLatitude!: number;
+
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-180)
+  @Max(180)
+  deviceLongitude!: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 3 })
+  @Min(0)
+  @Max(100000)
+  deviceAccuracyM?: number;
+
+  @IsISO8601({ strict: true })
+  deviceCapturedAt!: string;
+
+  @IsOptional()
+  @Transform(({ value }) => typeof value === 'string' && value.trim() ? value.trim() : null)
+  @IsString()
+  @MaxLength(255)
+  deviceLabel?: string | null;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-90)
+  @Max(90)
+  exifLatitude?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber({ maxDecimalPlaces: 6 })
+  @Min(-180)
+  @Max(180)
+  exifLongitude?: number;
+
+  @IsOptional()
+  @IsISO8601({ strict: true })
+  exifCapturedAt?: string;
+}

api-v3/src/inspection-visits/field-findings.controller.ts

@@ -0,0 +1,51 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  ParseUUIDPipe,
+  Post,
+  Req,
+} from '@nestjs/common';
+import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
+import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import { CreateFieldFindingDto } from './dto/create-field-finding.dto';
+import { FieldFindingsService } from './field-findings.service';
+
+@Controller('inspection-visits/:visitId/field-findings')
+export class FieldFindingsController {
+  constructor(private readonly fieldFindings: FieldFindingsService) {}
+
+  @Get(':assetId/options')
+  @RequirePermissions('inspection_findings.create', 'inspections.execute')
+  options(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ): Promise<unknown> {
+    return this.fieldFindings.options(visitId, assetId, principal);
+  }
+
+  @Get(':assetId')
+  @RequirePermissions('inspection_findings.read', 'inspections.execute')
+  list(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ): Promise<unknown> {
+    return this.fieldFindings.list(visitId, assetId, principal);
+  }
+
+  @Post(':assetId')
+  @RequirePermissions('inspection_findings.create', 'inspections.execute')
+  create(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @Body() dto: CreateFieldFindingDto,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ): Promise<unknown> {
+    return this.fieldFindings.create(visitId, assetId, dto, principal, request);
+  }
+}

api-v3/src/inspection-visits/field-findings.service.ts

@@ -0,0 +1,278 @@
+import { BadRequestException, ConflictException, Injectable, NotFoundException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import type { CreateInspectionFindingDto } from '../inspection-findings/dto/create-inspection-finding.dto';
+import { FindingCatalogService } from '../inspection-findings/finding-catalog.service';
+import { InspectionFindingsService } from '../inspection-findings/inspection-findings.service';
+import { assertMobileInspector } from '../inspection-operations/mobile-inspector-policy';
+import type { CreateFieldFindingDto } from './dto/create-field-finding.dto';
+
+interface DraftActRow {
+  id: string;
+  code: string;
+  status: string;
+}
+
+interface FieldFindingGate {
+  context: {
+    inspection: { id: string; code: string; status: string };
+    area: { id: string; code: string; name: string };
+    operatorCompany: { id: string; code: string; name: string };
+  };
+  capture: {
+    captureRequired: boolean;
+    hasGeometry: boolean;
+    creationGpsCaptured: boolean;
+    fieldPhotoCount: number;
+    readyForFinding: boolean;
+  };
+}
+
+@Injectable()
+export class FieldFindingsService {
+  constructor(
+    private readonly dataSource: DataSource,
+    private readonly catalog: FindingCatalogService,
+    private readonly findings: InspectionFindingsService,
+  ) {}
+
+  async options(visitId: string, assetId: string, principal: AuthPrincipal) {
+    const gate = await this.requireGate(visitId, assetId, principal);
+    const act = await this.requireDraftAct(visitId);
+    const [catalog, findings] = await Promise.all([
+      this.catalog.listApplicableForAsset(assetId, {}),
+      this.findings.listForAct(act.id),
+    ]);
+
+    return {
+      context: gate.context,
+      act,
+      capture: gate.capture,
+      catalog,
+      findings: findings.data.filter((finding) => finding.assetId === assetId),
+      canAddAnother: true,
+    };
+  }
+
+  async list(visitId: string, assetId: string, principal: AuthPrincipal) {
+    const gate = await this.requireGate(visitId, assetId, principal);
+    const act = await this.requireDraftAct(visitId);
+    const findings = await this.findings.listForAct(act.id);
+    return {
+      context: gate.context,
+      act,
+      capture: gate.capture,
+      data: findings.data.filter((finding) => finding.assetId === assetId),
+    };
+  }
+
+  async create(
+    visitId: string,
+    assetId: string,
+    dto: CreateFieldFindingDto,
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ) {
+    const gate = await this.requireGate(visitId, assetId, principal);
+    const act = await this.requireDraftAct(visitId);
+    const payload: CreateInspectionFindingDto = {
+      assetId,
+      catalogItemId: dto.catalogItemId ?? null,
+      customTitle: dto.customTitle ?? null,
+      customLegalBasis: dto.customLegalBasis ?? null,
+      description: dto.description,
+      severity: dto.severity,
+      correctionDueOn: dto.correctionDueOn ?? null,
+    };
+    const finding = await this.findings.create(act.id, payload, principal, request);
+    return {
+      context: gate.context,
+      act,
+      capture: gate.capture,
+      finding,
+      canAddAnother: true,
+    };
+  }
+
+  private async requireGate(
+    visitId: string,
+    assetId: string,
+    principal: AuthPrincipal,
+  ): Promise<FieldFindingGate> {
+    assertMobileInspector(principal);
+    const [row] = await this.dataSource.query(`
+      SELECT
+        visit.id AS "visitId",
+        visit.code AS "visitCode",
+        visit.status AS "visitStatus",
+        visit.operational_area_id AS "areaId",
+        area.code AS "areaCode",
+        area.name AS "areaName",
+        visit.operator_company_id AS "companyId",
+        company.code AS "companyCode",
+        company.name AS "companyName",
+        asset.id AS "assetId",
+        asset.operational_area_id AS "assetAreaId",
+        asset.operator_company_id AS "assetCompanyId",
+        EXISTS (
+          SELECT 1
+          FROM inspection_visit_members member
+          WHERE member.visit_id = visit.id
+            AND member.user_id = $3::uuid
+            AND member.included = true
+        ) OR visit.lead_inspector_user_id = $3::uuid AS assigned,
+        EXISTS (
+          SELECT 1
+          FROM inspection_visit_assets link
+          WHERE link.visit_id = visit.id
+            AND link.asset_id = asset.id
+            AND link.included = true
+        ) AS selected,
+        EXISTS (
+          SELECT 1
+          FROM asset_field_discoveries discovery
+          WHERE discovery.visit_id = visit.id
+            AND discovery.asset_id = asset.id
+        ) AS "captureRequired",
+        EXISTS (
+          SELECT 1
+          FROM asset_geometries geometry
+          WHERE geometry.asset_id = asset.id
+        ) AS "hasGeometry",
+        EXISTS (
+          SELECT 1
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = visit.id
+            AND event.asset_id = asset.id
+            AND event.event_type = 'CREATED'
+        ) AS "creationGpsCaptured",
+        (
+          SELECT COUNT(*)::integer
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = visit.id
+            AND event.asset_id = asset.id
+            AND event.event_type = 'PHOTO'
+        ) AS "fieldPhotoCount"
+      FROM inspection_visits visit
+      LEFT JOIN assets area ON area.id = visit.operational_area_id
+      LEFT JOIN assets company ON company.id = visit.operator_company_id
+      LEFT JOIN assets asset ON asset.id = $2::uuid
+        AND asset.information_status <> 'INACTIVE'
+      WHERE visit.id = $1::uuid
+    `, [visitId, assetId, principal.userId]) as Array<{
+      visitId: string;
+      visitCode: string;
+      visitStatus: string;
+      areaId: string | null;
+      areaCode: string | null;
+      areaName: string | null;
+      companyId: string | null;
+      companyCode: string | null;
+      companyName: string | null;
+      assetId: string | null;
+      assetAreaId: string | null;
+      assetCompanyId: string | null;
+      assigned: boolean;
+      selected: boolean;
+      captureRequired: boolean;
+      hasGeometry: boolean;
+      creationGpsCaptured: boolean;
+      fieldPhotoCount: number;
+    }>;
+
+    if (!row) {
+      throw new NotFoundException({ code: 'INSPECTION_VISIT_NOT_FOUND', message: 'Inspección no encontrada' });
+    }
+    if (row.visitStatus !== 'IN_PROGRESS') {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_VISIT_NOT_IN_PROGRESS',
+        message: 'Los hallazgos sólo pueden registrarse cuando la inspección está en curso',
+      });
+    }
+    if (!row.assigned) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_INSPECTOR_NOT_ASSIGNED',
+        message: 'El inspector no está asignado a esta inspección',
+      });
+    }
+    if (!row.areaId || !row.companyId || !row.areaCode || !row.areaName || !row.companyCode || !row.companyName) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_CONTEXT_REQUIRED',
+        message: 'La inspección no tiene Área y Operadora definidas',
+      });
+    }
+    if (!row.assetId) {
+      throw new NotFoundException({
+        code: 'FIELD_FINDING_INVENTORY_NOT_FOUND',
+        message: 'Registro de Inventario no encontrado',
+      });
+    }
+    if (row.assetAreaId !== row.areaId || row.assetCompanyId !== row.companyId) {
+      throw new BadRequestException({
+        code: 'FIELD_FINDING_INVENTORY_OUTSIDE_CONTEXT',
+        message: 'El Inventario no pertenece al Área y Operadora de esta inspección',
+      });
+    }
+    if (!row.selected) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_INVENTORY_NOT_SELECTED',
+        message: 'Seleccioná el Inventario dentro de la inspección antes de registrar un hallazgo',
+      });
+    }
+
+    const captureRequired = Boolean(row.captureRequired);
+    const hasGeometry = Boolean(row.hasGeometry);
+    const creationGpsCaptured = Boolean(row.creationGpsCaptured);
+    const fieldPhotoCount = Number(row.fieldPhotoCount ?? 0);
+    const readyForFinding = !captureRequired || (
+      hasGeometry && creationGpsCaptured && fieldPhotoCount > 0
+    );
+    if (!readyForFinding) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_CAPTURE_REQUIRED',
+        message: 'Antes del hallazgo, el Inventario creado en campo debe tener GPS y al menos una foto',
+        capture: { captureRequired, hasGeometry, creationGpsCaptured, fieldPhotoCount },
+      });
+    }
+
+    return {
+      context: {
+        inspection: { id: row.visitId, code: row.visitCode, status: row.visitStatus },
+        area: { id: row.areaId, code: row.areaCode, name: row.areaName },
+        operatorCompany: { id: row.companyId, code: row.companyCode, name: row.companyName },
+      },
+      capture: {
+        captureRequired,
+        hasGeometry,
+        creationGpsCaptured,
+        fieldPhotoCount,
+        readyForFinding,
+      },
+    };
+  }
+
+  private async requireDraftAct(visitId: string): Promise<DraftActRow> {
+    const rows = await this.dataSource.query(`
+      SELECT id, code, status
+      FROM inspection_acts
+      WHERE visit_id = $1::uuid
+        AND status = 'DRAFT'
+      ORDER BY created_at DESC, id DESC
+      LIMIT 2
+    `, [visitId]) as DraftActRow[];
+
+    if (rows.length === 0) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_DRAFT_ACT_REQUIRED',
+        message: 'La inspección no tiene un Acta borrador abierta para registrar hallazgos',
+      });
+    }
+    if (rows.length > 1) {
+      throw new ConflictException({
+        code: 'FIELD_FINDING_MULTIPLE_DRAFT_ACTS',
+        message: 'La inspección tiene más de un Acta borrador. Debe resolverse antes de continuar',
+      });
+    }
+    return rows[0];
+  }
+}

api-v3/src/inspection-visits/field-inventory.controller.ts

@@ -0,0 +1,93 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  ParseUUIDPipe,
+  Post,
+  Query,
+  Req,
+  UploadedFile,
+  UseInterceptors,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
+import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
+import { MAX_ASSET_MEDIA_BYTES, type UploadedAssetFile } from '../asset-master/asset-media-file';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import { CreateFieldInventoryDto } from './dto/create-field-inventory.dto';
+import { ListFieldInventoryQueryDto } from './dto/list-field-inventory-query.dto';
+import { UploadFieldInventoryPhotoDto } from './dto/upload-field-inventory-photo.dto';
+import { FieldInventoryService } from './field-inventory.service';
+
+@Controller('inspection-visits/:visitId/field-inventory')
+export class FieldInventoryController {
+  constructor(private readonly fieldInventory: FieldInventoryService) {}
+
+  @Get()
+  @RequirePermissions('assets.read', 'inspections.execute')
+  list(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Query() query: ListFieldInventoryQueryDto,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldInventory.list(visitId, query, principal);
+  }
+
+  @Get('types')
+  @RequirePermissions('assets.read', 'inspections.execute')
+  types(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Query() query: ListFieldInventoryQueryDto,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldInventory.types(visitId, query.parentId, principal);
+  }
+
+  @Get(':assetId')
+  @RequirePermissions('assets.read', 'inspections.execute')
+  detail(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldInventory.detail(visitId, assetId, principal);
+  }
+
+  @Post(':assetId/select')
+  @RequirePermissions('assets.read', 'inspections.execute')
+  selectExisting(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @CurrentAuth() principal: AuthPrincipal,
+  ) {
+    return this.fieldInventory.selectExisting(visitId, assetId, principal);
+  }
+
+  @Post()
+  @RequirePermissions('assets.create', 'inspections.execute')
+  create(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Body() dto: CreateFieldInventoryDto,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.fieldInventory.create(visitId, dto, principal, request);
+  }
+
+  @Post(':assetId/photos')
+  @RequirePermissions('assets.create', 'inspections.execute')
+  @UseInterceptors(FileInterceptor('file', {
+    limits: { fileSize: MAX_ASSET_MEDIA_BYTES, files: 1 },
+  }))
+  uploadPhoto(
+    @Param('visitId', new ParseUUIDPipe({ version: '4' })) visitId: string,
+    @Param('assetId', new ParseUUIDPipe({ version: '4' })) assetId: string,
+    @Body() dto: UploadFieldInventoryPhotoDto,
+    @UploadedFile() file: UploadedAssetFile | undefined,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.fieldInventory.uploadPhoto(visitId, assetId, dto, file, principal, request);
+  }
+}

api-v3/src/inspection-visits/field-inventory.service.ts

@@ -0,0 +1,648 @@
+import {
+  BadRequestException,
+  ConflictException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { AssetGeometriesService } from '../asset-master/asset-geometries.service';
+import { AssetMediaService, type AssetMediaView } from '../asset-master/asset-media.service';
+import { AssetsService } from '../asset-master/assets.service';
+import type { UploadedAssetFile } from '../asset-master/asset-media-file';
+import type { CreateFieldDiscoveryDto } from '../asset-master/dto/create-field-discovery.dto';
+import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
+import { AssetGeometryType, AssetMediaKind } from '../database/entities';
+import { FieldDiscoveryInspectionLinkService } from '../inspection-operations/field-discovery-inspection-link.service';
+import { assertMobileInspector } from '../inspection-operations/mobile-inspector-policy';
+import type { CreateFieldInventoryDto } from './dto/create-field-inventory.dto';
+import type { ListFieldInventoryQueryDto } from './dto/list-field-inventory-query.dto';
+import type { UploadFieldInventoryPhotoDto } from './dto/upload-field-inventory-photo.dto';
+
+interface MobileVisitContext {
+  id: string;
+  code: string;
+  status: string;
+  areaId: string;
+  areaCode: string;
+  areaName: string;
+  companyId: string;
+  companyCode: string;
+  companyName: string;
+  assigned: boolean;
+}
+
+interface FieldDiscoveryCreated {
+  id: string;
+  asset: {
+    id: string;
+    code: string;
+    name: string;
+    informationStatus: string;
+  };
+}
+
+export interface FieldInventoryCaptureStatus {
+  captureRequired: boolean;
+  hasGeometry: boolean;
+  creationGpsCaptured: boolean;
+  fieldPhotoCount: number;
+  readyForFinding: boolean;
+  latestDeviceCapture: {
+    latitude: number;
+    longitude: number;
+    accuracyM: number | null;
+    capturedAt: Date;
+    deviceLabel: string | null;
+  } | null;
+  latestPhotoExif: {
+    latitude: number | null;
+    longitude: number | null;
+    capturedAt: Date | null;
+  } | null;
+}
+
+@Injectable()
+export class FieldInventoryService {
+  constructor(
+    private readonly dataSource: DataSource,
+    private readonly assets: AssetsService,
+    private readonly geometries: AssetGeometriesService,
+    private readonly media: AssetMediaService,
+    private readonly links: FieldDiscoveryInspectionLinkService,
+  ) {}
+
+  async list(
+    visitId: string,
+    query: ListFieldInventoryQueryDto,
+    principal: AuthPrincipal,
+  ) {
+    const context = await this.requireVisitContext(visitId, principal, false);
+    if (query.parentId) await this.requireParentInContext(query.parentId, context);
+
+    const args: unknown[] = [context.areaId, context.companyId, visitId];
+    const conditions = [
+      'asset.operational_area_id = $1::uuid',
+      'asset.operator_company_id = $2::uuid',
+      "asset.information_status <> 'INACTIVE'",
+    ];
+
+    if (query.search?.trim()) {
+      args.push(`%${query.search.trim()}%`);
+      const p = `$${args.length}`;
+      conditions.push(`(
+        asset.code ILIKE ${p}
+        OR asset.name ILIKE ${p}
+        OR asset.common_name ILIKE ${p}
+        OR EXISTS (
+          SELECT 1
+          FROM asset_attribute_values value
+          JOIN asset_attribute_definitions definition ON definition.id = value.definition_id
+          WHERE value.asset_id = asset.id
+            AND definition.is_active = true
+            AND (value.value #>> '{}') ILIKE ${p}
+        )
+      )`);
+    }
+
+    if (query.parentId) {
+      args.push(query.parentId);
+      conditions.push(`asset.parent_id = $${args.length}::uuid`);
+    }
+    if (query.typeId) {
+      args.push(query.typeId);
+      conditions.push(`asset.asset_type_id = $${args.length}::uuid`);
+    }
+
+    args.push(query.limit);
+    const limit = `$${args.length}`;
+    const data = await this.dataSource.query(`
+      SELECT
+        asset.id,
+        asset.code,
+        asset.name,
+        asset.common_name AS "commonName",
+        asset.information_status AS "informationStatus",
+        asset.data_origin AS "dataOrigin",
+        JSONB_BUILD_OBJECT('id', type.id, 'code', type.code, 'name', type.name) AS type,
+        CASE WHEN parent.id IS NULL THEN NULL ELSE JSONB_BUILD_OBJECT(
+          'id', parent.id, 'code', parent.code, 'name', parent.name
+        ) END AS parent,
+        EXISTS (
+          SELECT 1 FROM inspection_visit_assets link
+          WHERE link.visit_id = $3::uuid
+            AND link.asset_id = asset.id
+            AND link.included = true
+        ) AS "selectedInInspection",
+        EXISTS (
+          SELECT 1 FROM asset_field_discoveries discovery
+          WHERE discovery.visit_id = $3::uuid AND discovery.asset_id = asset.id
+        ) AS "captureRequired",
+        EXISTS (
+          SELECT 1 FROM asset_geometries geometry WHERE geometry.asset_id = asset.id
+        ) AS "hasGeometry",
+        (
+          SELECT COUNT(*)::integer
+          FROM asset_field_capture_events capture
+          WHERE capture.visit_id = $3::uuid
+            AND capture.asset_id = asset.id
+            AND capture.event_type = 'PHOTO'
+        ) AS "fieldPhotoCount",
+        (
+          NOT EXISTS (
+            SELECT 1 FROM asset_field_discoveries discovery
+            WHERE discovery.visit_id = $3::uuid AND discovery.asset_id = asset.id
+          )
+          OR (
+            EXISTS (SELECT 1 FROM asset_geometries geometry WHERE geometry.asset_id = asset.id)
+            AND EXISTS (
+              SELECT 1 FROM asset_field_capture_events capture
+              WHERE capture.visit_id = $3::uuid
+                AND capture.asset_id = asset.id
+                AND capture.event_type = 'CREATED'
+            )
+            AND EXISTS (
+              SELECT 1 FROM asset_field_capture_events capture
+              WHERE capture.visit_id = $3::uuid
+                AND capture.asset_id = asset.id
+                AND capture.event_type = 'PHOTO'
+            )
+          )
+        ) AS "readyForFinding"
+      FROM assets asset
+      JOIN asset_types type ON type.id = asset.asset_type_id
+      LEFT JOIN assets parent ON parent.id = asset.parent_id
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY asset.name, asset.code
+      LIMIT ${limit}
+    `, args);
+
+    return { context: this.publicContext(context), data };
+  }
+
+  async types(
+    visitId: string,
+    parentId: string | undefined,
+    principal: AuthPrincipal,
+  ) {
+    const context = await this.requireVisitContext(visitId, principal, false);
+    const effectiveParentId = parentId ?? context.areaId;
+    const parent = await this.requireParentInContext(effectiveParentId, context);
+
+    const data = await this.dataSource.query(`
+      SELECT
+        type.id,
+        type.code,
+        type.name,
+        type.description,
+        COALESCE(
+          JSONB_AGG(
+            JSONB_BUILD_OBJECT(
+              'id', definition.id,
+              'code', definition.code,
+              'name', definition.name,
+              'dataType', definition.data_type,
+              'isRequired', definition.is_required,
+              'unit', definition.unit,
+              'options', definition.options,
+              'sortOrder', definition.sort_order
+            ) ORDER BY definition.sort_order, definition.name
+          ) FILTER (WHERE definition.id IS NOT NULL),
+          '[]'::jsonb
+        ) AS attributes
+      FROM asset_type_parent_rules rule
+      JOIN asset_types type ON type.id = rule.child_type_id
+      LEFT JOIN asset_attribute_definitions definition
+        ON definition.asset_type_id = type.id
+       AND definition.is_active = true
+      WHERE rule.parent_type_id = $1::uuid
+        AND type.is_active = true
+        AND type.operational_role = 'GENERIC'
+      GROUP BY type.id, type.code, type.name, type.description
+      ORDER BY type.name, type.code
+    `, [parent.typeId]);
+
+    return {
+      context: this.publicContext(context),
+      parent: { id: parent.id, code: parent.code, name: parent.name },
+      data,
+    };
+  }
+
+  async detail(visitId: string, assetId: string, principal: AuthPrincipal) {
+    const context = await this.requireVisitContext(visitId, principal, false);
+    await this.requireAssetInContext(assetId, context);
+    return {
+      context: this.publicContext(context),
+      asset: await this.assets.getById(assetId),
+      selectedInInspection: await this.isSelected(visitId, assetId),
+      capture: await this.captureStatus(visitId, assetId),
+    };
+  }
+
+  async selectExisting(
+    visitId: string,
+    assetId: string,
+    principal: AuthPrincipal,
+  ) {
+    const context = await this.requireVisitContext(visitId, principal, true);
+    await this.requireAssetInContext(assetId, context);
+    await this.dataSource.transaction((manager) =>
+      this.links.attach(manager, visitId, assetId, principal.userId),
+    );
+    return this.detail(visitId, assetId, principal);
+  }
+
+  async create(
+    visitId: string,
+    dto: CreateFieldInventoryDto,
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ) {
+    const context = await this.requireVisitContext(visitId, principal, true);
+    const parentId = dto.parentId ?? context.areaId;
+    await this.requireParentInContext(parentId, context);
+
+    const capturedAt = new Date(dto.deviceCapturedAt);
+    if (!Number.isFinite(capturedAt.getTime())) {
+      throw new BadRequestException({
+        code: 'FIELD_INVENTORY_INVALID_CAPTURE_DATE',
+        message: 'La fecha de captura del dispositivo no es válida',
+      });
+    }
+
+    const code = dto.code?.trim().toUpperCase() || await this.nextFieldCode(capturedAt);
+    const discoveryDto: CreateFieldDiscoveryDto = {
+      visitId,
+      code,
+      name: dto.name,
+      commonName: dto.commonName ?? null,
+      typeId: dto.typeId,
+      parentId,
+      operationalAreaId: context.areaId,
+      operatorCompanyId: context.companyId,
+      description: dto.description ?? null,
+      discoveryNotes: dto.discoveryNotes ?? null,
+      attributes: dto.attributes,
+    };
+
+    const discovery = await this.assets.createFieldDiscovery(
+      discoveryDto,
+      principal,
+      request,
+    ) as FieldDiscoveryCreated;
+    const assetId = discovery.asset?.id;
+    if (!assetId) {
+      throw new Error('El alta de campo no devolvió el identificador del Inventario creado');
+    }
+
+    await this.geometries.upsert(assetId, {
+      geometry: {
+        type: AssetGeometryType.POINT,
+        coordinates: [dto.deviceLongitude, dto.deviceLatitude],
+      },
+      accuracyM: dto.deviceAccuracyM ?? null,
+      capturedAt: dto.deviceCapturedAt,
+      deviceLabel: dto.deviceLabel ?? null,
+    }, principal, request);
+
+    await this.dataSource.query(`
+      INSERT INTO asset_field_capture_events (
+        visit_id, asset_id, event_type,
+        device_latitude, device_longitude, device_accuracy_m,
+        device_captured_at, device_label, created_by
+      ) VALUES ($1,$2,'CREATED',$3,$4,$5,$6,$7,$8)
+    `, [
+      visitId,
+      assetId,
+      dto.deviceLatitude,
+      dto.deviceLongitude,
+      dto.deviceAccuracyM ?? null,
+      capturedAt,
+      dto.deviceLabel ?? null,
+      principal.userId,
+    ]);
+
+    return this.detail(visitId, assetId, principal);
+  }
+
+  async uploadPhoto(
+    visitId: string,
+    assetId: string,
+    dto: UploadFieldInventoryPhotoDto,
+    file: UploadedAssetFile | undefined,
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ): Promise<{ media: AssetMediaView; capture: FieldInventoryCaptureStatus }> {
+    const context = await this.requireVisitContext(visitId, principal, true);
+    await this.requireAssetInContext(assetId, context);
+    if (!await this.isSelected(visitId, assetId)) {
+      throw new ConflictException({
+        code: 'FIELD_INVENTORY_NOT_SELECTED',
+        message: 'Seleccioná el registro dentro de la inspección antes de agregar fotografías',
+      });
+    }
+
+    const exifHasLatitude = dto.exifLatitude !== undefined;
+    const exifHasLongitude = dto.exifLongitude !== undefined;
+    if (exifHasLatitude !== exifHasLongitude) {
+      throw new BadRequestException({
+        code: 'FIELD_PHOTO_EXIF_COORDINATES_INCOMPLETE',
+        message: 'Las coordenadas EXIF deben incluir latitud y longitud juntas',
+      });
+    }
+
+    const uploaded = await this.media.upload(assetId, {
+      kind: AssetMediaKind.PHOTO,
+      title: dto.title ?? undefined,
+      description: dto.description ?? undefined,
+      capturedAt: dto.deviceCapturedAt,
+      latitude: dto.deviceLatitude,
+      longitude: dto.deviceLongitude,
+      accuracyM: dto.deviceAccuracyM,
+    }, file, principal, request);
+
+    await this.dataSource.query(`
+      INSERT INTO asset_field_capture_events (
+        visit_id, asset_id, media_id, event_type,
+        device_latitude, device_longitude, device_accuracy_m,
+        device_captured_at, device_label,
+        exif_latitude, exif_longitude, exif_captured_at,
+        created_by
+      ) VALUES ($1,$2,$3,'PHOTO',$4,$5,$6,$7,$8,$9,$10,$11,$12)
+    `, [
+      visitId,
+      assetId,
+      uploaded.id,
+      dto.deviceLatitude,
+      dto.deviceLongitude,
+      dto.deviceAccuracyM ?? null,
+      new Date(dto.deviceCapturedAt),
+      dto.deviceLabel ?? null,
+      dto.exifLatitude ?? null,
+      dto.exifLongitude ?? null,
+      dto.exifCapturedAt ? new Date(dto.exifCapturedAt) : null,
+      principal.userId,
+    ]);
+
+    return { media: uploaded, capture: await this.captureStatus(visitId, assetId) };
+  }
+
+  private async requireVisitContext(
+    visitId: string,
+    principal: AuthPrincipal,
+    requireInProgress: boolean,
+  ): Promise<MobileVisitContext> {
+    assertMobileInspector(principal);
+    const [context] = (await this.dataSource.query(`
+      SELECT
+        visit.id,
+        visit.code,
+        visit.status,
+        visit.operational_area_id AS "areaId",
+        area.code AS "areaCode",
+        area.name AS "areaName",
+        visit.operator_company_id AS "companyId",
+        company.code AS "companyCode",
+        company.name AS "companyName",
+        (
+          visit.lead_inspector_user_id = $2::uuid
+          OR EXISTS (
+            SELECT 1
+            FROM inspection_visit_members member
+            WHERE member.visit_id = visit.id
+              AND member.user_id = $2::uuid
+              AND member.included = true
+          )
+        ) AS assigned
+      FROM inspection_visits visit
+      LEFT JOIN assets area ON area.id = visit.operational_area_id
+      LEFT JOIN assets company ON company.id = visit.operator_company_id
+      WHERE visit.id = $1::uuid
+    `, [visitId, principal.userId])) as MobileVisitContext[];
+
+    if (!context) {
+      throw new NotFoundException({ code: 'INSPECTION_VISIT_NOT_FOUND', message: 'Inspección no encontrada' });
+    }
+    if (!context.areaId || !context.companyId) {
+      throw new ConflictException({
+        code: 'FIELD_INVENTORY_CONTEXT_REQUIRED',
+        message: 'La inspección no tiene Área y Operadora definidas',
+      });
+    }
+    if (!context.assigned) {
+      throw new ConflictException({
+        code: 'FIELD_INVENTORY_INSPECTOR_NOT_ASSIGNED',
+        message: 'El inspector no está asignado a esta inspección',
+      });
+    }
+    if (requireInProgress && context.status !== 'IN_PROGRESS') {
+      throw new ConflictException({
+        code: 'FIELD_INVENTORY_VISIT_NOT_IN_PROGRESS',
+        message: 'El Inventario sólo puede modificarse cuando la inspección está en curso',
+      });
+    }
+    if (!requireInProgress && !['PLANNED', 'IN_PROGRESS'].includes(context.status)) {
+      throw new ConflictException({
+        code: 'FIELD_INVENTORY_VISIT_NOT_AVAILABLE',
+        message: 'El Inventario de campo está disponible para inspecciones planificadas o en curso',
+      });
+    }
+    return context;
+  }
+
+  private publicContext(context: MobileVisitContext) {
+    return {
+      inspection: { id: context.id, code: context.code, status: context.status },
+      area: { id: context.areaId, code: context.areaCode, name: context.areaName },
+      operatorCompany: {
+        id: context.companyId,
+        code: context.companyCode,
+        name: context.companyName,
+      },
+    };
+  }
+
+  private async requireParentInContext(parentId: string, context: MobileVisitContext) {
+    const [parent] = (await this.dataSource.query(`
+      SELECT
+        asset.id,
+        asset.code,
+        asset.name,
+        asset.asset_type_id AS "typeId",
+        asset.operational_area_id AS "areaId",
+        asset.operator_company_id AS "companyId"
+      FROM assets asset
+      WHERE asset.id = $1::uuid
+        AND asset.information_status <> 'INACTIVE'
+    `, [parentId])) as Array<{
+      id: string;
+      code: string;
+      name: string;
+      typeId: string;
+      areaId: string | null;
+      companyId: string | null;
+    }>;
+
+    if (!parent) {
+      throw new NotFoundException({
+        code: 'FIELD_INVENTORY_PARENT_NOT_FOUND',
+        message: 'La ubicación padre no existe',
+      });
+    }
+    if (
+      parent.id !== context.areaId
+      && (parent.areaId !== context.areaId || parent.companyId !== context.companyId)
+    ) {
+      throw new BadRequestException({
+        code: 'FIELD_INVENTORY_PARENT_OUTSIDE_CONTEXT',
+        message: 'La ubicación padre no pertenece al Área y Operadora de la inspección',
+      });
+    }
+    return parent;
+  }
+
+  private async requireAssetInContext(assetId: string, context: MobileVisitContext) {
+    const [asset] = (await this.dataSource.query(`
+      SELECT id,
+             operational_area_id AS "areaId",
+             operator_company_id AS "companyId"
+      FROM assets
+      WHERE id = $1::uuid
+        AND information_status <> 'INACTIVE'
+    `, [assetId])) as Array<{
+      id: string;
+      areaId: string | null;
+      companyId: string | null;
+    }>;
+
+    if (!asset) {
+      throw new NotFoundException({
+        code: 'FIELD_INVENTORY_NOT_FOUND',
+        message: 'Registro de Inventario no encontrado',
+      });
+    }
+    if (asset.areaId !== context.areaId || asset.companyId !== context.companyId) {
+      throw new BadRequestException({
+        code: 'FIELD_INVENTORY_OUTSIDE_CONTEXT',
+        message: 'El registro no pertenece al Área y Operadora de esta inspección',
+      });
+    }
+    return asset;
+  }
+
+  private async isSelected(visitId: string, assetId: string): Promise<boolean> {
+    const rows = await this.dataSource.query(`
+      SELECT 1
+      FROM inspection_visit_assets
+      WHERE visit_id = $1::uuid
+        AND asset_id = $2::uuid
+        AND included = true
+    `, [visitId, assetId]) as unknown[];
+    return rows.length > 0;
+  }
+
+  private async captureStatus(
+    visitId: string,
+    assetId: string,
+  ): Promise<FieldInventoryCaptureStatus> {
+    const [row] = (await this.dataSource.query(`
+      SELECT
+        EXISTS (
+          SELECT 1
+          FROM asset_field_discoveries discovery
+          WHERE discovery.visit_id = $1::uuid
+            AND discovery.asset_id = $2::uuid
+        ) AS "captureRequired",
+        EXISTS (
+          SELECT 1 FROM asset_geometries geometry WHERE geometry.asset_id = $2::uuid
+        ) AS "hasGeometry",
+        EXISTS (
+          SELECT 1
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = $1::uuid
+            AND event.asset_id = $2::uuid
+            AND event.event_type = 'CREATED'
+        ) AS "creationGpsCaptured",
+        (
+          SELECT COUNT(*)::integer
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = $1::uuid
+            AND event.asset_id = $2::uuid
+            AND event.event_type = 'PHOTO'
+        ) AS "fieldPhotoCount",
+        (
+          SELECT JSONB_BUILD_OBJECT(
+            'latitude', event.device_latitude,
+            'longitude', event.device_longitude,
+            'accuracyM', event.device_accuracy_m,
+            'capturedAt', event.device_captured_at,
+            'deviceLabel', event.device_label
+          )
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = $1::uuid
+            AND event.asset_id = $2::uuid
+          ORDER BY event.device_captured_at DESC, event.created_at DESC, event.id DESC
+          LIMIT 1
+        ) AS "latestDeviceCapture",
+        (
+          SELECT JSONB_BUILD_OBJECT(
+            'latitude', event.exif_latitude,
+            'longitude', event.exif_longitude,
+            'capturedAt', event.exif_captured_at
+          )
+          FROM asset_field_capture_events event
+          WHERE event.visit_id = $1::uuid
+            AND event.asset_id = $2::uuid
+            AND event.event_type = 'PHOTO'
+          ORDER BY event.device_captured_at DESC, event.created_at DESC, event.id DESC
+          LIMIT 1
+        ) AS "latestPhotoExif"
+    `, [visitId, assetId])) as Array<{
+      captureRequired: boolean;
+      hasGeometry: boolean;
+      creationGpsCaptured: boolean;
+      fieldPhotoCount: number;
+      latestDeviceCapture: FieldInventoryCaptureStatus['latestDeviceCapture'];
+      latestPhotoExif: FieldInventoryCaptureStatus['latestPhotoExif'];
+    }>;
+
+    const captureRequired = Boolean(row?.captureRequired);
+    const hasGeometry = Boolean(row?.hasGeometry);
+    const creationGpsCaptured = Boolean(row?.creationGpsCaptured);
+    const fieldPhotoCount = Number(row?.fieldPhotoCount ?? 0);
+
+    return {
+      captureRequired,
+      hasGeometry,
+      creationGpsCaptured,
+      fieldPhotoCount,
+      readyForFinding: !captureRequired || (
+        hasGeometry && creationGpsCaptured && fieldPhotoCount > 0
+      ),
+      latestDeviceCapture: row?.latestDeviceCapture ?? null,
+      latestPhotoExif: row?.latestPhotoExif ?? null,
+    };
+  }
+
+  private async nextFieldCode(observedAt: Date): Promise<string> {
+    const year = observedAt.getUTCFullYear();
+    if (!Number.isInteger(year) || year < 2000 || year > 9999) {
+      throw new BadRequestException({
+        code: 'FIELD_INVENTORY_INVALID_CAPTURE_DATE',
+        message: 'La fecha de captura no es válida para generar el código',
+      });
+    }
+
+    const [row] = (await this.dataSource.query(`
+      INSERT INTO field_inventory_code_sequences (year, last_value)
+      VALUES ($1, 1)
+      ON CONFLICT (year)
+      DO UPDATE SET last_value = field_inventory_code_sequences.last_value + 1
+      RETURNING last_value AS value
+    `, [year])) as Array<{ value: number }>;
+
+    const value = Number(row?.value ?? 0);
+    if (!value) throw new Error('No se pudo generar el código de Inventario de campo');
+    return `CAM-${year}-${String(value).padStart(6, '0')}`;
+  }
+}

api-v3/src/inspection-visits/inspection-visits.controller.ts

@@ -14,6 +14,7 @@ import { CurrentAuth } from '../auth/decorators/current-auth.decorator';
 import { RequirePermissions } from '../authorization/decorators/require-permissions.decorator';
 import type { AuthPrincipal, RequestWithContext } from '../common/http/request-context';
 import { ChangeInspectionVisitStatusDto } from './dto/change-inspection-visit-status.dto';
+import { CloseInspectionVisitDto } from './dto/close-inspection-visit.dto';
 import { CreateInspectionVisitDto } from './dto/create-inspection-visit.dto';
 import { ExcludeInspectionVisitAssetDto } from './dto/exclude-inspection-visit-asset.dto';
 import { ListInspectionVisitsQueryDto } from './dto/list-inspection-visits-query.dto';
@@ -154,4 +155,15 @@ export class InspectionVisitsController {
   ) {
     return this.visits.start(id, principal, request);
   }
+
+  @Post(':id/close')
+  @RequirePermissions('inspections.execute')
+  close(
+    @Param('id', new ParseUUIDPipe({ version: '4' })) id: string,
+    @Body() dto: CloseInspectionVisitDto,
+    @CurrentAuth() principal: AuthPrincipal,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.visits.close(id, dto, principal, request);
+  }
 }

api-v3/src/inspection-visits/inspection-visits.module.ts

@@ -1,11 +1,17 @@
 import { Module } from '@nestjs/common';
+import { AssetMasterModule } from '../asset-master/asset-master.module';
 import { AuditModule } from '../audit/audit.module';
+import { InspectionFindingsModule } from '../inspection-findings/inspection-findings.module';
+import { FieldFindingsController } from './field-findings.controller';
+import { FieldFindingsService } from './field-findings.service';
+import { FieldInventoryController } from './field-inventory.controller';
+import { FieldInventoryService } from './field-inventory.service';
 import { InspectionVisitsController } from './inspection-visits.controller';
 import { InspectionVisitsService } from './inspection-visits.service';
 
 @Module({
-  imports: [AuditModule],
-  controllers: [InspectionVisitsController],
-  providers: [InspectionVisitsService],
+  imports: [AuditModule, AssetMasterModule, InspectionFindingsModule],
+  controllers: [InspectionVisitsController, FieldInventoryController, FieldFindingsController],
+  providers: [InspectionVisitsService, FieldInventoryService, FieldFindingsService],
 })
 export class InspectionVisitsModule {}

api-v3/src/inspection-visits/inspection-visits.service.ts

@@ -19,6 +19,7 @@ import {
   InspectionVisitStatus,
 } from '../database/entities';
 import type { ChangeInspectionVisitStatusDto } from './dto/change-inspection-visit-status.dto';
+import type { CloseInspectionVisitDto } from './dto/close-inspection-visit.dto';
 import type { CreateInspectionVisitDto } from './dto/create-inspection-visit.dto';
 import type { ListInspectionVisitsQueryDto } from './dto/list-inspection-visits-query.dto';
 import type { ReplaceInspectionVisitAssetsDto } from './dto/replace-inspection-visit-assets.dto';
@@ -810,6 +811,107 @@ export class InspectionVisitsService {
     });
   }
 
+
+  async close(
+    id: string,
+    dto: CloseInspectionVisitDto,
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ): Promise<InspectionVisitView> {
+    assertMobileInspector(principal);
+    return this.dataSource.transaction(async (manager) => {
+      const visit = await this.lockVisit(manager, id);
+      if (visit.status !== InspectionVisitStatus.IN_PROGRESS) {
+        throw new ConflictException({
+          code: 'INSPECTION_VISIT_NOT_IN_PROGRESS',
+          message: 'La inspección debe estar en curso para cerrarse',
+        });
+      }
+      if (!principal.permissions.includes('inspections.manage')) {
+        const memberIds = await this.activeMemberIds(manager, id);
+        if (!memberIds.includes(principal.userId)) {
+          throw new ForbiddenException({
+            code: 'INSPECTION_VISIT_NOT_ASSIGNED',
+            message: 'La inspección no está asignada al usuario actual',
+          });
+        }
+      }
+      const [acts] = (await manager.query(`
+        SELECT
+          COUNT(*) FILTER (WHERE act.status = 'DRAFT')::integer AS drafts,
+          COUNT(*) FILTER (
+            WHERE act.status = 'READY'
+              AND NOT EXISTS (
+                SELECT 1 FROM inspection_act_signatures signature
+                WHERE signature.act_id = act.id
+                  AND signature.signer_type = 'INSPECTOR'
+                  AND signature.status = 'SIGNED'
+              )
+          )::integer AS "readyWithoutInspector",
+          COUNT(*) FILTER (
+            WHERE act.status = 'READY'
+              AND NOT EXISTS (
+                SELECT 1 FROM inspection_act_signatures signature
+                WHERE signature.act_id = act.id
+                  AND signature.signer_type = 'COMPANY_RESPONSIBLE'
+              )
+          )::integer AS "pendingCompany"
+        FROM inspection_acts act
+        WHERE act.visit_id = $1
+          AND act.status <> 'CANCELLED'
+      `, [id])) as Array<{ drafts: number; readyWithoutInspector: number; pendingCompany: number }>;
+      if (Number(acts?.drafts ?? 0) > 0) {
+        throw new ConflictException({
+          code: 'INSPECTION_VISIT_DRAFT_ACTS_PENDING',
+          message: 'Prepará o cancelá las actas en borrador antes de cerrar la inspección',
+        });
+      }
+      if (Number(acts?.readyWithoutInspector ?? 0) > 0) {
+        throw new ConflictException({
+          code: 'INSPECTION_VISIT_INSPECTOR_SIGNATURE_PENDING',
+          message: 'Toda acta preparada debe tener firma de inspector antes de cerrar la inspección',
+        });
+      }
+      const serverClosedAt = new Date();
+      const clientClosedAt = new Date(dto.clientClosedAt);
+      if (visit.actualStartedAt && clientClosedAt.getTime() < visit.actualStartedAt.getTime()) {
+        throw new BadRequestException({
+          code: 'INSPECTION_VISIT_INVALID_CLOSE_TIME',
+          message: 'La fecha de cierre del dispositivo no puede ser anterior al inicio de la inspección',
+        });
+      }
+      if (clientClosedAt.getTime() > serverClosedAt.getTime() + 24 * 60 * 60 * 1000) {
+        throw new BadRequestException({
+          code: 'INSPECTION_VISIT_INVALID_DEVICE_TIME',
+          message: 'La fecha informada por el dispositivo no puede estar más de 24 horas en el futuro',
+        });
+      }
+      visit.status = InspectionVisitStatus.CLOSED;
+      visit.actualClosedAt = serverClosedAt;
+      visit.updatedBy = principal.userId;
+      await manager.getRepository(InspectionVisit).save(visit);
+      const updated = await this.loadView(manager, id);
+      await this.audit.record({
+        ...administrationAuditContext(principal, request),
+        action: AuditAction.INSPECTION_VISIT_STATUS_CHANGED,
+        entityType: 'inspection_visit',
+        entityId: id,
+        beforeData: { status: InspectionVisitStatus.IN_PROGRESS },
+        afterData: {
+          status: InspectionVisitStatus.CLOSED,
+          clientClosedAt: clientClosedAt.toISOString(),
+          serverClosedAt: serverClosedAt.toISOString(),
+          pendingCompanySignatures: Number(acts?.pendingCompany ?? 0),
+        },
+        metadata: {
+          closeSource: 'ANDROID',
+          actsMayCompleteCompanySignatureLater: true,
+        },
+      }, manager);
+      return updated;
+    });
+  }
+
   private visitSelect(where: string): string {
     return `
       SELECT

api-v3/src/version.ts

@@ -1,2 +1,2 @@
-export const API_VERSION = '0.19.6-4';
-export const API_PHASE = 'D5.6.4';
+export const API_VERSION = '0.23.0-1';
+export const API_PHASE = 'F2.3';

api-v3/test/f2-2-1-reference-excel-data.test.ts

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { loadF221ExcelSource } from '../src/reference-data/f2-2-1-excel-source';
+
+const source = loadF221ExcelSource();
+
+test('F2.2.1 preserves every normalized territorial source row', () => {
+  assert.equal(source.territory.length, 230);
+  assert.equal(new Set(source.territory.map((row) => row.field)).size, 220);
+  assert.equal(new Set(source.territory.map((row) => `${row.field.toLowerCase()}|${row.area.toLowerCase()}`)).size, 230);
+});
+
+test('F2.2.1 does not collapse repeated field names across different operational contexts', () => {
+  const byName = new Map<string, Set<string>>();
+  for (const row of source.territory) {
+    const key = row.field.toLowerCase();
+    const contexts = byName.get(key) ?? new Set<string>();
+    contexts.add(`${row.area}|${row.operator}`);
+    byName.set(key, contexts);
+  }
+  assert.ok([...byName.values()].some((contexts) => contexts.size > 1));
+});
+
+test('F2.2.1 keeps the APP matrix as configuration rather than physical inventory rows', () => {
+  assert.equal(source.types.length, 113);
+  assert.equal(source.parentPairs.length, 119);
+  assert.equal(source.attributes.length, 44);
+  assert.equal(source.idemRefs.length, 25);
+  assert.ok(source.types.some((entry) => entry.code === 'tanque'));
+  assert.ok(source.types.some((entry) => entry.code === 'bateria'));
+});
+
+test('F2.2.1 keeps IDEM as inheritance metadata, never as a catalog title', () => {
+  const directTitles = source.directFindings.flatMap((entry) => entry.titles);
+  assert.equal(directTitles.some((title) => /^idem\b/i.test(title.trim())), false);
+  assert.ok(source.idemRefs.some((entry) => entry.type === 'tanque'));
+});
+
+test('F2.2.1 imports the grouped Hallazgo catalog supplied in Hoja2', () => {
+  assert.equal(source.groups.length, 19);
+  assert.equal(source.groups.reduce((total, group) => total + group.items.length, 0), 171);
+  const tanks = source.groups.find((group) => group.name.trim().toUpperCase() === 'TANQUES');
+  assert.ok(tanks);
+  assert.ok(tanks.items.some((item) => /ESTADO DEL TANQUE/i.test(item.title)));
+});
+
+test('F2.2.1 preserves rows explicitly reporting no operator without fabricating an organization in source data', () => {
+  assert.ok(source.territory.some((row) => row.operator.toLowerCase().includes('sin empresa operadora')));
+});

api-v3/test/unit/field-findings-f2-3.test.ts

@@ -0,0 +1,67 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFileSync } from 'node:fs';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+import { CreateFieldFindingDto } from '../../src/inspection-visits/dto/create-field-finding.dto';
+import { FieldFindingsController } from '../../src/inspection-visits/field-findings.controller';
+
+function permissions(method: string): string[] {
+  const controller = FieldFindingsController.prototype;
+  const handler = controller[method as keyof typeof controller];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('F2.3 mantiene los Hallazgos de campo bajo ejecución móvil y permisos explícitos', () => {
+  assert.deepEqual(permissions('options'), ['inspection_findings.create', 'inspections.execute']);
+  assert.deepEqual(permissions('list'), ['inspection_findings.read', 'inspections.execute']);
+  assert.deepEqual(permissions('create'), ['inspection_findings.create', 'inspections.execute']);
+});
+
+test('F2.3 exige descripción y título cuando el inspector usa OTROS', async () => {
+  const dto = plainToInstance(CreateFieldFindingDto, {
+    description: '',
+    catalogItemId: null,
+    customTitle: '',
+  });
+  const errors = await validate(dto);
+  const properties = new Set(errors.map((error) => error.property));
+  assert.equal(properties.has('description'), true);
+  assert.equal(properties.has('customTitle'), true);
+});
+
+test('F2.3 vuelve a validar contexto, selección y GPS+foto en servidor antes del Hallazgo', () => {
+  const source = readFileSync('src/inspection-visits/field-findings.service.ts', 'utf8');
+  assert.match(source, /assertMobileInspector\(principal\)/);
+  assert.match(source, /row\.visitStatus !== 'IN_PROGRESS'/);
+  assert.match(source, /FIELD_FINDING_INSPECTOR_NOT_ASSIGNED/);
+  assert.match(source, /FIELD_FINDING_INVENTORY_OUTSIDE_CONTEXT/);
+  assert.match(source, /FIELD_FINDING_INVENTORY_NOT_SELECTED/);
+  assert.match(source, /hasGeometry && creationGpsCaptured && fieldPhotoCount > 0/);
+  assert.match(source, /FIELD_FINDING_CAPTURE_REQUIRED/);
+});
+
+test('F2.3 resuelve exactamente el Acta DRAFT actual y no vuelve a la regla de un Acta por inspección', () => {
+  const source = readFileSync('src/inspection-visits/field-findings.service.ts', 'utf8');
+  assert.match(source, /FROM inspection_acts/);
+  assert.match(source, /status = 'DRAFT'/);
+  assert.match(source, /LIMIT 2/);
+  assert.match(source, /FIELD_FINDING_DRAFT_ACT_REQUIRED/);
+  assert.match(source, /FIELD_FINDING_MULTIPLE_DRAFT_ACTS/);
+});
+
+test('F2.3 reutiliza catálogo contextual y creación canónica, conserva OTROS y permite varios Hallazgos', () => {
+  const fieldSource = readFileSync('src/inspection-visits/field-findings.service.ts', 'utf8');
+  const catalogSource = readFileSync('src/inspection-findings/finding-catalog.service.ts', 'utf8');
+  const findingSource = readFileSync('src/inspection-findings/inspection-findings.service.ts', 'utf8');
+
+  assert.match(fieldSource, /this\.catalog\.listApplicableForAsset\(assetId, \{\}\)/);
+  assert.match(fieldSource, /this\.findings\.create\(act\.id, payload, principal, request\)/);
+  assert.match(fieldSource, /canAddAnother: true/);
+  assert.match(catalogSource, /code: 'OTHER'/);
+  assert.match(catalogSource, /label: 'OTROS'/);
+  assert.match(findingSource, /finding_catalog_proposals/);
+  assert.match(findingSource, /PENDING/);
+});

api-v3/test/unit/field-inventory-f2-1.test.ts

@@ -0,0 +1,67 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFileSync } from 'node:fs';
+import { validate } from 'class-validator';
+import { plainToInstance } from 'class-transformer';
+import { FieldInventoryController } from '../../src/inspection-visits/field-inventory.controller';
+import { CreateFieldInventoryDto } from '../../src/inspection-visits/dto/create-field-inventory.dto';
+import { UploadFieldInventoryPhotoDto } from '../../src/inspection-visits/dto/upload-field-inventory-photo.dto';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+
+function permissions(method: string): string[] {
+  const controller = FieldInventoryController.prototype;
+  const handler = controller[method as keyof typeof controller];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('F2.1 mantiene Inventario de campo bajo política móvil y permisos explícitos', () => {
+  assert.deepEqual(permissions('list'), ['assets.read', 'inspections.execute']);
+  assert.deepEqual(permissions('types'), ['assets.read', 'inspections.execute']);
+  assert.deepEqual(permissions('selectExisting'), ['assets.read', 'inspections.execute']);
+  assert.deepEqual(permissions('create'), ['assets.create', 'inspections.execute']);
+  assert.deepEqual(permissions('uploadPhoto'), ['assets.create', 'inspections.execute']);
+});
+
+test('F2.1 exige GPS del dispositivo al crear Inventario en campo', async () => {
+  const dto = plainToInstance(CreateFieldInventoryDto, {
+    typeId: '11111111-1111-4111-8111-111111111111',
+    name: 'Batería 28',
+    attributes: {},
+    deviceCapturedAt: '2026-09-05T17:30:00-03:00',
+  });
+  const errors = await validate(dto);
+  const properties = new Set(errors.map((error) => error.property));
+  assert.equal(properties.has('deviceLatitude'), true);
+  assert.equal(properties.has('deviceLongitude'), true);
+});
+
+test('F2.1 exige GPS del dispositivo en cada fotografía de campo', async () => {
+  const dto = plainToInstance(UploadFieldInventoryPhotoDto, {
+    deviceCapturedAt: '2026-09-05T17:30:00-03:00',
+  });
+  const errors = await validate(dto);
+  const properties = new Set(errors.map((error) => error.property));
+  assert.equal(properties.has('deviceLatitude'), true);
+  assert.equal(properties.has('deviceLongitude'), true);
+});
+
+test('F2.1 deriva Área y Operadora desde la Inspección y usa el asset anidado del alta provisional', () => {
+  const source = readFileSync('src/inspection-visits/field-inventory.service.ts', 'utf8');
+  assert.match(source, /visit\.operational_area_id AS \"areaId\"/);
+  assert.match(source, /visit\.operator_company_id AS \"companyId\"/);
+  assert.match(source, /operationalAreaId: context\.areaId/);
+  assert.match(source, /operatorCompanyId: context\.companyId/);
+  assert.match(source, /const assetId = discovery\.asset\?\.id/);
+});
+
+test('F2.1 bloquea hallazgos sobre altas de campo hasta tener GPS y foto', () => {
+  const migration = readFileSync(
+    'src/database/migrations/1789668000000-phase-f2-1-field-inventory.ts',
+    'utf8',
+  );
+  assert.match(migration, /enforce_field_inventory_capture_before_finding/);
+  assert.match(migration, /FIELD_INVENTORY_GPS_REQUIRED/);
+  assert.match(migration, /FIELD_INVENTORY_PHOTO_REQUIRED/);
+  assert.match(migration, /REVOKE UPDATE, DELETE ON TABLE asset_field_capture_events/);
+});

api-v3/test/unit/inspection-acts-single-act.test.ts

@@ -4,37 +4,29 @@ import { ConflictException } from '@nestjs/common';
 import type { DataSource, EntityManager } from 'typeorm';
 import { InspectionActsService } from '../../src/inspection-acts/inspection-acts.service';
 
-type SingleActGuard = {
-  assertVisitHasNoAct(manager: EntityManager, visitId: string): Promise<void>;
+type DraftActGuard = {
+  assertVisitHasNoDraftAct(manager: EntityManager, visitId: string): Promise<void>;
 };
 
-function serviceGuard(): SingleActGuard {
+function serviceGuard(): DraftActGuard {
   return new InspectionActsService(
     {} as DataSource,
     {} as never,
-  ) as unknown as SingleActGuard;
+  ) as unknown as DraftActGuard;
 }
 
-test('single-act guard allows a visit without an act', async () => {
-  const manager = {
-    query: async () => [],
-  } as unknown as EntityManager;
-
-  await assert.doesNotReject(
-    serviceGuard().assertVisitHasNoAct(manager, 'visit-id'),
-  );
+test('multi-act guard allows a new act when the inspection has no draft act', async () => {
+  const manager = { query: async () => [] } as unknown as EntityManager;
+  await assert.doesNotReject(serviceGuard().assertVisitHasNoDraftAct(manager, 'visit-id'));
 });
 
-test('single-act guard rejects a second act for the same visit', async () => {
-  const manager = {
-    query: async () => [{ code: 'ACTA-2026-000001' }],
-  } as unknown as EntityManager;
-
+test('multi-act guard blocks only a second draft act for the same inspection', async () => {
+  const manager = { query: async () => [{ code: 'ACTA-2026-000001' }] } as unknown as EntityManager;
   await assert.rejects(
-    serviceGuard().assertVisitHasNoAct(manager, 'visit-id'),
+    serviceGuard().assertVisitHasNoDraftAct(manager, 'visit-id'),
     (error: unknown) => error instanceof ConflictException
       && error.getResponse() instanceof Object
       && (error.getResponse() as { code?: string }).code
-        === 'INSPECTION_VISIT_ACT_ALREADY_EXISTS',
+        === 'INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS',
   );
 });

api-v3/test/unit/inspection-visits-authorization.test.ts

@@ -20,4 +20,5 @@ test('inspection visit endpoints separate reading, planning, assignment and exec
   assert.deepEqual(permissionFor('replaceTeam'), ['inspections.assign']);
   assert.deepEqual(permissionFor('changeStatus'), ['inspections.manage']);
   assert.deepEqual(permissionFor('start'), ['inspections.execute']);
+  assert.deepEqual(permissionFor('close'), ['inspections.execute']);
 });

api-v3/test/unit/mobile-inspector-integration.test.ts

@@ -19,7 +19,7 @@ test('D5.1 applies the mobile-inspector policy to every field operation', async
     source('inspection-findings/inspection-evidence.service.ts'),
     source('inspection-closing/inspection-closing.service.ts'),
   ]);
-  assert.equal(policyCalls(visits), 1);
+  assert.equal(policyCalls(visits), 2);
   assert.equal(policyCalls(acts), 3);
   assert.equal(policyCalls(findings), 2);
   assert.equal(policyCalls(evidence), 1);

api-v3/test/unit/phase-d5-3-19-inventory-filters-deadlines.test.ts

@@ -46,9 +46,9 @@ test('D5.3.19 exposes company area inspector and date filters across operational
   }
 });
 
-test('D5.3.19 keeps one visit equal to one act', () => {
-  assert.match(actsService, /await this\.assertVisitHasNoAct\(manager, visitId\)/);
-  assert.match(actsService, /INSPECTION_VISIT_ACT_ALREADY_EXISTS/);
+test('F1.1 supersedes the historical single-act rule while retaining the D5.3.19 filters', () => {
+  assert.match(actsService, /await this\.assertVisitHasNoDraftAct\(manager, visitId\)/);
+  assert.match(actsService, /INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS/);
 });
 
 test('D5.3.19 does not introduce the contextual finding catalog before its office definition', () => {

api-v3/test/unit/phase-d5-3-20-automatic-word-report.test.ts

@@ -35,7 +35,7 @@ test('D5.3.20 builds OOXML Word from the frozen act snapshot without external do
   assert.doesNotMatch(builder, /nodemailer|libreoffice|pandoc/i);
 });
 
-test('D5.3.20 preserves one visit one act and leaves email delivery for a configured phase', () => {
+test('D5.3.20 keeps frozen report generation act-scoped and leaves email delivery for a configured phase', () => {
   assert.match(closing, /findingsRemainOpen: true/);
   assert.doesNotMatch(migration, /smtp|email_outbox|mail_delivery/i);
 });

api-v3/test/unit/phase-d5-3-21-document-delivery.test.ts

@@ -4,4 +4,4 @@ test('D5.3.21 stores institutional and company recipients without hardcoding add
 test('D5.3.21 creates an immutable act PDF and separates its delivery from the report Word',()=>{assert.match(migration,/inspection_act_pdf_artifacts/);assert.match(migration,/ACT_PDF/);assert.match(migration,/REPORT_WORD/);assert.match(pdf,/%PDF-1\.4/);assert.match(delivery,/this\.pdf\.ensure/);assert.match(delivery,/this\.word\.ensure/);});
 test('D5.3.21 keeps an auditable retryable outbox with explicit waiting states',()=>{assert.match(migration,/WAITING_RECIPIENT/);assert.match(migration,/WAITING_TRANSPORT/);assert.match(migration,/WAITING_ARTIFACT/);assert.match(delivery,/export interface DeliveryRow/);assert.match(controller,/Promise<DeliveryRow>/);assert.match(controller,/outbox\/:id\/retry/);assert.match(controller,/retry-pending/);});
 test('D5.3.21 only attempts SMTP when transport and recipients are configured',()=>{assert.match(smtp,/SMTP_HOST/);assert.match(smtp,/MAIL_FROM/);assert.match(smtp,/STARTTLS/);assert.match(delivery,/this\.smtp\.configured\(\)/);assert.match(delivery,/WAITING_TRANSPORT/);});
-test('D5.3.21 triggers document delivery after the frozen report Word step without changing one visit one act',()=>{assert.match(reports,/await this\.delivery\.dispatchForAct\(actId\)/); const acts=read('src/inspection-acts/inspection-acts.service.ts');assert.match(acts,/assertVisitHasNoAct/);assert.match(acts,/INSPECTION_VISIT_ACT_ALREADY_EXISTS/);});
+test('D5.3.21 delivery stays act-scoped after F1.1 enables multiple acts',()=>{assert.match(reports,/await this\.delivery\.dispatchForAct\(actId\)/); const acts=read('src/inspection-acts/inspection-acts.service.ts');assert.match(acts,/assertVisitHasNoDraftAct/);assert.match(acts,/INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS/);});

api-v3/test/unit/phase-d5-3-22-director-report-review.test.ts

@@ -48,8 +48,8 @@ test('D5.3.22 binds the final Director signature to report and revision hashes',
 });
 
 test('D5.3.22 changes only the report review layer and preserves inspection immutability', () => {
-  assert.match(acts, /assertVisitHasNoAct/);
-  assert.match(acts, /INSPECTION_VISIT_ACT_ALREADY_EXISTS/);
+  assert.match(acts, /assertVisitHasNoDraftAct/);
+  assert.match(acts, /INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS/);
   assert.match(findings, /INSPECTION_FINDING_RESPONSE_IMMUTABLE/);
   assert.doesNotMatch(migration, /ALTER TABLE inspection_acts/);
   assert.doesNotMatch(migration, /ALTER TABLE inspection_findings/);

api-v3/test/unit/phase-d5-3-23-field-discoveries.test.ts

@@ -26,12 +26,14 @@ test('D5.3.23 only lets a mobile assigned inspector create during an active visi
   assert.match(assets, /FIELD_DISCOVERY_INSPECTOR_NOT_ASSIGNED/);
 });
 
-test('D5.3.23 immediately links the provisional object to the visit and open act', () => {
+test('F1.1 preserves D5.3.23 field discovery while linking only to the current draft act', () => {
   assert.match(assets, /fieldDiscoveryInspectionLinks\.attach/);
   assert.doesNotMatch(assets, /INSERT INTO inspection_/);
   assert.match(inspectionLinks, /INSERT INTO inspection_visit_assets/);
   assert.match(inspectionLinks, /INSERT INTO inspection_act_assets/);
-  assert.match(inspectionLinks, /FIELD_DISCOVERY_ACT_NOT_EDITABLE/);
+  assert.match(inspectionLinks, /status = 'DRAFT'/);
+  assert.match(inspectionLinks, /if \(act\)/);
+  assert.match(inspectionLinks, /actId: act\?\.id \?\? null/);
   assert.match(findings, /assertActAsset/);
 });
 

api-v3/test/unit/phase-d5-6-phase-d-closure.test.ts

@@ -6,10 +6,10 @@ import test from 'node:test';
 const root = process.cwd();
 const read = (relative: string) => fs.readFileSync(path.join(root, relative), 'utf8');
 
-test('D5.6 preserves one visit one immutable act with a frozen closure snapshot', () => {
+test('D5.6 immutable act closure remains intact after the multi-act transition', () => {
   const acts = read('src/inspection-acts/inspection-acts.service.ts');
   const closing = read('src/inspection-closing/inspection-closing.service.ts');
-  assert.match(acts, /INSPECTION_VISIT_ACT_ALREADY_EXISTS/);
+  assert.match(acts, /INSPECTION_VISIT_DRAFT_ACT_ALREADY_EXISTS/);
   assert.match(closing, /final_snapshot = \$2/);
   assert.match(closing, /final_sha256 = \$3/);
   assert.match(closing, /InspectionActVersionEvent\.CLOSED/);
@@ -74,10 +74,8 @@ test('D5.6 preserves auditable document delivery while allowing SMTP to remain p
   assert.match(smtp, /MAIL_FROM/);
 });
 
-test('D5.6 declares a stable Phase D closure across maintenance hotfixes without introducing another functional migration', () => {
-  const apiVersion = read('src/version.ts');
-  assert.match(apiVersion, /API_VERSION = '0\.19\.6(?:-\d+)?'/);
-  assert.match(apiVersion, /API_PHASE = 'D5\.6(?:\.\d+)?'/);
+test('D5.6 remains a historical closure baseline while Phase F introduces an explicit new migration', () => {
   const migrations = fs.readdirSync(path.join(root, 'src/database/migrations'));
   assert.equal(migrations.some((name) => /phase-d5-6/i.test(name)), false);
+  assert.equal(migrations.some((name) => /phase-f1-1-multi-act-inspections/i.test(name)), true);
 });

api-v3/test/unit/phase-f1-1-multi-act-operating-model.test.ts

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = process.cwd();
+const read = (relative: string) => fs.readFileSync(path.join(root, relative), 'utf8');
+
+test('F1.1 migration allows many acts per inspection while keeping only one draft at a time', () => {
+  const migration = read('src/database/migrations/1789495200000-phase-f1-1-multi-act-inspections.ts');
+  assert.match(migration, /DROP CONSTRAINT IF EXISTS uq_inspection_acts_visit/);
+  assert.match(migration, /CREATE UNIQUE INDEX uq_inspection_acts_one_draft_per_visit/);
+  assert.match(migration, /WHERE status = 'DRAFT'/);
+  assert.match(migration, /DROP CONSTRAINT IF EXISTS uq_inspection_reports_visit/);
+  assert.match(migration, /CREATE INDEX idx_inspection_reports_visit_id/);
+});
+
+test('F1.1 preserves exactly one frozen report per act instead of per inspection', () => {
+  const reportEntity = read('src/database/entities/inspection-report.entity.ts');
+  const reports = read('src/inspection-reports/inspection-reports.service.ts');
+  assert.match(reportEntity, /@Index\('uq_inspection_reports_act', \['actId'\], \{ unique: true \}\)/);
+  assert.match(reportEntity, /@Index\('idx_inspection_reports_visit_id', \['visitId'\]\)/);
+  assert.doesNotMatch(reportEntity, /visitId'\], \{ unique: true \}/);
+  assert.match(reports, /WHERE act_id = \$1/);
+});
+
+test('F1.1 closes an act without closing its parent inspection', () => {
+  const closing = read('src/inspection-closing/inspection-closing.service.ts');
+  const closeBody = closing.slice(closing.indexOf('  async close('), closing.indexOf('  async signatureContent('));
+  assert.match(closeBody, /UPDATE inspection_acts/);
+  assert.doesNotMatch(closeBody, /UPDATE inspection_visits/);
+  assert.match(closeBody, /visitRemainsIndependent: true/);
+  assert.match(closeBody, /ensureFrozenReport\(manager, actId, principal, request\)/);
+});
+
+test('F1.1 exposes an APK-only explicit inspection close and permits pending company signature', () => {
+  const controller = read('src/inspection-visits/inspection-visits.controller.ts');
+  const visits = read('src/inspection-visits/inspection-visits.service.ts');
+  assert.match(controller, /@Post\(':id\/close'\)/);
+  assert.match(controller, /@RequirePermissions\('inspections\.execute'\)/);
+  assert.match(visits, /async close\(/);
+  assert.match(visits, /assertMobileInspector\(principal\)/);
+  assert.match(visits, /INSPECTION_VISIT_DRAFT_ACTS_PENDING/);
+  assert.match(visits, /INSPECTION_VISIT_INSPECTOR_SIGNATURE_PENDING/);
+  assert.match(visits, /pendingCompanySignatures/);
+  assert.match(visits, /actsMayCompleteCompanySignatureLater: true/);
+});
+
+test('F1.1 lets the company sign after the inspection closes and records conformity or dissent', () => {
+  const closing = read('src/inspection-closing/inspection-closing.service.ts');
+  const dto = read('src/inspection-closing/dto/create-company-signature.dto.ts');
+  const signatureEntity = read('src/database/entities/inspection-act-signature.entity.ts');
+  assert.match(closing, /InspectionVisitStatus\.IN_PROGRESS, InspectionVisitStatus\.CLOSED/);
+  assert.match(closing, /InspectionCompanySignatureManifestation\.CONFORMITY/);
+  assert.match(closing, /InspectionCompanySignatureManifestation\.DISSENT/);
+  assert.match(dto, /@ValidateIf/);
+  assert.match(dto, /@MinLength\(10\)/);
+  assert.match(signatureEntity, /CONFORMITY = 'CONFORMITY'/);
+  assert.match(signatureEntity, /DISSENT = 'DISSENT'/);
+  assert.match(signatureEntity, /companyStatement/);
+});
+
+test('F1.1 keeps field-created Inventory linked only to the current draft act', () => {
+  const link = read('src/inspection-operations/field-discovery-inspection-link.service.ts');
+  assert.match(link, /AND status = 'DRAFT'/);
+  assert.match(link, /if \(act\)/);
+  assert.match(link, /inspection_visit_assets/);
+  assert.match(link, /inspection_act_assets/);
+  assert.match(link, /return \{ actId: act\?\.id \?\? null \}/);
+  assert.doesNotMatch(link, /status <> 'CANCELLED'/);
+});

api-v3/test/unit/phase-f1-2-act-administration.test.ts

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { validate } from 'class-validator';
+import { plainToInstance } from 'class-transformer';
+import { SetActResponseDeadlineDto } from '../../src/act-administration/dto/set-act-response-deadline.dto';
+import { CreateActCompanyResponseDto } from '../../src/act-administration/dto/create-act-company-response.dto';
+
+const source = (path: string) => readFileSync(resolve(process.cwd(), path), 'utf8');
+const migration = source('src/database/migrations/1789581600000-phase-f1-2-act-administration.ts');
+const service = source('src/act-administration/act-administration.service.ts');
+const controller = source('src/act-administration/act-administration.controller.ts');
+
+test('F1.2 stores one append-only administrative deadline ledger per Act', () => {
+  assert.match(migration, /inspection_act_deadline_events/);
+  assert.match(migration, /append_only/);
+  assert.match(service, /ACT_RESPONSE_DEADLINE_SET/);
+});
+
+test('F1.2 preserves ambiguous historical finding deadlines instead of collapsing them', () => {
+  assert.match(migration, /HAVING COUNT\(DISTINCT correction_due_on\) = 1/);
+});
+
+test('F1.2 stores company responses and protected PDF metadata at Act level', () => {
+  assert.match(migration, /inspection_act_company_responses/);
+  assert.match(service, /%PDF-/);
+  assert.match(controller, /inspection-acts\/:actId\/administration/);
+});
+
+test('F1.2 deadline and company response DTOs reject invalid office input', async () => {
+  const deadline = plainToInstance(SetActResponseDeadlineDto, { responseDueOn: 'bad', reason: 'x' });
+  assert.ok((await validate(deadline)).length >= 2);
+  const response = plainToInstance(CreateActCompanyResponseDto, { receivedOn: 'bad', contactEmail: 'bad' });
+  assert.ok((await validate(response)).length >= 2);
+});
+
+test('F1.2 derives administrative queues from Acts instead of replacing finding history', () => {
+  assert.match(service, /WAITING_RESPONSE/);
+  assert.match(service, /COMMITMENT_OVERDUE/);
+  assert.match(service, /inspection_findings/);
+});

api-v3/test/unit/phase-f1-3-field-briefing.test.ts

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { test } from 'node:test';
+
+const service = readFileSync('src/act-administration/field-briefing.service.ts', 'utf8');
+const controller = readFileSync('src/act-administration/field-briefing.controller.ts', 'utf8');
+const moduleSource = readFileSync('src/act-administration/act-administration.module.ts', 'utf8');
+
+test('F1.3 agrupa pendientes de campo por Acta y Hallazgo', () => {
+  assert.match(service, /inspection_act_deadline_events/);
+  assert.match(service, /inspection_act_company_responses/);
+  assert.match(service, /source_visit\.operational_area_id = \$2::uuid/);
+  assert.match(service, /source_visit\.operator_company_id = \$3::uuid/);
+  assert.match(service, /ACT_RESPONSE_OVERDUE/);
+  assert.match(service, /COMPANY_COMMITMENT_OVERDUE/);
+  assert.match(service, /VERIFICATION_PENDING/);
+  assert.match(service, /findings: \[\]/);
+});
+
+test('F1.3 expone el briefing para una inspección planificada', () => {
+  assert.match(controller, /inspection-visits\/:visitId\/field-briefing/);
+  assert.match(controller, /RequirePermissions\('inspections\.read'\)/);
+  assert.match(moduleSource, /FieldBriefingController/);
+  assert.match(moduleSource, /FieldBriefingService/);
+});
+
+test('F1.3 no usa el plazo del Hallazgo como plazo administrativo', () => {
+  assert.doesNotMatch(service, /correction_due_on/);
+  assert.match(service, /deadline\.response_due_on/);
+});

docs/f1-3-planning-scope.md

@@ -0,0 +1,11 @@
+# F1.3 · Planificación inteligente de pendientes
+
+Objetivo: al planificar una inspección para un Área/Yacimiento + Operadora, generar un paquete de campo con pendientes administrativos y operativos provenientes de Actas anteriores del mismo contexto.
+
+Reglas:
+- La unidad administrativa es el Acta.
+- Los hallazgos se muestran dentro de su Acta de origen.
+- El checklist de planificación incluye Actas con respuesta vencida o por vencer, respuestas de empresa con fecha comprometida de regularización, y hallazgos con control/verificación pendiente.
+- El inspector puede ver antecedentes antes de salir y en la APK.
+- La planificación no modifica ni cierra Actas/hallazgos previos.
+- La verificación en campo se registra append-only.

scripts/deploy-github.sh

@@ -16,6 +16,7 @@ PREV_SHA=""
 TARGET_SHA=""
 EXPECTED_API_VERSION=""
 EXPECTED_WEB_VERSION=""
+APP_TOUCHED=0
 
 cd "$APP"
 export GIT_SSH_COMMAND="ssh -i $KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
@@ -52,6 +53,7 @@ publish_status() {
     echo "current_sha=$current"
     echo "api_version=${EXPECTED_API_VERSION:-unknown}"
     echo "web_version=${EXPECTED_WEB_VERSION:-unknown}"
+    echo "app_touched=$APP_TOUCHED"
     echo "backup=${BACKUP:-unknown}"
   } > "$status_file"
 
@@ -90,21 +92,32 @@ rollback() {
   echo "============================================================"
 
   cd "$APP"
-  if [ -n "${PREV_SHA:-}" ]; then
+  if [ "$APP_TOUCHED" -eq 1 ] && [ -n "${PREV_SHA:-}" ]; then
+    echo "Restaurando aplicación al commit previo: $PREV_SHA"
     git reset --hard "$PREV_SHA" || true
     docker compose build api web </dev/null || true
     docker compose up -d --no-deps --force-recreate api web </dev/null || true
+  else
+    echo "El candidato falló antes de modificar producción; no se reconstruye ni reinicia la aplicación activa."
   fi
 
   echo
-  echo "Estado tras rollback:"
+  echo "Estado actual:"
   docker compose ps -a </dev/null || true
+
+  if [ "$APP_TOUCHED" -eq 1 ]; then
+    echo
+    echo "Últimos logs:"
+    docker compose logs --tail=160 api web </dev/null || true
+  fi
+
   echo
-  echo "Últimos logs:"
-  docker compose logs --tail=160 api web </dev/null || true
-  echo
-  echo "Backup PRE disponible en: $BACKUP"
-  echo "Las migraciones son forward-only; database-before.dump queda disponible para restauración manual si hiciera falta."
+  if [ -d "$BACKUP" ]; then
+    echo "Backup PRE disponible en: $BACKUP"
+    echo "Las migraciones son forward-only; database-before.dump queda disponible para restauración manual si hiciera falta."
+  else
+    echo "No fue necesario crear backup PRE: el fallo ocurrió durante el preflight del candidato, antes de tocar producción."
+  fi
   exit "$rc"
 }
 trap rollback ERR
@@ -119,8 +132,9 @@ for cmd in git docker curl tar node; do
 done
 [ -f "$KEY" ] || { echo "ERROR: falta deploy key $KEY"; false; }
 [ -d .git ] || { echo "ERROR: $APP no es repositorio Git"; false; }
+[ -f .env ] || { echo "ERROR: falta $APP/.env"; false; }
 
-git config --global --add safe.directory "$APP" >/dev/null 2>&1 || true
+git config --global --get-all safe.directory 2>/dev/null | grep -Fxq "$APP" || git config --global --add safe.directory "$APP"
 
 if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
   echo "ERROR: hay cambios locales versionados en producción."
@@ -148,7 +162,7 @@ if ! git merge-base --is-ancestor "$PREV_SHA" "$TARGET_SHA"; then
 fi
 
 PHASE="candidate-preflight"
-mkdir -p "$STAGE"
+rm -rf "$STAGE"
 git worktree add --detach "$STAGE" "$TARGET_SHA" >/dev/null
 
 EXPECTED_API_VERSION="$(node -p "require('$STAGE/api-v3/package.json').version")"
@@ -204,6 +218,7 @@ PHASE="fast-forward"
 echo
 echo "========== FAST-FORWARD =========="
 git log --oneline --no-decorate "$PREV_SHA..$TARGET_SHA"
+APP_TOUCHED=1
 git merge --ff-only "origin/$DEPLOY_REF"
 
 PHASE="build"

web-v2/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dhv2-web",
-  "version": "0.19.6-4",
+  "version": "0.20.0-2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dhv2-web",
-      "version": "0.19.6-4",
+      "version": "0.20.0-2",
       "dependencies": {
         "maplibre-gl": "^6.0.0",
         "react": "^19.0.0",

web-v2/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dhv2-web",
-  "version": "0.19.6-4",
+  "version": "0.20.0-4",
   "private": true,
   "type": "module",
   "engines": {

web-v2/src/app/App.tsx

@@ -32,6 +32,9 @@ import { ActsPage } from '../pages/ActsPage';
 import { ReportsPage } from '../pages/ReportsPage';
 import { ReportDetailPage } from '../pages/ReportDetailPage';
 import { VerificationPlanningPage } from '../pages/VerificationPlanningPage';
+import { ActAdministrationPage } from '../pages/ActAdministrationPage';
+import { ActAdministrationDetailPage } from '../pages/ActAdministrationDetailPage';
+import { FieldBriefingsPage } from '../pages/FieldBriefingsPage';
 
 const MapPage = lazy(() => import('../pages/MapPage').then((module) => ({ default: module.MapPage })));
 
@@ -63,6 +66,7 @@ export function App() {
         <Route element={<PermissionRoute permission="inspections.read" />}>
           <Route path="/inspecciones" element={<InspectionVisitsPage />} />
           <Route path="/inspecciones/:id" element={<InspectionVisitEditorPage />} />
+          <Route path="/preparacion-campo" element={<FieldBriefingsPage />} />
         </Route>
         <Route element={<PermissionRoute permission="inspections.manage" />}><Route path="/inspecciones/nueva" element={<InspectionVisitEditorPage />} /></Route>
         <Route element={<PermissionRoute permission="inspection_acts.read" />}>
@@ -71,7 +75,7 @@ export function App() {
         </Route>
         <Route element={<PermissionRoute permission="inspection_findings.read" />}><Route path="/hallazgos" element={<FindingsPage />} /><Route path="/hallazgos/:id" element={<FindingDetailPage />} /></Route>
         <Route element={<PermissionRoute permission="inspection_verifications.plan" />}><Route path="/hallazgos/planificacion" element={<VerificationPlanningPage />} /></Route>
-        <Route element={<PermissionRoute permission="inspection_acts.read" />}><Route path="/actas" element={<ActsPage />} /></Route>
+        <Route element={<PermissionRoute permission="inspection_acts.read" />}><Route path="/actas" element={<ActsPage />} /><Route path="/seguimiento-actas" element={<ActAdministrationPage />} /><Route path="/seguimiento-actas/:actId" element={<ActAdministrationDetailPage />} /></Route>
         <Route element={<PermissionRoute permission="inspection_reports.read" />}><Route path="/informes" element={<ReportsPage />} /><Route path="/informes/:id" element={<ReportDetailPage />} /></Route>
         <Route element={<PermissionRoute permission="assets.read_history" />}><Route path="/historial" element={<HistoryPage />} /></Route>
         <Route element={<PermissionRoute permission="assets.read_temporal" />}><Route path="/consulta-temporal" element={<TemporalAssetsPage />} /></Route>

web-v2/src/config/version.ts

@@ -1,2 +1,2 @@
-export const APP_VERSION = '0.19.6-4';
-export const APP_PHASE = 'Fase D5.6.4 · Inspecciones simples y combobox buscables';
+export const APP_VERSION = '0.20.0-4';
+export const APP_PHASE = 'Fase F1.4 · Briefing contextual antes de salir';

web-v2/src/features/inspections/FieldBriefingPanel.tsx

@@ -0,0 +1,97 @@
+import { useEffect, useState } from 'react';
+import { Link } from 'react-router';
+import { Alert, EmptyState, LoadingBlock, errorMessage } from '../../components/Feedback';
+import { Icon } from '../../components/Icon';
+import type { InspectionVisit } from '../../lib/api';
+import { formatDate, formatDateOnly } from '../../lib/format';
+import {
+  getInspectionFieldBriefing,
+  type FieldBriefing,
+  type FieldBriefingActState,
+} from './fieldBriefingApi';
+
+function stateLabel(state: FieldBriefingActState): string {
+  if (state === 'ACT_RESPONSE_OVERDUE') return 'Respuesta del Acta vencida';
+  if (state === 'ACT_RESPONSE_DUE_SOON') return 'Respuesta próxima a vencer';
+  if (state === 'COMPANY_COMMITMENT_OVERDUE') return 'Compromiso de empresa vencido';
+  if (state === 'VERIFICATION_PENDING') return 'Verificación pendiente';
+  if (state === 'RESPONSE_RECEIVED') return 'Respuesta recibida';
+  return 'Esperando respuesta';
+}
+
+function stateClass(state: FieldBriefingActState): string {
+  if (state === 'ACT_RESPONSE_OVERDUE' || state === 'COMPANY_COMMITMENT_OVERDUE') return 'danger';
+  if (state === 'ACT_RESPONSE_DUE_SOON' || state === 'VERIFICATION_PENDING') return 'warning';
+  return 'pending';
+}
+
+export function FieldBriefingPanel({ visit }: { visit: InspectionVisit }) {
+  const [briefing, setBriefing] = useState<FieldBriefing | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState('');
+
+  useEffect(() => {
+    let active = true;
+    setLoading(true);
+    setError('');
+    getInspectionFieldBriefing(visit.id)
+      .then((value) => { if (active) setBriefing(value); })
+      .catch((requestError) => { if (active) setError(errorMessage(requestError)); })
+      .finally(() => { if (active) setLoading(false); });
+    return () => { active = false; };
+  }, [visit.id, visit.updatedAt]);
+
+  return <section className="panel inspection-checklist-panel">
+    <div className="panel-heading">
+      <div>
+        <span className="eyebrow">ANTES DE CONFIRMAR LA SALIDA</span>
+        <h2>Pendientes para revisar en campo</h2>
+        <p className="section-copy">Actas anteriores del mismo Área y Operadora que requieren atención durante esta inspección. El plazo administrativo pertenece al Acta y los hallazgos se mantienen dentro de su expediente de origen.</p>
+      </div>
+      <div className="form-actions">
+        <Link className="button secondary" to="/preparacion-campo"><Icon name="clipboard" />Vista imprimible</Link>
+      </div>
+    </div>
+
+    {error && <Alert>{error}</Alert>}
+    {loading ? <LoadingBlock label="Preparando pendientes de campo…" /> : briefing && <>
+      <div className="inspection-checklist-metrics">
+        <div><strong>{briefing.summary.acts}</strong><span>actas con pendientes</span></div>
+        <div><strong>{briefing.summary.findings}</strong><span>hallazgos a revisar</span></div>
+        <div><strong>{briefing.summary.inventoryItems}</strong><span>registros involucrados</span></div>
+        <div><strong>{briefing.summary.responseOverdue}</strong><span>respuestas vencidas</span></div>
+        <div><strong>{briefing.summary.commitmentOverdue}</strong><span>compromisos vencidos</span></div>
+        <div><strong>{briefing.summary.verificationPending}</strong><span>verificaciones pendientes</span></div>
+      </div>
+
+      <div className="temporal-notice">
+        <Icon name="clipboard" />
+        <p><strong>Contexto de salida:</strong> {briefing.inspection.area?.name ?? 'Área sin definir'} · {briefing.inspection.operatorCompany?.name ?? 'Operadora sin definir'} · {formatDateOnly(briefing.plannedOn)}.</p>
+      </div>
+
+      {briefing.acts.length === 0
+        ? <EmptyState title="Sin pendientes anteriores" text="No hay Actas anteriores con acciones de campo pendientes para este Área y Operadora." />
+        : <div>{briefing.acts.map((act) => <div className="table-panel" key={act.actId}>
+            <div className="table-summary">
+              <div><strong>{act.actCode}</strong><span>{formatDate(act.occurredAt)} · {act.findings.length} hallazgo{act.findings.length === 1 ? '' : 's'}</span></div>
+              <span className={`status-badge ${stateClass(act.adminState)}`}>{stateLabel(act.adminState)}</span>
+            </div>
+            <div className="table-scroll"><table>
+              <thead><tr><th>Hallazgo</th><th>Inventario</th><th>Gravedad</th><th>Control</th><th /></tr></thead>
+              <tbody>{act.findings.map((finding) => <tr key={finding.id}>
+                <td><Link className="history-asset-link" to={`/hallazgos/${finding.id}`}><strong>{finding.title}</strong><small>{finding.code} · {finding.status}</small></Link></td>
+                <td><Link className="history-asset-link" to={`/inventarios/${finding.asset.id}`}><strong>{finding.asset.name}</strong><small>{finding.asset.code} · {finding.asset.typeName}</small></Link></td>
+                <td>{finding.severity ?? '—'}</td>
+                <td>{finding.nextControlOn ? formatDateOnly(finding.nextControlOn) : 'A definir'}</td>
+                <td className="action-cell"><Link className="button secondary compact" to={`/seguimiento-actas/${act.actId}`}>Ver Acta</Link></td>
+              </tr>)}</tbody>
+            </table></div>
+            <div className="table-summary">
+              <span>Plazo empresa: <strong>{act.responseDueOn ? formatDateOnly(act.responseDueOn) : 'sin definir'}</strong></span>
+              <span>Respuesta: <strong>{act.responseReceivedOn ? formatDateOnly(act.responseReceivedOn) : 'pendiente'}</strong></span>
+              <span>Compromiso: <strong>{act.committedCorrectionOn ? formatDateOnly(act.committedCorrectionOn) : '—'}</strong></span>
+            </div>
+          </div>)}</div>}
+    </>}
+  </section>;
+}

web-v2/src/features/inspections/InspectionActsPanel.tsx

@@ -6,6 +6,7 @@ import { Icon } from '../../components/Icon';
 import { listInspectionActs } from '../../lib/api';
 import type { InspectionActListItem, InspectionVisit } from '../../lib/api';
 import { formatDate } from '../../lib/format';
+import { FieldBriefingPanel } from './FieldBriefingPanel';
 import { inspectionActStatusClass, inspectionActStatusLabel } from './inspectionActPresentation';
 
 export function InspectionActsPanel({ visit }: { visit: InspectionVisit }) {
@@ -25,17 +26,18 @@ export function InspectionActsPanel({ visit }: { visit: InspectionVisit }) {
       .finally(() => setLoading(false));
   }, [canRead, visit.id]);
 
-  if (!canRead) return null;
-
-  return <section className="inspection-acts-panel">
-    <div className="panel-heading">
-      <div><span className="eyebrow">ACTA DE LA VISITA</span><h2>Acta única</h2><p className="section-copy">Cada visita genera una única acta, con numeración anual oficial y versiones inmutables.</p></div>
-      <span className="status-badge pending">Sólo lectura</span>
-    </div>
-    <div className="temporal-notice"><Icon name="clipboard" /><p><strong>El acta se crea en la APK.</strong> El dashboard permite consultar el acta, sus hallazgos, firmas e informe después de la sincronización.</p></div>
-    {error && <Alert>{error}</Alert>}
-    {loading ? <LoadingBlock label="Cargando actas…" /> : acts.length === 0
-      ? <EmptyState title="Sin acta sincronizada" text={visit.status === 'IN_PROGRESS' ? 'El inspector debe crearla desde la APK.' : 'Aparecerá aquí cuando el inspector la genere desde la APK.'} />
-      : <div className="table-panel inspection-acts-table"><div className="table-summary"><strong>Acta de inspección</strong><span>Numeración oficial global por año</span></div><div className="table-scroll"><table><thead><tr><th>Acta</th><th>Estado</th><th>Fecha</th><th>Registros</th><th>Hallazgos</th><th>Versión</th><th /></tr></thead><tbody>{acts.map((act) => <tr key={act.id}><td><div className="asset-cell"><span className="asset-symbol"><Icon name="clipboard" size={17} /></span><div><strong>{act.title}</strong><small>{act.code}</small></div></div></td><td><span className={`status-badge ${inspectionActStatusClass(act.status)}`}>{inspectionActStatusLabel(act.status)}</span></td><td>{formatDate(act.occurredAt)}</td><td>{act.assetCount}</td><td>{act.findingCount}</td><td>v{act.currentVersion}</td><td className="action-cell"><Link className="icon-button" to={`/inspecciones/actas/${act.id}`} aria-label={`Abrir ${act.code}`}><Icon name="chevron" /></Link></td></tr>)}</tbody></table></div></div>}
-  </section>;
+  return <>
+    <FieldBriefingPanel visit={visit} />
+    {canRead && <section className="inspection-acts-panel">
+      <div className="panel-heading">
+        <div><span className="eyebrow">ACTAS DE LA INSPECCIÓN</span><h2>Actas generadas</h2><p className="section-copy">Una inspección puede generar múltiples actas. Cada acta agrupa sus propios hallazgos y tendrá un único informe.</p></div>
+        <span className="status-badge pending">Sólo lectura</span>
+      </div>
+      <div className="temporal-notice"><Icon name="clipboard" /><p><strong>Las actas se crean en la APK.</strong> El dashboard permite consultar cada acta, sus hallazgos, firmas e informe después de la sincronización.</p></div>
+      {error && <Alert>{error}</Alert>}
+      {loading ? <LoadingBlock label="Cargando actas…" /> : acts.length === 0
+        ? <EmptyState title="Sin actas sincronizadas" text={visit.status === 'IN_PROGRESS' ? 'El inspector puede crear la primera acta desde la APK.' : 'Aparecerán aquí a medida que el inspector genere actas desde la APK.'} />
+        : <div className="table-panel inspection-acts-table"><div className="table-summary"><strong>Actas de la inspección</strong><span>Numeración oficial global por año</span></div><div className="table-scroll"><table><thead><tr><th>Acta</th><th>Estado</th><th>Fecha</th><th>Registros</th><th>Hallazgos</th><th>Versión</th><th /></tr></thead><tbody>{acts.map((act) => <tr key={act.id}><td><div className="asset-cell"><span className="asset-symbol"><Icon name="clipboard" size={17} /></span><div><strong>{act.title}</strong><small>{act.code}</small></div></div></td><td><span className={`status-badge ${inspectionActStatusClass(act.status)}`}>{inspectionActStatusLabel(act.status)}</span></td><td>{formatDate(act.occurredAt)}</td><td>{act.assetCount}</td><td>{act.findingCount}</td><td>v{act.currentVersion}</td><td className="action-cell"><Link className="icon-button" to={`/inspecciones/actas/${act.id}`} aria-label={`Abrir ${act.code}`}><Icon name="chevron" /></Link></td></tr>)}</tbody></table></div></div>}
+    </section>}
+  </>;
 }

web-v2/src/features/inspections/InspectionClosurePanel.tsx

@@ -62,7 +62,7 @@ export function InspectionClosurePanel({ act }: { act: InspectionAct }) {
   const constanciasCompletas = inspectorSignatures.length > 0 && Boolean(companyOutcome);
 
   return <section className="panel inspection-closure-panel">
-    <div className="panel-heading"><div><span className="eyebrow">CIERRE DE LA INSPECCIÓN · SÓLO LECTURA</span><h2>Responsable, firmas y sellado</h2><p className="section-copy">La preparación, las firmas y el cierre son operaciones exclusivas de la APK para inspectores.</p></div><span className={`status-badge large ${act.status === 'CLOSED' ? 'active' : act.status === 'READY' ? 'observed' : 'pending'}`}>{act.status === 'CLOSED' ? 'Cierre sellado' : act.status === 'READY' ? 'Esperando firmas' : 'Pendiente en APK'}</span></div>
+    <div className="panel-heading"><div><span className="eyebrow">CIERRE DEL ACTA · SÓLO LECTURA</span><h2>Responsable, firmas y sellado</h2><p className="section-copy">La preparación y firma del acta se realizan desde la APK. La inspección puede continuar con otras actas.</p></div><span className={`status-badge large ${act.status === 'CLOSED' ? 'active' : act.status === 'READY' ? 'observed' : 'pending'}`}>{act.status === 'CLOSED' ? 'Cierre sellado' : act.status === 'READY' ? 'Esperando firmas' : 'Pendiente en APK'}</span></div>
 
     {error && <Alert>{error}</Alert>}
     <div className="temporal-notice"><Icon name="clipboard" /><p><strong>Operación exclusiva en APK.</strong> El dashboard muestra las constancias sincronizadas, pero no permite identificar al responsable, firmar, reabrir ni cerrar el acta.</p></div>
@@ -78,8 +78,8 @@ export function InspectionClosurePanel({ act }: { act: InspectionAct }) {
 
     {closure.closure?.isCurrent && <div className="closure-hash-card"><div><span className="eyebrow">CONTENIDO CONGELADO</span><strong>{closure.closure.schemaVersion}</strong><small>Preparado {formatDate(closure.closure.preparedAt)}</small></div><code>{closure.closure.preparedSha256}</code></div>}
 
-    {closure.signatures.length > 0 && <div className="signature-records">{closure.signatures.map((signature) => <article key={signature.id}><div><span className={`status-badge ${signature.status === 'SIGNED' ? 'active' : 'observed'}`}>{signatureStatusLabel(signature.status)}</span><strong>{signature.signerName}</strong><small>{signerTypeLabel(signature.signerType)} · {formatDate(signature.createdAt)}</small></div><code title={signature.signaturePayloadSha256}>{signature.signaturePayloadSha256}</code>{signature.status === 'SIGNED' ? <button type="button" className="button secondary" onClick={() => viewSignature(signature)}>Ver firma</button> : <p>{signature.reason}</p>}</article>)}</div>}
+    {closure.signatures.length > 0 && <div className="signature-records">{closure.signatures.map((signature) => <article key={signature.id}><div><span className={`status-badge ${signature.status === 'SIGNED' ? 'active' : 'observed'}`}>{signatureStatusLabel(signature.status)}</span><strong>{signature.signerName}</strong><small>{signerTypeLabel(signature.signerType)} · {formatDate(signature.createdAt)}</small></div><code title={signature.signaturePayloadSha256}>{signature.signaturePayloadSha256}</code>{signature.status === 'SIGNED' ? <><button type="button" className="button secondary" onClick={() => viewSignature(signature)}>Ver firma</button>{signature.signerType === 'COMPANY_RESPONSIBLE' && <p><strong>{signature.companyManifestation === 'DISSENT' ? 'Firma en disidencia' : 'Firma en conformidad'}</strong>{signature.companyStatement ? ` · ${signature.companyStatement}` : ''}</p>}</> : <p>{signature.reason}</p>}</article>)}</div>}
 
-    {act.status === 'CLOSED' && closure.closure?.finalSha256 && <div className="closed-seal"><Icon name="check" /><div><span className="eyebrow">ACTA Y VISITA CERRADAS</span><strong>{formatDate(closure.closure.serverClosedAt)}</strong><p>Los hallazgos continúan abiertos para la respuesta de la empresa y el próximo control.</p><code>{closure.closure.finalSha256}</code></div></div>}
+    {act.status === 'CLOSED' && closure.closure?.finalSha256 && <div className="closed-seal"><Icon name="check" /><div><span className="eyebrow">ACTA CERRADA</span><strong>{formatDate(closure.closure.serverClosedAt)}</strong><p>El acta quedó sellada. La inspección y las demás actas tienen un ciclo independiente.</p><code>{closure.closure.finalSha256}</code></div></div>}
   </section>;
 }

web-v2/src/features/inspections/fieldBriefingApi.ts

@@ -0,0 +1,56 @@
+import { apiRequest } from '../../lib/api';
+
+export type FieldBriefingActState =
+  | 'ACT_RESPONSE_OVERDUE'
+  | 'ACT_RESPONSE_DUE_SOON'
+  | 'WAITING_RESPONSE'
+  | 'COMPANY_COMMITMENT_OVERDUE'
+  | 'VERIFICATION_PENDING'
+  | 'RESPONSE_RECEIVED';
+
+export interface FieldBriefingFinding {
+  id: string;
+  code: string;
+  title: string;
+  status: string;
+  severity: number | null;
+  nextControlOn: string | null;
+  asset: { id: string; code: string; name: string; typeName: string };
+}
+
+export interface FieldBriefingAct {
+  actId: string;
+  actCode: string;
+  occurredAt: string;
+  adminState: FieldBriefingActState;
+  responseDueOn: string | null;
+  responseReceivedOn: string | null;
+  committedCorrectionOn: string | null;
+  latestResponseId: string | null;
+  findings: FieldBriefingFinding[];
+}
+
+export interface FieldBriefing {
+  inspection: {
+    id: string;
+    code: string;
+    status: string;
+    plannedStartAt: string | null;
+    area: { id: string; code: string; name: string } | null;
+    operatorCompany: { id: string; code: string; name: string } | null;
+  };
+  plannedOn: string;
+  summary: {
+    acts: number;
+    findings: number;
+    inventoryItems: number;
+    responseOverdue: number;
+    commitmentOverdue: number;
+    verificationPending: number;
+  };
+  acts: FieldBriefingAct[];
+}
+
+export function getInspectionFieldBriefing(visitId: string) {
+  return apiRequest<FieldBriefing>(`/inspection-visits/${visitId}/field-briefing`);
+}

web-v2/src/layout/AppLayout.tsx

@@ -16,9 +16,11 @@ interface NavItem {
 const operational: NavItem[] = [
   { to: '/', label: 'Inicio', icon: 'home', permission: 'dashboard.read' },
   { to: '/inspecciones', label: 'Inspecciones', icon: 'clipboard', permission: 'inspections.read' },
+  { to: '/preparacion-campo', label: 'Preparación de campo', icon: 'clipboard', permission: 'inspections.read' },
 ];
 
 const followUp: NavItem[] = [
+  { to: '/seguimiento-actas', label: 'Seguimiento de actas', icon: 'clipboard', permission: 'inspection_acts.read' },
   { to: '/hallazgos', label: 'Hallazgos', icon: 'alert', permission: 'inspection_findings.read' },
 ];
 

web-v2/src/lib/api.ts

@@ -1129,6 +1129,8 @@ export interface InspectionActSignature {
   position: string | null;
   status: InspectionActSignatureStatus;
   reason: string | null;
+  companyManifestation: 'CONFORMITY' | 'DISSENT' | null;
+  companyStatement: string | null;
   mimeType: string | null;
   sizeBytes: number | null;
   imageSha256: string | null;
@@ -3094,3 +3096,36 @@ export function updateDocumentDeliverySettings(input:{officeEmail?:string|null;d
 export function listDocumentDeliveries(){return apiRequest<{data:DocumentDeliveryItem[]}>('/document-delivery/outbox');}
 export function retryDocumentDelivery(id:string){return apiRequest<DocumentDeliveryItem>(`/document-delivery/outbox/${id}/retry`,{method:'POST'});}
 export function retryPendingDocumentDeliveries(){return apiRequest<{processed:number}>('/document-delivery/outbox/retry-pending',{method:'POST'});}
+
+export type ActAdministrationState = 'NEW' | 'WAITING_RESPONSE' | 'DUE_SOON' | 'OVERDUE' | 'RESPONSE_RECEIVED' | 'VERIFICATION_PENDING' | 'COMMITMENT_OVERDUE' | 'REGULARIZED';
+export interface ActAdministrationQueueItem {
+  actId: string; actCode: string; actStatus: string; occurredAt: string; closedAt: string | null;
+  visitId: string; visitCode: string; areaId: string | null; companyId: string | null; areaName: string | null; companyName: string | null;
+  responseDueOn: string | null; deadlineReason: string | null; responseReceivedOn: string | null; committedCorrectionOn: string | null;
+  findingCount: number; openFindingCount: number; scheduledControlCount: number; adminState: ActAdministrationState;
+}
+export interface ActAdministrationQueuePage { data: ActAdministrationQueueItem[]; counters: Partial<Record<ActAdministrationState, number>>; meta: PageMeta }
+export interface ActAdministrationDetail {
+  act: ActAdministrationQueueItem;
+  deadlines: Array<{ id:string; responseDueOn:string; reason:string; createdAt:string }>;
+  responses: Array<{ id:string; receivedOn:string; details:string|null; committedCorrectionOn:string|null; contactName:string|null; contactEmail:string|null; originalName:string|null; sizeBytes:number|null; sha256:string|null; createdAt:string }>;
+  findings: Array<{ id:string; code:string; title:string; status:string; nextControlOn:string|null }>;
+}
+export function listActAdministrationQueue(params: { state?: ActAdministrationState | 'ALL'; areaId?: string; companyId?: string; page?: number; pageSize?: number } = {}) {
+  const q = new URLSearchParams({ page: String(params.page ?? 1), pageSize: String(params.pageSize ?? 25) });
+  if (params.state && params.state !== 'ALL') q.set('state', params.state);
+  if (params.areaId) q.set('areaId', params.areaId);
+  if (params.companyId) q.set('companyId', params.companyId);
+  return apiRequest<ActAdministrationQueuePage>(`/act-administration/queue?${q}`);
+}
+export function getActAdministration(actId: string) { return apiRequest<ActAdministrationDetail>(`/inspection-acts/${actId}/administration`); }
+export function setActResponseDeadline(actId: string, input: { responseDueOn: string; reason: string }) { return apiRequest(`/inspection-acts/${actId}/administration/deadline`, { method: 'PATCH', body: JSON.stringify(input) }); }
+export function addActCompanyResponse(actId: string, input: { receivedOn: string; details?: string; committedCorrectionOn?: string; contactName?: string; contactEmail?: string; file?: File }) {
+  const body = new FormData(); body.append('receivedOn', input.receivedOn);
+  if (input.details) body.append('details', input.details); if (input.committedCorrectionOn) body.append('committedCorrectionOn', input.committedCorrectionOn);
+  if (input.contactName) body.append('contactName', input.contactName); if (input.contactEmail) body.append('contactEmail', input.contactEmail); if (input.file) body.append('file', input.file);
+  return apiRequest(`/inspection-acts/${actId}/administration/responses`, { method: 'POST', body });
+}
+export function actCompanyResponseContentUrl(responseId: string) { return `${API_BASE}/act-company-responses/${responseId}/content`; }
+export function listActAdministrationCalendar(from?: string, to?: string) { const q=new URLSearchParams(); if(from)q.set('from',from); if(to)q.set('to',to); return apiRequest<{from:string;to:string;data:Array<{type:'RESPONSE_DUE'|'COMMITMENT_DUE';date:string;actId:string;actCode:string;areaName:string|null;companyName:string|null;state:ActAdministrationState}>}>(`/act-administration/calendar${q.size?`?${q}`:''}`); }
+

web-v2/src/lib/format.ts

@@ -76,7 +76,7 @@ const actions: Record<string, string> = {
   INSPECTION_ACT_REOPENED: 'Acta devuelta a borrador',
   INSPECTION_ACT_SIGNATURE_RECORDED: 'Firma manuscrita incorporada al acta',
   INSPECTION_ACT_COMPANY_OUTCOME_RECORDED: 'Resultado de recepción empresarial registrado',
-  INSPECTION_ACT_CLOSED: 'Acta y visita cerradas',
+  INSPECTION_ACT_CLOSED: 'Acta cerrada',
   INSPECTION_REPORT_GENERATED: 'Informe de inspección generado',
   INSPECTION_VERIFICATION_PLANNED: 'Visita de verificación preparada',
   INSPECTION_FINDING_CREATED: 'Hallazgo abierto',

web-v2/src/pages/ActAdministrationDetailPage.tsx

@@ -0,0 +1,20 @@
+
+import { useEffect, useState } from 'react';
+import type { FormEvent } from 'react';
+import { Link, useParams } from 'react-router';
+import { Alert, LoadingBlock, errorMessage } from '../components/Feedback';
+import { addActCompanyResponse, actCompanyResponseContentUrl, getActAdministration, setActResponseDeadline } from '../lib/api';
+import type { ActAdministrationDetail } from '../lib/api';
+import { formatDate } from '../lib/format';
+
+export function ActAdministrationDetailPage(){
+ const {actId=''}=useParams(); const [data,setData]=useState<ActAdministrationDetail|null>(null); const [error,setError]=useState(''); const [busy,setBusy]=useState(false); const [due,setDue]=useState(''); const [reason,setReason]=useState('Plazo administrativo otorgado a la empresa'); const [received,setReceived]=useState(new Date().toISOString().slice(0,10)); const [details,setDetails]=useState(''); const [commitment,setCommitment]=useState(''); const [file,setFile]=useState<File|undefined>();
+ const load=()=>getActAdministration(actId).then(setData).catch(e=>setError(errorMessage(e))); useEffect(()=>{void load()},[actId]);
+ const deadline=async(e:FormEvent)=>{e.preventDefault();setBusy(true);setError('');try{await setActResponseDeadline(actId,{responseDueOn:due,reason});setDue('');await load()}catch(err){setError(errorMessage(err))}finally{setBusy(false)}};
+ const response=async(e:FormEvent)=>{e.preventDefault();setBusy(true);setError('');try{await addActCompanyResponse(actId,{receivedOn:received,details:details||undefined,committedCorrectionOn:commitment||undefined,file});setDetails('');setCommitment('');setFile(undefined);await load()}catch(err){setError(errorMessage(err))}finally{setBusy(false)}};
+ if(!data&&!error)return <LoadingBlock label="Cargando expediente administrativo…"/>;
+ return <section>{error&&<Alert>{error}</Alert>}{data&&<><div className="page-heading"><div><span className="eyebrow">EXPEDIENTE ADMINISTRATIVO</span><h1>{data.act.actCode}</h1><p>{data.act.areaName??'Área sin asignar'} · {data.act.companyName??'Empresa sin asignar'} · {data.act.openFindingCount} hallazgos abiertos</p></div><Link className="button secondary" to={`/inspecciones/actas/${data.act.actId}`}>Ver Acta</Link></div>
+ <div className="detail-grid"><div className="card"><h2>Plazo de respuesta</h2><p>El plazo aplica al conjunto completo de hallazgos del Acta.</p><form className="form-grid" onSubmit={deadline}><label><span>Vencimiento *</span><input type="date" required value={due} onChange={e=>setDue(e.target.value)}/></label><label className="full"><span>Motivo *</span><textarea required minLength={3} value={reason} onChange={e=>setReason(e.target.value)}/></label><button className="button primary" disabled={busy}>Registrar nuevo plazo</button></form>{data.deadlines.length>0&&<div className="stack-list">{data.deadlines.map(d=><div key={d.id}><strong>{formatDate(d.responseDueOn)}</strong><small>{d.reason}</small></div>)}</div>}</div>
+ <div className="card"><h2>Respuesta de la empresa</h2><form className="form-grid" onSubmit={response}><label><span>Recibida el *</span><input type="date" required value={received} onChange={e=>setReceived(e.target.value)}/></label><label><span>Fecha comprometida</span><input type="date" value={commitment} onChange={e=>setCommitment(e.target.value)}/></label><label className="full"><span>Detalle</span><textarea value={details} onChange={e=>setDetails(e.target.value)} placeholder="Resumen de la presentación de la empresa"/></label><label className="full"><span>PDF presentado</span><input type="file" accept="application/pdf,.pdf" onChange={e=>setFile(e.target.files?.[0])}/></label><button className="button primary" disabled={busy}>Registrar respuesta</button></form>{data.responses.length>0&&<div className="stack-list">{data.responses.map(r=><div key={r.id}><strong>{formatDate(r.receivedOn)}</strong><small>{r.details??'Sin detalle'}{r.committedCorrectionOn?` · compromiso ${formatDate(r.committedCorrectionOn)}`:''}</small>{r.originalName&&<a className="text-link" href={actCompanyResponseContentUrl(r.id)} target="_blank" rel="noreferrer">Abrir PDF</a>}</div>)}</div>}</div></div>
+ <div className="card"><h2>Hallazgos del Acta</h2><div className="table-scroll"><table><thead><tr><th>Código</th><th>Hallazgo</th><th>Estado</th><th>Próximo control</th></tr></thead><tbody>{data.findings.map(f=><tr key={f.id}><td><Link className="text-link" to={`/hallazgos/${f.id}`}>{f.code}</Link></td><td>{f.title}</td><td>{f.status}</td><td>{f.nextControlOn?formatDate(f.nextControlOn):'Sin programar'}</td></tr>)}</tbody></table></div></div></>}</section>;
+}

web-v2/src/pages/ActAdministrationPage.tsx

@@ -0,0 +1,22 @@
+
+import { useEffect, useState } from 'react';
+import { Link } from 'react-router';
+import { Alert, EmptyState, LoadingBlock, errorMessage } from '../components/Feedback';
+import { useOperationalContext } from '../context/OperationalContext';
+import { listActAdministrationQueue } from '../lib/api';
+import type { ActAdministrationQueueItem, ActAdministrationState, PageMeta } from '../lib/api';
+import { formatDate } from '../lib/format';
+
+const states: Array<{value:'ALL'|ActAdministrationState;label:string}> = [
+  {value:'ALL',label:'Todas'}, {value:'NEW',label:'Nuevas'}, {value:'WAITING_RESPONSE',label:'Esperando respuesta'},
+  {value:'DUE_SOON',label:'Próximas a vencer'}, {value:'OVERDUE',label:'Vencidas'}, {value:'RESPONSE_RECEIVED',label:'Respondidas'},
+  {value:'VERIFICATION_PENDING',label:'A verificar'}, {value:'COMMITMENT_OVERDUE',label:'Compromiso vencido'}, {value:'REGULARIZED',label:'Regularizadas'},
+];
+const label=(s:ActAdministrationState)=>states.find(x=>x.value===s)?.label??s;
+export function ActAdministrationPage(){
+ const ctx=useOperationalContext(); const [state,setState]=useState<'ALL'|ActAdministrationState>('ALL'); const [items,setItems]=useState<ActAdministrationQueueItem[]>([]); const [meta,setMeta]=useState<PageMeta>({page:1,pageSize:25,total:0,totalPages:0}); const [counters,setCounters]=useState<Partial<Record<ActAdministrationState,number>>>({}); const [loading,setLoading]=useState(true); const [error,setError]=useState('');
+ useEffect(()=>{setLoading(true);setError('');listActAdministrationQueue({state,areaId:ctx.areaId||undefined,companyId:ctx.companyId||undefined,page:1,pageSize:50}).then(r=>{setItems(r.data);setMeta(r.meta);setCounters(r.counters)}).catch(e=>setError(errorMessage(e))).finally(()=>setLoading(false));},[state,ctx.areaId,ctx.companyId]);
+ return <section><div className="page-heading"><div><span className="eyebrow">SEGUIMIENTO ADMINISTRATIVO</span><h1>Seguimiento de Actas</h1><p>El plazo y la respuesta de la empresa se gestionan sobre el Acta completa. Los hallazgos quedan dentro de su expediente.</p></div></div>
+ <div className="status-tabs">{states.map(s=><button key={s.value} className={state===s.value?'active':''} onClick={()=>setState(s.value)}>{s.label}{s.value!=='ALL'&&<small>{counters[s.value]??0}</small>}</button>)}</div>
+ {error&&<Alert>{error}</Alert>}{loading?<LoadingBlock label="Cargando seguimiento…"/>:items.length===0?<EmptyState title="Sin actas" text="No hay actas en este estado para el contexto seleccionado."/>:<div className="table-panel"><div className="table-summary"><strong>{meta.total} acta{meta.total===1?'':'s'}</strong></div><div className="table-scroll"><table><thead><tr><th>Acta</th><th>Área / empresa</th><th>Hallazgos</th><th>Plazo empresa</th><th>Respuesta</th><th>Estado</th><th/></tr></thead><tbody>{items.map(a=><tr key={a.actId}><td><strong>{a.actCode}</strong><small className="block-muted">{formatDate(a.occurredAt)}</small></td><td><strong>{a.areaName??'—'}</strong><small className="block-muted">{a.companyName??'—'}</small></td><td>{a.openFindingCount} abiertos / {a.findingCount}</td><td>{a.responseDueOn?formatDate(a.responseDueOn):'Sin definir'}</td><td>{a.responseReceivedOn?formatDate(a.responseReceivedOn):'Pendiente'}</td><td><span className={`status-badge ${a.adminState==='OVERDUE'||a.adminState==='COMMITMENT_OVERDUE'?'danger':'pending'}`}>{label(a.adminState)}</span></td><td><Link className="button secondary" to={`/seguimiento-actas/${a.actId}`}>Gestionar</Link></td></tr>)}</tbody></table></div></div>}</section>;
+}

web-v2/src/pages/FieldBriefingsPage.tsx

@@ -0,0 +1,265 @@
+import { useEffect, useMemo, useState } from 'react';
+import { Link } from 'react-router';
+import { SearchableSelect } from '../components/SearchableSelect';
+import { Alert, EmptyState, LoadingBlock } from '../components/Feedback';
+import { formatDate, formatDateOnly } from '../lib/format';
+
+type AdminState =
+  | 'ACT_RESPONSE_OVERDUE'
+  | 'ACT_RESPONSE_DUE_SOON'
+  | 'WAITING_RESPONSE'
+  | 'COMPANY_COMMITMENT_OVERDUE'
+  | 'VERIFICATION_PENDING'
+  | 'RESPONSE_RECEIVED';
+
+interface VisitOption {
+  id: string;
+  code: string;
+  status: string;
+  plannedStartAt: string | null;
+  operationalArea: { name: string } | null;
+  operatorCompany: { name: string } | null;
+}
+
+interface BriefingFinding {
+  id: string;
+  code: string;
+  title: string;
+  status: string;
+  severity: number | null;
+  nextControlOn: string | null;
+  asset: {
+    id: string;
+    code: string;
+    name: string;
+    typeName: string;
+  };
+}
+
+interface BriefingAct {
+  actId: string;
+  actCode: string;
+  occurredAt: string;
+  adminState: AdminState;
+  responseDueOn: string | null;
+  responseReceivedOn: string | null;
+  committedCorrectionOn: string | null;
+  latestResponseId: string | null;
+  findings: BriefingFinding[];
+}
+
+interface FieldBriefing {
+  inspection: {
+    id: string;
+    code: string;
+    status: string;
+    plannedStartAt: string | null;
+    area: { id: string; code: string | null; name: string | null } | null;
+    operatorCompany: { id: string; code: string | null; name: string | null } | null;
+  };
+  plannedOn: string;
+  summary: {
+    acts: number;
+    findings: number;
+    inventoryItems: number;
+    responseOverdue: number;
+    commitmentOverdue: number;
+    verificationPending: number;
+  };
+  acts: BriefingAct[];
+}
+
+async function getJson<T>(url: string): Promise<T> {
+  const response = await fetch(url, {
+    credentials: 'same-origin',
+    headers: { Accept: 'application/json' },
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const message = typeof payload?.message === 'string'
+      ? payload.message
+      : 'No se pudo preparar el paquete de campo.';
+    throw new Error(message);
+  }
+  return payload as T;
+}
+
+function adminStateLabel(state: AdminState): string {
+  const labels: Record<AdminState, string> = {
+    ACT_RESPONSE_OVERDUE: 'Respuesta del Acta vencida',
+    ACT_RESPONSE_DUE_SOON: 'Respuesta próxima a vencer',
+    WAITING_RESPONSE: 'Esperando respuesta',
+    COMPANY_COMMITMENT_OVERDUE: 'Compromiso de empresa vencido',
+    VERIFICATION_PENDING: 'Verificación pendiente',
+    RESPONSE_RECEIVED: 'Respuesta recibida',
+  };
+  return labels[state];
+}
+
+function findingAction(finding: BriefingFinding, act: BriefingAct, plannedOn: string) {
+  if (finding.nextControlOn) {
+    if (finding.nextControlOn <= plannedOn) {
+      return { label: 'Revisar en campo', detail: 'Control programado o vencido', tone: 'danger' };
+    }
+    return { label: 'Próximo control', detail: `Previsto ${formatDateOnly(finding.nextControlOn)}`, tone: 'pending' };
+  }
+  if (act.adminState === 'VERIFICATION_PENDING') {
+    return { label: 'Revisar en campo', detail: 'Respuesta recibida sin control programado', tone: 'danger' };
+  }
+  if (act.adminState === 'COMPANY_COMMITMENT_OVERDUE') {
+    return { label: 'Revisar en campo', detail: 'Regularización comprometida vencida', tone: 'danger' };
+  }
+  if (act.adminState === 'RESPONSE_RECEIVED') {
+    return { label: 'Antecedente', detail: 'Respuesta de empresa recibida', tone: 'pending' };
+  }
+  return { label: 'Antecedente', detail: adminStateLabel(act.adminState), tone: 'pending' };
+}
+
+export function FieldBriefingsPage() {
+  const [visits, setVisits] = useState<VisitOption[]>([]);
+  const [visitId, setVisitId] = useState('');
+  const [briefing, setBriefing] = useState<FieldBriefing | null>(null);
+  const [loadingVisits, setLoadingVisits] = useState(true);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState('');
+
+  useEffect(() => {
+    setLoadingVisits(true);
+    Promise.all([
+      getJson<{ data: VisitOption[] }>('/api/v3/inspection-visits?status=PLANNED&page=1&pageSize=100'),
+      getJson<{ data: VisitOption[] }>('/api/v3/inspection-visits?status=DRAFT&page=1&pageSize=100'),
+    ]).then(([planned, drafts]) => {
+      const all = [...planned.data, ...drafts.data]
+        .sort((a, b) => String(a.plannedStartAt ?? '').localeCompare(String(b.plannedStartAt ?? '')));
+      setVisits(all);
+      const onlyVisit = all[0];
+      if (all.length === 1 && onlyVisit) setVisitId(onlyVisit.id);
+    }).catch((cause) => {
+      setError(cause instanceof Error ? cause.message : String(cause));
+    }).finally(() => setLoadingVisits(false));
+  }, []);
+
+  useEffect(() => {
+    if (!visitId) {
+      setBriefing(null);
+      return;
+    }
+    setLoading(true);
+    setError('');
+    getJson<FieldBriefing>(`/api/v3/inspection-visits/${visitId}/field-briefing`)
+      .then(setBriefing)
+      .catch((cause) => setError(cause instanceof Error ? cause.message : String(cause)))
+      .finally(() => setLoading(false));
+  }, [visitId]);
+
+  const selected = useMemo(
+    () => visits.find((visit) => visit.id === visitId) ?? null,
+    [visits, visitId],
+  );
+
+  return <section className="field-briefing-page">
+    <div className="page-heading">
+      <div>
+        <span className="eyebrow">ANTES DE SALIR A CAMPO</span>
+        <h1>Preparación de campo</h1>
+        <p>Seleccioná la inspección y revisá los pendientes de Actas anteriores del mismo Área/Yacimiento y Operadora.</p>
+      </div>
+      {briefing && <button className="button secondary no-print" type="button" onClick={() => window.print()}>
+        Imprimir preparación
+      </button>}
+    </div>
+
+    <div className="form-card no-print">
+      <label>Inspección planificada</label>
+      {loadingVisits ? <LoadingBlock label="Cargando inspecciones…" /> : <SearchableSelect
+        value={visitId}
+        onChange={(event) => setVisitId(event.target.value)}
+        searchPlaceholder="Buscar por código, Área u Operadora…"
+      >
+        <option value="">Seleccionar inspección…</option>
+        {visits.map((visit) => <option key={visit.id} value={visit.id}>
+          {visit.code} · {visit.operationalArea?.name ?? 'Sin Área'} · {visit.operatorCompany?.name ?? 'Sin Operadora'}
+        </option>)}
+      </SearchableSelect>}
+      {selected?.plannedStartAt && <small className="block-muted">Salida prevista: {formatDate(selected.plannedStartAt)}</small>}
+    </div>
+
+    {error && <Alert>{error}</Alert>}
+    {loading && <LoadingBlock label="Armando paquete de campo…" />}
+
+    {!loading && !briefing && !error && <EmptyState
+      title="Seleccioná una inspección"
+      text="El sistema reunirá automáticamente los pendientes de inspecciones anteriores del mismo contexto."
+    />}
+
+    {!loading && briefing && <>
+      <div className="page-heading compact">
+        <div>
+          <span className="eyebrow">{briefing.inspection.code}</span>
+          <h2>{briefing.inspection.area?.name ?? 'Área sin definir'} · {briefing.inspection.operatorCompany?.name ?? 'Operadora sin definir'}</h2>
+          <p>Fecha de referencia: {formatDateOnly(briefing.plannedOn)}</p>
+        </div>
+        <Link className="button secondary no-print" to={`/inspecciones/${briefing.inspection.id}`}>
+          Abrir planificación
+        </Link>
+      </div>
+
+      <div className="status-tabs briefing-summary">
+        <span>Actas <strong>{briefing.summary.acts}</strong></span>
+        <span>Hallazgos <strong>{briefing.summary.findings}</strong></span>
+        <span>Inventario <strong>{briefing.summary.inventoryItems}</strong></span>
+        <span>Respuestas vencidas <strong>{briefing.summary.responseOverdue}</strong></span>
+        <span>Compromisos vencidos <strong>{briefing.summary.commitmentOverdue}</strong></span>
+        <span>Verificaciones pendientes <strong>{briefing.summary.verificationPending}</strong></span>
+      </div>
+
+      {briefing.acts.length === 0 ? <EmptyState
+        title="Sin pendientes anteriores"
+        text="No hay Actas anteriores con hallazgos abiertos que requieran atención para esta inspección."
+      /> : briefing.acts.map((act) => <article className="table-panel" key={act.actId}>
+        <div className="table-summary">
+          <div>
+            <strong>{act.actCode}</strong>
+            <small className="block-muted">{formatDate(act.occurredAt)} · {adminStateLabel(act.adminState)}</small>
+          </div>
+          <div>
+            <small>Plazo del Acta</small>
+            <strong>{act.responseDueOn ? formatDateOnly(act.responseDueOn) : 'Sin definir'}</strong>
+          </div>
+          <div>
+            <small>Respuesta empresa</small>
+            <strong>{act.responseReceivedOn ? formatDateOnly(act.responseReceivedOn) : 'Pendiente'}</strong>
+          </div>
+          <div>
+            <small>Compromiso empresa</small>
+            <strong>{act.committedCorrectionOn ? formatDateOnly(act.committedCorrectionOn) : 'Sin fecha'}</strong>
+          </div>
+        </div>
+
+        <div className="table-scroll">
+          <table>
+            <thead><tr><th>Qué hacer</th><th>Hallazgo</th><th>Inventario</th><th>Control</th></tr></thead>
+            <tbody>{act.findings.map((finding) => {
+              const action = findingAction(finding, act, briefing.plannedOn);
+              return <tr key={finding.id}>
+                <td>
+                  <span className={`status-badge ${action.tone}`}>{action.label}</span>
+                  <small className="block-muted">{action.detail}</small>
+                </td>
+                <td>
+                  <strong>{finding.code}</strong>
+                  <small className="block-muted">{finding.title}</small>
+                </td>
+                <td>
+                  <strong>{finding.asset.code}</strong>
+                  <small className="block-muted">{finding.asset.name} · {finding.asset.typeName}</small>
+                </td>
+                <td>{finding.nextControlOn ? formatDateOnly(finding.nextControlOn) : 'Sin fecha'}</td>
+              </tr>;
+            })}</tbody>
+          </table>
+        </div>
+      </article>)}
+    </>}
+  </section>;
+}

web-v2/src/pages/InspectionVisitEditorPage.tsx

@@ -404,7 +404,7 @@ export function InspectionVisitEditorPage() {
     {visit && <div className="survey-status-actions panel"><div><strong>Flujo de la inspección</strong><p>Oficina planifica y asigna. El inspector responsable inicia la inspección desde la APK; toda la ejecución de campo sigue siendo exclusiva del dispositivo móvil.</p></div><div>{canManage && visit.status === 'DRAFT' && <button type="button" className="button secondary" onClick={() => void changeStatus('PLANNED')} disabled={busy}>Confirmar planificación</button>}{canManage && visit.status === 'PLANNED' && <button type="button" className="button secondary" onClick={() => void changeStatus('DRAFT')} disabled={busy}>Volver a borrador</button>}{canManage && ['DRAFT', 'PLANNED'].includes(visit.status) && <button type="button" className="button danger-outline" onClick={() => void changeStatus('CANCELLED')} disabled={busy}>Cancelar planificación</button>}</div></div>}
 
     {visit?.status === 'PLANNED' && <div className="temporal-notice"><Icon name="clipboard" /><p><strong>Planificación lista.</strong> El inspector asignado debe iniciar la inspección desde la APK. El dashboard no dispone de acción de inicio.</p></div>}
-    {visit?.status === 'IN_PROGRESS' && <div className="temporal-notice"><Icon name="clipboard" /><p><strong>Inspección iniciada {formatDate(visit.actualStartedAt)}.</strong> El acta, hallazgos, evidencias y cierre se registran desde la APK; aquí se consultan.</p></div>}
+    {visit?.status === 'IN_PROGRESS' && <div className="temporal-notice"><Icon name="clipboard" /><p><strong>Inspección iniciada {formatDate(visit.actualStartedAt)}.</strong> Las actas, hallazgos, evidencias y el cierre de la inspección se registran desde la APK; aquí se consultan.</p></div>}
     {visit?.status === 'CANCELLED' && <Alert>Cancelada: {visit.cancellationReason}</Alert>}
   </section>;
 }