@tradejs/cli 3.1.29-beta.276 → 3.1.29-beta.277

package/dist/scripts/strategyRelease.js

@@ -34,18 +34,346 @@ __export(strategyRelease_exports, {
   runStrategyReleaseCommand: () => runStrategyReleaseCommand
 });
 module.exports = __toCommonJS(strategyRelease_exports);
-var import_promises2 = __toESM(require("fs/promises"));
+var import_promises3 = __toESM(require("fs/promises"));
 var import_node_fs = require("fs");
 var import_node_readline = require("readline");
-var import_node_path2 = __toESM(require("path"));
+var import_node_path4 = __toESM(require("path"));
 var import_chalk = __toESM(require("chalk"));
 
-// src/lib/strategyRelease.ts
-var import_node_crypto = require("crypto");
+// src/lib/strategyRelease/researchRetention.ts
 var import_promises = __toESM(require("fs/promises"));
+var import_node_path2 = __toESM(require("path"));
+var import_node_crypto = require("crypto");
+var import_strategyReleaseEvidence = require("@tradejs/infra/strategyReleaseEvidence");
+
+// src/lib/strategyRelease/researchFileConsumers.ts
 var import_node_path = __toESM(require("path"));
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var runCommand = (command, args) => execFileAsync(command, args, { maxBuffer: 32 * 1024 * 1024 });
+var GUEST_FILE_CHECK = `
+import os, sys, json
+if os.geteuid() != 0:
+    raise RuntimeError('Cannot inspect every container process')
+wanted = set(json.loads(sys.argv[1]))
+opened = set()
+for pid in os.listdir('/proc'):
+    if not pid.isdigit():
+        continue
+    for kind in ('fd', 'map_files'):
+        directory = '/proc/' + pid + '/' + kind
+        try:
+            names = os.listdir(directory)
+        except FileNotFoundError:
+            continue
+        for name in names:
+            try:
+                target = os.readlink(directory + '/' + name)
+            except FileNotFoundError:
+                continue
+            if target in wanted:
+                opened.add(target)
+print(json.dumps(sorted(opened)))
+`;
+var assertNoResearchFileConsumers = async (files, run = runCommand) => {
+  const virtualPids = /* @__PURE__ */ new Set();
+  const wanted = new Set(files.map((file) => import_node_path.default.resolve(file)));
+  let commonRoot = files.length ? import_node_path.default.dirname(files[0]) : "";
+  while (commonRoot && files.some((file) => {
+    const relative = import_node_path.default.relative(commonRoot, file);
+    return relative === ".." || relative.startsWith(`..${import_node_path.default.sep}`) || import_node_path.default.isAbsolute(relative);
+  }))
+    commonRoot = import_node_path.default.dirname(commonRoot);
+  const selectors = [];
+  if (files.length > 1e3 && commonRoot !== import_node_path.default.parse(commonRoot).root) {
+    selectors.push(["+D", commonRoot]);
+  } else {
+    for (let offset = 0; offset < files.length; offset += 100)
+      selectors.push(["--", ...files.slice(offset, offset + 100)]);
+  }
+  for (const selector of selectors) {
+    let output;
+    try {
+      output = (await run("lsof", ["-F", "pcn", ...selector])).stdout;
+    } catch (error) {
+      if (error.code === 1) continue;
+      throw error;
+    }
+    let pid = "";
+    let virtual = false;
+    for (const line of output.split("\n")) {
+      if (line.startsWith("p")) {
+        pid = line.slice(1);
+        virtual = false;
+      }
+      if (line.startsWith("c"))
+        virtual = line.startsWith("ccom.apple.Virtualization.");
+      if (line.startsWith("n")) {
+        if (!wanted.has(import_node_path.default.resolve(line.slice(1)))) continue;
+        if (!virtual || !/^\d+$/.test(pid))
+          throw new Error(
+            `Research cleanup found open files: ${line.slice(1)}`
+          );
+        virtualPids.add(pid);
+      }
+    }
+  }
+  if (!virtualPids.size) return;
+  for (const pid of virtualPids) {
+    const comm = (await run("ps", ["-p", pid, "-o", "comm="])).stdout.trim();
+    if (comm !== "/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine") {
+      throw new Error("Unrecognized virtual file consumer");
+    }
+  }
+  const contexts = JSON.parse(
+    (await run("docker", ["context", "inspect"])).stdout
+  );
+  if (contexts.length !== 1 || !contexts[0].Endpoints.docker.Host.startsWith("unix://")) {
+    throw new Error("Research file inspection requires a local Docker socket");
+  }
+  const ids = (await run("docker", ["ps", "-q"])).stdout.trim().split(/\s+/).filter(Boolean);
+  if (!ids.length)
+    throw new Error("Cannot resolve virtual research file handles");
+  const containers = JSON.parse(
+    (await run("docker", ["inspect", ...ids])).stdout
+  );
+  const covered = /* @__PURE__ */ new Set();
+  for (const container of containers) {
+    const guestFiles = /* @__PURE__ */ new Set();
+    for (const mount of container.Mounts) {
+      if (mount.Type !== "bind") continue;
+      for (const file of files) {
+        const relative = import_node_path.default.relative(mount.Source, file);
+        if (relative === "" || !relative.startsWith(`..${import_node_path.default.sep}`) && relative !== ".." && !import_node_path.default.isAbsolute(relative)) {
+          guestFiles.add(import_node_path.default.posix.join(mount.Destination, relative));
+          covered.add(file);
+        }
+      }
+    }
+    if (!guestFiles.size) continue;
+    const paths = [...guestFiles];
+    for (let offset = 0; offset < paths.length; offset += 250) {
+      const opened = JSON.parse(
+        (await run("docker", [
+          "exec",
+          container.Id,
+          "python",
+          "-c",
+          GUEST_FILE_CHECK,
+          JSON.stringify(paths.slice(offset, offset + 250))
+        ])).stdout
+      );
+      if (!Array.isArray(opened) || opened.length)
+        throw new Error("Research cleanup found open files in a container");
+    }
+  }
+  if (covered.size !== files.length)
+    throw new Error("Unresolved virtual research file handles");
+};
+
+// src/lib/strategyRelease/evidenceRetention.ts
+var DAY_MS = 864e5;
+var isResearchRetired = (research) => research?.status === "retired" && research.retirement?.policy === "discard-unrecoverable-without-rerun" && Boolean(research.retirement.reason.trim()) && Boolean(research.retirement.missingEvidence.length) && research.retirement.missingEvidence.every((item) => Boolean(item.trim()));
+var planStrategyEvidenceRetention = ({
+  now,
+  entries,
+  research,
+  retentionDays = {
+    operational_redis: 3,
+    verbose_payload: 14,
+    research_payload: 0,
+    research_cache: 0,
+    verified_runtime_bundle: 90,
+    compact_ledger: null
+  }
+}) => {
+  const keep = [];
+  const remove = [];
+  const retired = isResearchRetired(research);
+  const roles = new Set(
+    research?.permanentArtifacts.map((artifact) => artifact.role)
+  );
+  const terminalResearch = Boolean(
+    (research?.status === "completed" || retired) && Number.isFinite(research?.completedAt) && research.completedAt <= now && (retired ? ["note"] : ["note", "candidates", "metrics"]).every(
+      (role) => roles.has(role)
+    )
+  );
+  for (const entry of entries) {
+    const days = retentionDays[entry.kind];
+    const isResearch = entry.kind === "research_payload" || entry.kind === "research_cache";
+    const completedResearch = Boolean(
+      terminalResearch && research?.researchId === entry.researchId && /^[a-f0-9]{64}$/.test(entry.sha256 ?? "")
+    );
+    if (isResearch && !completedResearch || days == null || !entry.verified || !entry.aggregated && !(isResearch && retired) || !isResearch && now - entry.createdAt <= days * DAY_MS) {
+      keep.push(entry);
+    } else {
+      remove.push(entry);
+    }
+  }
+  return {
+    keep,
+    delete: remove,
+    bytesReclaimable: remove.reduce((total, entry) => total + entry.bytes, 0)
+  };
+};
+
+// src/lib/strategyRelease/researchRetention.ts
+var SHA256_RE = /^[a-f0-9]{64}$/;
+var mapFiles = async (entries, visit) => {
+  const results = new Array(entries.length);
+  let next = 0;
+  const workers = await Promise.allSettled(
+    Array.from({ length: Math.min(8, entries.length) }, async () => {
+      while (next < entries.length) {
+        const index = next++;
+        results[index] = await visit(entries[index]);
+      }
+    })
+  );
+  for (const worker of workers)
+    if (worker.status === "rejected") throw worker.reason;
+  return results;
+};
+var fileSha256 = async (file, bytes) => bytes <= 1024 * 1024 ? (0, import_node_crypto.createHash)("sha256").update(await import_promises.default.readFile(file)).digest("hex") : (0, import_strategyReleaseEvidence.strategyEvidenceFileSha256)(file);
+var inside = (root, file) => {
+  const relative = import_node_path2.default.relative(root, file);
+  return relative !== "" && !relative.startsWith(`..${import_node_path2.default.sep}`) && relative !== ".." && !import_node_path2.default.isAbsolute(relative);
+};
+var applyResearchRetention = async (options) => {
+  const projectRoot = await import_promises.default.realpath(options.projectRoot);
+  const dataRoot = import_node_path2.default.join(projectRoot, "data");
+  const resolve = (file) => import_node_path2.default.resolve(projectRoot, file);
+  const receiptPath = resolve(options.receiptPath);
+  const journalPath = `${receiptPath}.deleted.jsonl`;
+  const permanent = new Set(
+    options.research.permanentArtifacts.map((entry) => resolve(entry.path))
+  );
+  if (!inside(projectRoot, receiptPath) || permanent.has(receiptPath) || permanent.has(journalPath)) {
+    throw new Error(
+      "Cleanup receipt must be separate from permanent research artifacts"
+    );
+  }
+  permanent.add(receiptPath);
+  permanent.add(journalPath);
+  for (const file of options.protectedPaths ?? []) permanent.add(resolve(file));
+  const retired = isResearchRetired(options.research);
+  if (options.research.status !== "completed" && !retired || !Number.isFinite(options.research.completedAt) || options.research.completedAt > Date.now()) {
+    throw new Error("Research must be completed before cleanup");
+  }
+  for (const role of retired ? ["note"] : ["note", "candidates", "metrics"]) {
+    if (!options.research.permanentArtifacts.some((entry) => entry.role === role)) {
+      throw new Error(`Missing permanent research ${role}`);
+    }
+  }
+  await mapFiles(options.research.permanentArtifacts, async (artifact) => {
+    const file = resolve(artifact.path);
+    if (!inside(projectRoot, await import_promises.default.realpath(file)) || !SHA256_RE.test(artifact.sha256) || await fileSha256(file, (await import_promises.default.stat(file)).size) !== artifact.sha256) {
+      throw new Error(
+        `Permanent research artifact checksum/path mismatch: ${file}`
+      );
+    }
+    if (artifact.role === "note") {
+      const handle = await import_promises.default.open(file, "r");
+      try {
+        const header = Buffer.alloc(4096);
+        const { bytesRead } = await handle.read(header, 0, header.length, 0);
+        const frontmatter = header.subarray(0, bytesRead).toString("utf8").match(/^---\r?\n([\s\S]*?)\r?\n---/);
+        if (!frontmatter || !/^schema:\s*tradejs-research\/v1\s*$/m.test(frontmatter[1]) || !(retired ? /^reproduction:\s*(?:complete|partial|blocked|legacy-partial)\s*$/m.test(
+          frontmatter[1]
+        ) : /^reproduction:\s*complete\s*$/m.test(frontmatter[1]))) {
+          throw new Error(
+            `Research note must have reproduction: complete: ${file}`
+          );
+        }
+      } finally {
+        await handle.close();
+      }
+    }
+  });
+  const checkedPaths = /* @__PURE__ */ new Set();
+  const checked = await mapFiles(options.entries, async (entry) => {
+    const file = resolve(entry.path);
+    if (!["research_payload", "research_cache"].includes(entry.kind) || entry.researchId !== options.research.researchId || !entry.verified || !entry.aggregated && !retired || !SHA256_RE.test(entry.sha256 ?? "") || !inside(dataRoot, file) || permanent.has(file) || /\.(?:md|patch|diff)$/i.test(file)) {
+      throw new Error(`Not a disposable research file: ${file}`);
+    }
+    if (checkedPaths.has(file))
+      throw new Error(`Duplicate cleanup path: ${file}`);
+    checkedPaths.add(file);
+    if (await import_promises.default.realpath(file) !== file)
+      throw new Error(`Research cleanup refuses symlinks: ${file}`);
+    const stat = await import_promises.default.lstat(file);
+    if (!stat.isFile() || stat.size !== entry.bytes || await fileSha256(file, stat.size) !== entry.sha256) {
+      throw new Error(
+        `Disposable research file checksum/size mismatch: ${file}`
+      );
+    }
+    return { entry, file, mtimeMs: stat.mtimeMs, ino: stat.ino };
+  });
+  await assertNoResearchFileConsumers(checked.map((entry) => entry.file));
+  const receipt = {
+    schema: "tradejs-research-cleanup-receipt/v1",
+    researchId: options.research.researchId,
+    completedAt: options.research.completedAt,
+    ...retired ? { retirement: options.research.retirement } : {},
+    journalPath,
+    permanentArtifacts: options.research.permanentArtifacts,
+    scope: "reported aggregates and frozen candidates; new trade-level analyses require a rerun",
+    status: "planned",
+    files: checked.map(({ entry, file }) => ({
+      path: file,
+      sha256: entry.sha256,
+      bytes: entry.bytes,
+      removed: false
+    }))
+  };
+  if (!options.apply) return receipt;
+  await import_promises.default.mkdir(import_node_path2.default.dirname(receiptPath), { recursive: true });
+  if (await import_promises.default.realpath(import_node_path2.default.dirname(receiptPath)) !== import_node_path2.default.dirname(receiptPath)) {
+    throw new Error("Cleanup receipt refuses symlinked directories");
+  }
+  const lock = await import_promises.default.open(`${receiptPath}.lock`, "wx");
+  let journal;
+  const writeReceipt = async () => {
+    const temp = `${receiptPath}.${process.pid}.tmp`;
+    await import_promises.default.writeFile(temp, `${JSON.stringify(receipt, null, 2)}
+`, "utf8");
+    await import_promises.default.rename(temp, receiptPath);
+  };
+  try {
+    journal = await import_promises.default.open(journalPath, "wx");
+    receipt.status = "applying";
+    await writeReceipt();
+    for (let index = 0; index < checked.length; index += 1) {
+      const { file, entry, ino, mtimeMs } = checked[index];
+      const stat = await import_promises.default.lstat(file);
+      if (!stat.isFile() || stat.ino !== ino || stat.mtimeMs !== mtimeMs || stat.size !== entry.bytes) {
+        throw new Error(`Research file changed during cleanup: ${file}`);
+      }
+      await import_promises.default.unlink(file);
+      receipt.files[index].removed = true;
+      await journal.write(`${JSON.stringify(receipt.files[index])}
+`);
+    }
+    receipt.status = "completed";
+    await writeReceipt();
+    return receipt;
+  } catch (error) {
+    if (journal) await writeReceipt();
+    throw error;
+  } finally {
+    await journal?.close();
+    await lock.close();
+    await import_promises.default.unlink(`${receiptPath}.lock`);
+  }
+};
+
+// src/lib/strategyRelease.ts
+var import_node_crypto2 = require("crypto");
+var import_promises2 = __toESM(require("fs/promises"));
+var import_node_path3 = __toESM(require("path"));
 var import_types2 = require("@tradejs/types");
-var import_strategyReleaseEvidence = require("@tradejs/infra/strategyReleaseEvidence");
+var import_strategyReleaseEvidence2 = require("@tradejs/infra/strategyReleaseEvidence");
 
 // src/lib/strategyRelease/liveDiagnosis.ts
 var import_types = require("@tradejs/types");
@@ -107,7 +435,7 @@ var buildStrategyLiveDiagnosis = (input) => {
 };
 
 // src/lib/strategyRelease/monitoringProfile.ts
-var DAY_MS = 864e5;
+var DAY_MS2 = 864e5;
 function assert(condition, message) {
   if (!condition) throw new Error(`Invalid strategy release: ${message}`);
 }
@@ -163,13 +491,13 @@ var buildStrategyMonitoringProfile = ({
       Number.isInteger(windowDays) && windowDays > 0,
       "monitoring profile days must be positive integers"
     );
-    const duration = windowDays * DAY_MS;
+    const duration = windowDays * DAY_MS2;
     assert(
       endTime - startTime >= duration,
       `${windowDays}d monitoring window exceeds historical coverage`
     );
     const drawdowns = [];
-    for (let windowStart = startTime; windowStart + duration <= endTime; windowStart += DAY_MS) {
+    for (let windowStart = startTime; windowStart + duration <= endTime; windowStart += DAY_MS2) {
       const windowEnd = windowStart + duration;
       drawdowns.push(
         realizedDrawdown(
@@ -197,54 +525,25 @@ var buildStrategyMonitoringProfile = ({
   };
 };
 
-// src/lib/strategyRelease/evidenceRetention.ts
-var DAY_MS2 = 864e5;
-var planStrategyEvidenceRetention = ({
-  now,
-  entries,
-  retentionDays = {
-    operational_redis: 3,
-    verbose_payload: 14,
-    verified_runtime_bundle: 90,
-    compact_ledger: null
-  }
-}) => {
-  const keep = [];
-  const remove = [];
-  for (const entry of entries) {
-    const days = retentionDays[entry.kind];
-    if (days == null || !entry.verified || !entry.aggregated || now - entry.createdAt <= days * DAY_MS2) {
-      keep.push(entry);
-    } else {
-      remove.push(entry);
-    }
-  }
-  return {
-    keep,
-    delete: remove,
-    bytesReclaimable: remove.reduce((total, entry) => total + entry.bytes, 0)
-  };
-};
-
 // src/lib/strategyRelease.ts
-var SHA256_RE = /^[a-f0-9]{64}$/;
+var SHA256_RE2 = /^[a-f0-9]{64}$/;
 var LINEAGE_FINGERPRINT_RE = /^[a-f0-9]{16}$/;
 var STRATEGY_REVISION_RE = /^sr1:[a-f0-9]{16}$/;
 var DEPLOYMENT_COMPOSITION_ID_RE = /^dc1:[a-f0-9]{16}$/;
 var REQUIRED_LONG_WINDOWS = [1095, 1460, 1825];
 var REQUIRED_DIAGNOSTIC_TERMINAL_WINDOWS = [365, 180, 90];
 var MIN_RECENT_DIRECTION_REPAIR_EVENTS = 20;
-var safeSegment = import_strategyReleaseEvidence.safeStrategyEvidenceSegment;
-var compactTimestamp = import_strategyReleaseEvidence.compactStrategyEvidenceTimestamp;
+var safeSegment = import_strategyReleaseEvidence2.safeStrategyEvidenceSegment;
+var compactTimestamp = import_strategyReleaseEvidence2.compactStrategyEvidenceTimestamp;
 var verifyFullPeriodChartArtifact = async (input) => {
   const artifact = input.chartArtifact;
-  if (!artifact?.path || !SHA256_RE.test(artifact.sha256)) return false;
+  if (!artifact?.path || !SHA256_RE2.test(artifact.sha256)) return false;
   try {
-    const artifactPath = import_node_path.default.resolve(artifact.path);
-    if (await (0, import_strategyReleaseEvidence.strategyEvidenceFileSha256)(artifactPath) !== artifact.sha256) {
+    const artifactPath = import_node_path3.default.resolve(artifact.path);
+    if (await (0, import_strategyReleaseEvidence2.strategyEvidenceFileSha256)(artifactPath) !== artifact.sha256) {
       return false;
     }
-    const report = JSON.parse(await import_promises.default.readFile(artifactPath, "utf8"));
+    const report = JSON.parse(await import_promises2.default.readFile(artifactPath, "utf8"));
     return Boolean(
       report.chart?.persisted === true && report.chart.cardIds?.length && report.errors?.failed === 0 && report.run?.strategy === input.strategy && report.run.mode === "local-deterministic" && report.run.recent === 0 && report.run.since == null && report.run.until == null && Number(report.run.sourceRows) > 0
     );
@@ -253,13 +552,13 @@ var verifyFullPeriodChartArtifact = async (input) => {
   }
 };
 var readVerifiedJsonArtifact = async (artifact) => {
-  if (!artifact?.path || !SHA256_RE.test(artifact.sha256)) return null;
+  if (!artifact?.path || !SHA256_RE2.test(artifact.sha256)) return null;
   try {
-    const artifactPath = import_node_path.default.resolve(artifact.path);
-    if (await (0, import_strategyReleaseEvidence.strategyEvidenceFileSha256)(artifactPath) !== artifact.sha256) {
+    const artifactPath = import_node_path3.default.resolve(artifact.path);
+    if (await (0, import_strategyReleaseEvidence2.strategyEvidenceFileSha256)(artifactPath) !== artifact.sha256) {
       return null;
     }
-    return JSON.parse(await import_promises.default.readFile(artifactPath, "utf8"));
+    return JSON.parse(await import_promises2.default.readFile(artifactPath, "utf8"));
   } catch {
     return null;
   }
@@ -272,7 +571,7 @@ var verifyResearchDecisionLineage = async (input) => {
   if (!progress || !selected) return false;
   const progressSelection = progress.selectedComposition;
   return Boolean(
-    progress.schema === "tradejs-release-progress/v2" && progress.strategy === input.strategy && progress.status === "complete" && progress.verdictAllowed === true && typeof progress.lineageId === "string" && progress.lineageId.length > 0 && typeof progress.objectiveFingerprint === "string" && SHA256_RE.test(progress.objectiveFingerprint) && typeof progressSelection?.candidateId === "string" && progressSelection.candidateId.length > 0 && typeof progressSelection.compositionFingerprint === "string" && SHA256_RE.test(progressSelection.compositionFingerprint) && progressSelection.artifactSha256 === input.selectedCompositionArtifact?.sha256 && selected.schema === "tradejs-release-selected-composition/v2" && selected.strategy === input.strategy && selected.lineageId === progress.lineageId && selected.objectiveFingerprint === progress.objectiveFingerprint && selected.candidateId === progressSelection.candidateId && selected.compositionFingerprint === progressSelection.compositionFingerprint && selected.chartSha256 === input.chartArtifact?.sha256
+    progress.schema === "tradejs-release-progress/v2" && progress.strategy === input.strategy && progress.status === "complete" && progress.verdictAllowed === true && typeof progress.lineageId === "string" && progress.lineageId.length > 0 && typeof progress.objectiveFingerprint === "string" && SHA256_RE2.test(progress.objectiveFingerprint) && typeof progressSelection?.candidateId === "string" && progressSelection.candidateId.length > 0 && typeof progressSelection.compositionFingerprint === "string" && SHA256_RE2.test(progressSelection.compositionFingerprint) && progressSelection.artifactSha256 === input.selectedCompositionArtifact?.sha256 && selected.schema === "tradejs-release-selected-composition/v2" && selected.strategy === input.strategy && selected.lineageId === progress.lineageId && selected.objectiveFingerprint === progress.objectiveFingerprint && selected.candidateId === progressSelection.candidateId && selected.compositionFingerprint === progressSelection.compositionFingerprint && selected.chartSha256 === input.chartArtifact?.sha256
   );
 };
 var hasExactRuntimeTarget = (target, strategyName) => Boolean(
@@ -413,12 +712,12 @@ var deriveStrategyReleaseResearchDecision = async (input) => {
     summary: "Start the exact frozen composition as a micro-forward test at MAX_LOSS_VALUE=1; do not retune an underpowered or exposed recent tail."
   };
 };
-var canonicalStrategyReleaseJson = (value) => (0, import_strategyReleaseEvidence.canonicalStrategyEvidenceJson)(value);
-var strategyReleaseSha256 = (value) => (0, import_strategyReleaseEvidence.strategyEvidenceSha256)(value);
+var canonicalStrategyReleaseJson = (value) => (0, import_strategyReleaseEvidence2.canonicalStrategyEvidenceJson)(value);
+var strategyReleaseSha256 = (value) => (0, import_strategyReleaseEvidence2.strategyEvidenceSha256)(value);
 function assert2(condition, message) {
   if (!condition) throw new Error(`Invalid strategy release: ${message}`);
 }
-var assertFingerprint = (value, label) => assert2(SHA256_RE.test(value), `${label} must be a lowercase SHA-256`);
+var assertFingerprint = (value, label) => assert2(SHA256_RE2.test(value), `${label} must be a lowercase SHA-256`);
 var assertLineageFingerprint = (value, label) => assert2(
   LINEAGE_FINGERPRINT_RE.test(value),
   `${label} must be a 16-character lowercase lineage fingerprint`
@@ -808,7 +1107,7 @@ var createStrategyReleaseEnvelope = (manifest) => ({
   manifest
 });
 var verifyStrategyReleaseEnvelope = async (valueOrPath) => {
-  const value = typeof valueOrPath === "string" ? JSON.parse(await import_promises.default.readFile(valueOrPath, "utf8")) : valueOrPath;
+  const value = typeof valueOrPath === "string" ? JSON.parse(await import_promises2.default.readFile(valueOrPath, "utf8")) : valueOrPath;
   const envelope = value;
   assert2(
     envelope?.schema === "tradejs-strategy-release-envelope/v1",
@@ -859,8 +1158,8 @@ var verifyStrategyReleaseEnvelope = async (valueOrPath) => {
   return envelope;
 };
 var verifyStrategyEvidenceMarkerEnvelope = async (valueOrPath) => {
-  const value = typeof valueOrPath === "string" ? JSON.parse(await import_promises.default.readFile(valueOrPath, "utf8")) : valueOrPath;
-  return (0, import_strategyReleaseEvidence.verifyStrategyEvidenceMarkerEnvelope)(value);
+  const value = typeof valueOrPath === "string" ? JSON.parse(await import_promises2.default.readFile(valueOrPath, "utf8")) : valueOrPath;
+  return (0, import_strategyReleaseEvidence2.verifyStrategyEvidenceMarkerEnvelope)(value);
 };
 var releaseMarkers = (manifest) => {
   const common = {
@@ -921,21 +1220,21 @@ var releaseMarkers = (manifest) => {
 };
 var writeJsonAtomic = async (filePath, value) => {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  await import_promises.default.mkdir(import_node_path.default.dirname(filePath), { recursive: true });
-  await import_promises.default.writeFile(
+  await import_promises2.default.mkdir(import_node_path3.default.dirname(filePath), { recursive: true });
+  await import_promises2.default.writeFile(
     temporaryPath,
     `${canonicalStrategyReleaseJson(value)}
 `,
     "utf8"
   );
-  await import_promises.default.rename(temporaryPath, filePath);
+  await import_promises2.default.rename(temporaryPath, filePath);
 };
 var publishStrategyRelease = async ({
   rootDir,
   manifest
 }) => {
   const envelope = createStrategyReleaseEnvelope(manifest);
-  const markerEnvelope = (0, import_strategyReleaseEvidence.createStrategyEvidenceMarkerEnvelope)({
+  const markerEnvelope = (0, import_strategyReleaseEvidence2.createStrategyEvidenceMarkerEnvelope)({
     strategy: manifest.strategy,
     createdAt: manifest.createdAt,
     markers: releaseMarkers(manifest),
@@ -945,13 +1244,13 @@ var publishStrategyRelease = async ({
       path: entry.path
     }))
   });
-  const releasePath = import_node_path.default.join(
+  const releasePath = import_node_path3.default.join(
     rootDir,
     "releases",
     safeSegment(manifest.strategy, "strategy"),
     `${manifest.releaseId}.json`
   );
-  const markerPath = import_node_path.default.join(
+  const markerPath = import_node_path3.default.join(
     rootDir,
     "markers",
     safeSegment(manifest.strategy, "strategy"),
@@ -1025,19 +1324,19 @@ var publishStrategyLiveDiagnosis = async ({
       severity: diagnosis.verdict === "EXPECTED_DRAWDOWN" ? "info" : "warning"
     }
   ];
-  const markerEnvelope = (0, import_strategyReleaseEvidence.createStrategyEvidenceMarkerEnvelope)({
+  const markerEnvelope = (0, import_strategyReleaseEvidence2.createStrategyEvidenceMarkerEnvelope)({
     strategy: diagnosis.strategy,
     createdAt: diagnosis.createdAt,
     markers,
     sourceArtifacts
   });
-  const diagnosisPath = import_node_path.default.join(
+  const diagnosisPath = import_node_path3.default.join(
     rootDir,
     "diagnoses",
     safeSegment(diagnosis.strategy, "strategy"),
     `${diagnosisId}.json`
   );
-  const markerPath = import_node_path.default.join(
+  const markerPath = import_node_path3.default.join(
     rootDir,
     "markers",
     safeSegment(diagnosis.strategy, "strategy"),
@@ -1227,11 +1526,11 @@ var verifyCompletedCoreResearchBundle = async ({
   const specSha256 = finiteString(artifact.specSha256);
   assert2(researchId != null, "core result researchId is required");
   assert2(specSha256 != null, "core result specSha256 is required");
-  const researchDir = import_node_path.default.dirname(resultPath);
-  const manifestPath = import_node_path.default.join(researchDir, "manifest.json");
-  const specPath = import_node_path.default.join(researchDir, "spec.json");
-  const manifestBytes = await import_promises.default.readFile(manifestPath).catch(() => null);
-  const specBytes = await import_promises.default.readFile(specPath).catch(() => null);
+  const researchDir = import_node_path3.default.dirname(resultPath);
+  const manifestPath = import_node_path3.default.join(researchDir, "manifest.json");
+  const specPath = import_node_path3.default.join(researchDir, "spec.json");
+  const manifestBytes = await import_promises2.default.readFile(manifestPath).catch(() => null);
+  const specBytes = await import_promises2.default.readFile(specPath).catch(() => null);
   assert2(
     manifestBytes != null && specBytes != null,
     "core result must belong to a completed core research bundle"
@@ -1240,22 +1539,22 @@ var verifyCompletedCoreResearchBundle = async ({
   const artifactHashes = manifest.artifactHashes != null && typeof manifest.artifactHashes === "object" && !Array.isArray(manifest.artifactHashes) ? manifest.artifactHashes : null;
   const parsedSpec = JSON.parse(specBytes.toString("utf8"));
   assert2(
-    manifest.schema === "tradejs-core-research-manifest/v1" && manifest.status === "completed" && manifest.researchId === researchId && manifest.specSha256 === specSha256 && artifactHashes?.["result.json"] === resultSha256 && (0, import_node_crypto.createHash)("sha256").update(canonicalStrategyReleaseJson(parsedSpec)).digest("hex") === specSha256,
+    manifest.schema === "tradejs-core-research-manifest/v1" && manifest.status === "completed" && manifest.researchId === researchId && manifest.specSha256 === specSha256 && artifactHashes?.["result.json"] === resultSha256 && (0, import_node_crypto2.createHash)("sha256").update(canonicalStrategyReleaseJson(parsedSpec)).digest("hex") === specSha256,
     "core result is not bound by its completed core research manifest"
   );
   for (const [relativePath, expectedSha256] of Object.entries(
     artifactHashes ?? {}
   )) {
     assert2(
-      !import_node_path.default.isAbsolute(relativePath) && !relativePath.split(/[\\/]/).includes(".."),
+      !import_node_path3.default.isAbsolute(relativePath) && !relativePath.split(/[\\/]/).includes(".."),
       `core bundle artifact ${relativePath} escapes its research directory`
     );
     assert2(
-      typeof expectedSha256 === "string" && SHA256_RE.test(expectedSha256),
+      typeof expectedSha256 === "string" && SHA256_RE2.test(expectedSha256),
       `core bundle artifact ${relativePath} has an invalid checksum`
     );
-    const actualSha256 = await (0, import_strategyReleaseEvidence.strategyEvidenceFileSha256)(
-      import_node_path.default.join(researchDir, relativePath)
+    const actualSha256 = await (0, import_strategyReleaseEvidence2.strategyEvidenceFileSha256)(
+      import_node_path3.default.join(researchDir, relativePath)
     );
     assert2(
       actualSha256 === expectedSha256,
@@ -1266,7 +1565,7 @@ var verifyCompletedCoreResearchBundle = async ({
 async function collectReleaseEvidenceReferences(references) {
   return Promise.all(
     references.map(async (reference) => {
-      const actualSha256 = await (0, import_strategyReleaseEvidence.strategyEvidenceFileSha256)(reference.path);
+      const actualSha256 = await (0, import_strategyReleaseEvidence2.strategyEvidenceFileSha256)(reference.path);
       assert2(
         actualSha256 === reference.sha256,
         `evidence ${reference.artifactId} checksum mismatch`
@@ -1274,7 +1573,7 @@ async function collectReleaseEvidenceReferences(references) {
       let artifact;
       try {
         const parsed = JSON.parse(
-          await import_promises.default.readFile(reference.path, "utf8")
+          await import_promises2.default.readFile(reference.path, "utf8")
         );
         assert2(
           parsed != null && typeof parsed === "object" && !Array.isArray(parsed),
@@ -1433,17 +1732,17 @@ var required = (value, name) => {
 };
 var writeJsonAtomic2 = async (filePath, value) => {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  await import_promises2.default.mkdir(import_node_path2.default.dirname(filePath), { recursive: true });
-  await import_promises2.default.writeFile(
+  await import_promises3.default.mkdir(import_node_path4.default.dirname(filePath), { recursive: true });
+  await import_promises3.default.writeFile(
     temporaryPath,
     `${JSON.stringify(value, null, 2)}
 `,
     "utf8"
   );
-  await import_promises2.default.rename(temporaryPath, filePath);
+  await import_promises3.default.rename(temporaryPath, filePath);
 };
 var runStrategyReleaseCommand = async (options) => {
-  const inputPath = import_node_path2.default.resolve(options.inputPath);
+  const inputPath = import_node_path4.default.resolve(options.inputPath);
   if (options.command === "verify") {
     const envelope = await verifyStrategyReleaseEnvelope(inputPath);
     return {
@@ -1481,7 +1780,7 @@ var runStrategyReleaseCommand = async (options) => {
       endTime,
       days: options.days?.length ? options.days : [7, 30, 90]
     });
-    const outputPath = import_node_path2.default.resolve(
+    const outputPath = import_node_path4.default.resolve(
       options.outputPath ?? "output/strategy-monitoring-profile.json"
     );
     await writeJsonAtomic2(outputPath, profile);
@@ -1492,22 +1791,40 @@ var runStrategyReleaseCommand = async (options) => {
       profile
     };
   }
-  const input = JSON.parse(await import_promises2.default.readFile(inputPath, "utf8"));
+  const input = JSON.parse(await import_promises3.default.readFile(inputPath, "utf8"));
   if (options.command === "decide") {
     const decision = await deriveStrategyReleaseResearchDecision(input);
     if (options.outputPath) {
-      await writeJsonAtomic2(import_node_path2.default.resolve(options.outputPath), decision);
+      await writeJsonAtomic2(import_node_path4.default.resolve(options.outputPath), decision);
     }
     return {
       kind: "decided",
       ...decision,
-      outputPath: options.outputPath ? import_node_path2.default.resolve(options.outputPath) : null
+      outputPath: options.outputPath ? import_node_path4.default.resolve(options.outputPath) : null
     };
   }
   if (options.command === "retention") {
     const plan = planStrategyEvidenceRetention(input);
-    if (options.apply) {
-      await Promise.all(plan.delete.map((entry) => import_promises2.default.rm(entry.path)));
+    const researchEntries = plan.delete.filter(
+      (entry) => entry.kind === "research_payload" || entry.kind === "research_cache"
+    );
+    const receiptPath = options.outputPath ?? `${inputPath}.receipt.json`;
+    if (researchEntries.length) {
+      if (researchEntries.length !== plan.delete.length) {
+        throw new Error(
+          "Research cleanup requires a separate inventory from runtime retention"
+        );
+      }
+      await applyResearchRetention({
+        projectRoot: process.env.PROJECT_CWD ?? process.cwd(),
+        research: input.research,
+        entries: researchEntries,
+        receiptPath,
+        apply: Boolean(options.apply),
+        protectedPaths: [inputPath]
+      });
+    } else if (options.apply) {
+      await Promise.all(plan.delete.map((entry) => import_promises3.default.rm(entry.path)));
     }
     return {
       kind: "retention",
@@ -1515,17 +1832,18 @@ var runStrategyReleaseCommand = async (options) => {
       keepCount: plan.keep.length,
       deleteCount: plan.delete.length,
       bytesReclaimable: plan.bytesReclaimable,
-      delete: plan.delete.map((entry) => entry.path)
+      delete: plan.delete.map((entry) => entry.path),
+      ...researchEntries.length && options.apply ? { receiptPath } : {}
     };
   }
   if (options.command === "diagnose") {
     const diagnosis = buildStrategyLiveDiagnosis(input);
-    const outputPath = import_node_path2.default.resolve(
+    const outputPath = import_node_path4.default.resolve(
       options.outputPath ?? "output/strategy-live-diagnosis.json"
     );
     await writeJsonAtomic2(outputPath, diagnosis);
     const published2 = options.rootDir ? await publishStrategyLiveDiagnosis({
-      rootDir: import_node_path2.default.resolve(options.rootDir),
+      rootDir: import_node_path4.default.resolve(options.rootDir),
       diagnosis,
       sourceArtifacts: input.sourceArtifacts ?? []
     }) : null;
@@ -1542,7 +1860,7 @@ var runStrategyReleaseCommand = async (options) => {
     evidence: await collectReleaseEvidenceReferences(input.evidence ?? [])
   });
   const published = await publishStrategyRelease({
-    rootDir: import_node_path2.default.resolve(options.rootDir ?? "data/strategy-release"),
+    rootDir: import_node_path4.default.resolve(options.rootDir ?? "data/strategy-release"),
     manifest
   });
   return {