fix(spike): the first flight must opt out of hold admission, not inherit it

[IanFrelinger]

Found by UAT tier 3, running the autonomy lane the way a tester reaches it: TesterQuickstart section 6 → samples/autonomy-objectives/README.md → the first-flight script it calls "the shortest working path".

The defect

The non-sweep first flight cannot succeed with shipped defaults:

outcome : CertifiedButHeld (2.2s)
explanation: certified; the operator holds admission (loop is in hold mode, no unattended swap)
certificate: signed=True escape_rate=0
FIRST FLIGHT: FAILED — expected AdmittedAndSwapped

Program.cs composes Nexo:Autonomy with Enabled, UseSandboxSessions, SessionImage, CadenceFloorSeconds and WatchMinInvocations — but never HoldAdmission. The fail-closed default (true, NexoAutonomyOptions.cs:64) therefore applies, the loop correctly returns CertifiedButHeld, and Program.cs:244 fails the run for not being AdmittedAndSwapped.

The product is right; the spike is wrong. The flight asserts the swap and then goes on to prove the swapped generation serves, so flying the whole loop is its entire purpose. It was left behind when the default became fail-closed. SweepMode.cs:55 sets the flag explicitly — to true, since a campaign certifies without admitting — which is why the campaign path kept working and this one rotted unnoticed.

The fix

Set HoldAdmission=false explicitly in the flight's own configuration, with a comment saying what the shipped default is and why this one place is allowed to differ. The alternative — softening the assertion to accept CertifiedButHeld — would leave the flight unable to reach the swap-and-serve half of what it exists to demonstrate.

Verification

Same script, same -Dry mode, only the flag changed.

Before (commit f6459d72, reproduced twice):

FIRST FLIGHT: FAILED — expected AdmittedAndSwapped
exit=1

After:

invocation 1: errorCount=1 first='live invocation: probe'
invocation 2: errorCount=1 first='live invocation: probe'
invocation 3: errorCount=1 first='live invocation: probe'
# Autonomy digest
## The loop did
- 2026-08-17 18:29:19Z — **swap-committed** generation 1
## The loop proposes and is holding
- (nothing held)
FIRST FLIGHT: PASS
exit=0

Not changed

The shipped default stays HoldAdmission=true. Nothing about the fail-closed posture moves; this is a spike opting out in the open, on a sample objective, inside a container. Tier 3 separately confirmed the surrounding claims hold: ProposalRequest has no field capable of carrying acceptance criteria to a proposer, and the autonomy types carry [Experimental].

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.