elanous 0.2.10 → 0.2.11

package/scripts/measure-gate-shards.ts

@@ -0,0 +1,309 @@
+#!/usr/bin/env bun
+/** On node-b, from a clean main checkout: bun scripts/measure-gate-shards.ts --shards 4 --measurements docs/measurements/td1-whole-gate-mechanical-2026-10-01.tsv
+ * Runs the same tracked gate test files once together and once in GT2 memory-budgeted bundles.
+ * Missing TSV planning rows are measured individually on this machine before either comparison run;
+ * allow time for that calibration when the historical TSV is stale. No guessed RSS is used.
+ * Each mode uses the same machine, Bun executable and deterministic test environment. stdout is one JSON line;
+ * stderr contains diagnostics. RSS is the maximum sampled sum of process-group RSS (50 ms resolution).
+ * Peak RSS is sampling-dependent and excludes memory after a process leaves its group.
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, rmdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { planGateTestShards } from '../src/self-dev/shard-plan.js';
+import { prepareIsolatedTestEnv, deriveCdpTestPatterns } from './test-deterministic.js';
+
+export interface GateMeasurement {
+  mode: 'unsharded' | 'sharded';
+  durationMs: number;
+  peakRssMb: number;
+  // Confirmed OOMs only; an unknown termination is counted separately.
+  oomCount: number;
+  unknownTerminations: number;
+  oomCountStatus: 'confirmed' | 'partial';
+  verdict: 'passed' | 'failed' | 'unmeasured';
+  cases: Record<string, 'passed' | 'failed'>;
+  runs: number;
+}
+
+export interface GateComparison {
+  commit: string;
+  machine: string;
+  files: number;
+  shards: number;
+  unsharded: GateMeasurement;
+  sharded: GateMeasurement;
+  verdictAgrees: boolean;
+}
+
+export function readGateMeasurements(path: string): { rss: Map<string, number>; seconds: Map<string, number> } {
+  const lines = readFileSync(path, 'utf8').trimEnd().split(/\r?\n/);
+  const header = lines.shift()?.split('\t') ?? [];
+  const fileAt = header.indexOf('file'), rssAt = header.indexOf('rss_mb'), secondsAt = header.indexOf('secs');
+  if (fileAt < 0 || rssAt < 0 || secondsAt < 0) throw new Error('measurement TSV needs file, rss_mb and secs columns');
+  const rss = new Map<string, number>(), seconds = new Map<string, number>();
+  for (const line of lines) {
+    const cells = line.split('\t');
+    const file = cells[fileAt], mb = Number(cells[rssAt]), sec = Number(cells[secondsAt]);
+    if (!file || rss.has(file) || !cells[rssAt] || !cells[secondsAt] || !Number.isFinite(mb) || mb <= 0 || !Number.isFinite(sec) || sec < 0) {
+      throw new Error(`invalid measurement row: ${line}`);
+    }
+    rss.set(file, mb);
+    seconds.set(file, sec);
+  }
+  return { rss, seconds };
+}
+
+function git(repo: string, args: string[]): string {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (result.status !== 0) throw new Error(`git ${args[0]} failed: ${result.stderr.trim()}`);
+  return result.stdout.trim();
+}
+
+export function trackedGateFiles(repo: string): { commit: string; files: string[] } {
+  if (git(repo, ['rev-parse', '--show-toplevel']) !== resolve(repo)) throw new Error('run from the repository root');
+  if (git(repo, ['symbolic-ref', '--short', 'HEAD']) !== 'main') throw new Error('measurement requires the main checkout');
+  if (git(repo, ['status', '--porcelain'])) throw new Error('measurement requires a clean main checkout');
+  const commit = git(repo, ['rev-parse', 'HEAD']);
+  const files = git(repo, ['ls-files', '*.test.*']).split('\n').filter((file) => /\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file))
+    .filter((file) => !file.split('/').some((part) => part.startsWith('.'))).sort();
+  if (!files.length) throw new Error('no gate tests found');
+  return { commit, files };
+}
+
+/** Fill missing in-memory planning rows from actual single-file runs, never an assumed RSS. */
+export async function calibrateMissingGateMeasurements(options: {
+  repo: string; files: readonly string[]; rss: Map<string, number>; seconds: Map<string, number>;
+}): Promise<void> {
+  const { repo, files, rss, seconds } = options;
+  const missing = files.filter((file) => !rss.has(file) || !seconds.has(file));
+  if (!missing.length) return;
+  console.error(`calibrating ${missing.length} gate files missing from the historical TSV on this machine`);
+  const root = mkdtempSync(join(tmpdir(), 'gate-shards-calibrate-'));
+  try {
+    for (const [index, file] of missing.entries()) {
+      const env = prepareIsolatedTestEnv(process.env, join(root, `env-${index}`));
+      const report = join(root, `case-${index}.xml`);
+      const started = performance.now();
+      const child = Bun.spawn(['bun', 'test', '--reporter=junit', `--reporter-outfile=${report}`, `./${file}`], {
+        cwd: repo, env, stdin: 'ignore', stdout: 'ignore', stderr: 'pipe', detached: true,
+      });
+      let peakKb = 0;
+      const sample = () => {
+        const ps = spawnSync('ps', ['-e', '-o', 'pgid=', '-o', 'rss='], { encoding: 'utf8' });
+        if (ps.status !== 0) throw new Error(`RSS calibration sampling failed: ${file}`);
+        const kb = ps.stdout.split('\n').reduce((sum, line) => {
+          const [group, value] = line.trim().split(/\s+/).map(Number);
+          return group === child.pid && Number.isFinite(value) ? sum + value! : sum;
+        }, 0);
+        peakKb = Math.max(peakKb, kb);
+      };
+      const interval = setInterval(sample, 50);
+      let stderr: string, code: number;
+      try {
+        sample();
+        stderr = await new Response(child.stderr).text();
+        code = await child.exited;
+        sample();
+      } finally { clearInterval(interval); }
+      let cases: Record<string, 'passed' | 'failed'>;
+      try { cases = readCases(readFileSync(report, 'utf8'), [file]); }
+      catch (error) { throw new Error(`calibration JUnit incomplete for ${file}: ${error}`); }
+      const failed = Object.values(cases).includes('failed');
+      if (child.signalCode || peakKb === 0 || (code !== 0 && code !== 1) || (code === 0 && failed) || (code === 1 && !failed)) {
+        throw new Error(`calibration incomplete for ${file}: code=${code} signal=${child.signalCode ?? 'none'} ${stderr.slice(-500)}`);
+      }
+      rss.set(file, Math.ceil(peakKb / 1024));
+      seconds.set(file, (performance.now() - started) / 1000);
+    }
+  } finally { rmSync(root, { recursive: true, force: true }); }
+}
+
+// Bun JUnit writes one testsuite per file. Require every expected file and every declared case,
+// including failures/errors; missing or truncated output is unmeasured, never a passing verdict.
+export function readCases(xml: string, files: readonly string[]): Record<string, 'passed' | 'failed'> {
+  const expected = new Set(files), seen = new Set<string>();
+  const cases: Record<string, 'passed' | 'failed'> = Object.create(null);
+  const suites = [...xml.matchAll(/<testsuite\b([^>]*)>([\s\S]*?)<\/testsuite>/g)];
+  if (!/<testsuites\b/.test(xml) || !/<\/testsuites>\s*$/.test(xml)) throw new Error('incomplete JUnit document');
+  const attr = (text: string, key: string) => new RegExp(`\\b${key}="([^"]*)"`).exec(text)?.[1];
+  for (const [, attrs, body] of suites) {
+    const file = attr(attrs!, 'file') ?? attr(attrs!, 'name');
+    if (!file || !expected.has(file) || seen.has(file)) throw new Error(`unexpected or repeated JUnit suite: ${file}`);
+    seen.add(file);
+    const tests = Number(attr(attrs!, 'tests'));
+    const entries = [...body!.matchAll(/<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g)];
+    if (!Number.isSafeInteger(tests) || tests < 1 || entries.length !== tests) throw new Error(`incomplete JUnit suite: ${file}`);
+    for (const [, properties, contents] of entries) {
+      const name = attr(properties!, 'name'), caseFile: string = attr(properties!, 'file') ?? file;
+      const className = attr(properties!, 'classname');
+      if (!name || caseFile !== file || /<skipped\b/.test(contents ?? '')) throw new Error(`incomplete JUnit case: ${file}`);
+      const id = `${file} > ${className && className !== file ? `${className} > ` : ''}${name}`;
+      if (id in cases) throw new Error(`duplicate JUnit case: ${id}`);
+      cases[id] = /<(?:failure|error)\b/.test(contents ?? '') ? 'failed' : 'passed';
+    }
+  }
+  if (seen.size !== expected.size) throw new Error(`missing JUnit suites: ${[...expected].filter((file) => !seen.has(file)).join(', ')}`);
+  return cases;
+}
+
+// A private cgroup records kernel-attributed OOM kills for exactly one test bundle.
+// A host without delegated cgroup v2 write access cannot classify abnormal exits as OOM.
+function oomKills(path: string): number {
+  const line = readFileSync(join(path, 'memory.events'), 'utf8').split('\n').find((entry) => entry.startsWith('oom_kill '));
+  const value = Number(line?.slice('oom_kill '.length));
+  if (!line || !Number.isSafeInteger(value) || value < 0) throw new Error(`invalid cgroup oom_kill counter: ${path}`);
+  return value;
+}
+
+interface Run { code: number | null; signal: string | null; xml: string; stderr: string; oomKills: number | null }
+
+export async function measureGateComparison(options: {
+  repo: string; files: string[]; commit: string; shards: number; rss: ReadonlyMap<string, number>;
+  seconds: ReadonlyMap<string, number>; budgetGiB?: number;
+  /** Fixture-only cgroup filesystem; production always uses the calling process's cgroup v2. */
+  cgroupRoot?: string;
+  /** Test-only creation hook for a synthetic cgroup v2 fixture. */
+  onCgroupCreated?: (path: string) => void;
+}): Promise<GateComparison> {
+  const { repo, files, commit, shards, rss, seconds } = options;
+  if (!Number.isSafeInteger(shards) || shards < 1 || files.length === 0 || new Set(files).size !== files.length) throw new Error('invalid shard count or files');
+  const bundles = planGateTestShards(files, rss, seconds, options.budgetGiB ?? 8, shards);
+  const root = mkdtempSync(join(tmpdir(), 'gate-shards-measure-'));
+  const cgroup = options.cgroupRoot ?? (() => {
+    try {
+      const entry = readFileSync('/proc/self/cgroup', 'utf8').split('\n').find((line) => line.startsWith('0::'));
+      if (!entry) return null;
+      const path = resolve('/sys/fs/cgroup', `.${entry.slice(3)}`);
+      return path.startsWith('/sys/fs/cgroup/') || path === '/sys/fs/cgroup' ? path : null;
+    } catch { return null; } // macOS and hosts without cgroup v2 report partial OOM counts.
+  })();
+  const measure = async (mode: GateMeasurement['mode'], groups: string[][]): Promise<GateMeasurement> => {
+    const started = performance.now();
+    const testRoot = join(root, mode);
+    mkdirSync(testRoot);
+    const env = prepareIsolatedTestEnv(process.env, testRoot);
+    const reports = groups.map((_, index) => join(root, `${mode}-${index}.xml`));
+    // Record total RSS of the concurrently running test process groups, not the wrapper's RSS.
+    const running = new Set<number>();
+    let peakKb = 0;
+    const sample = () => {
+      if (!running.size) return;
+      const ps = spawnSync('ps', ['-e', '-o', 'pgid=', '-o', 'rss='], { encoding: 'utf8' });
+      if (ps.status !== 0) throw new Error('RSS sampling failed');
+      const kb = ps.stdout.split('\n').reduce((sum, line) => {
+        const [group, rssKb] = line.trim().split(/\s+/).map(Number);
+        return running.has(group!) && Number.isFinite(rssKb) ? sum + rssKb! : sum;
+      }, 0);
+      peakKb = Math.max(peakKb, kb);
+    };
+    const runs: Run[] = [];
+    let interval: ReturnType<typeof setInterval> | undefined;
+    try {
+      await Promise.all(groups.map(async (group, index) => {
+        // Bundles share the mode's isolated environment but have separate Bun process groups.
+        const cmd = ['bun', 'test', '--reporter=junit', `--reporter-outfile=${reports[index]}`, ...group.map((file) => `./${file}`)];
+        let groupPath: string | null = null;
+        if (cgroup) {
+          try {
+            groupPath = join(cgroup, `gate-shards-${process.pid}-${index}-${mode}-${root.split('/').at(-1)}`);
+            mkdirSync(groupPath);
+            options.onCgroupCreated?.(groupPath);
+            oomKills(groupPath);
+          } catch {
+            if (groupPath) { try { rmdirSync(groupPath); } catch { /* No delegated cleanup access. */ } }
+            groupPath = null;
+          }
+        }
+        // The shell blocks before exec: assign its PID to the private cgroup first.
+        // exec retains the PID; descendants inherit the same group and memory.events.
+        const child = Bun.spawn(groupPath ? ['bash', '-c', 'read -r _ || exit 125; exec "$@"', 'gate-shards', ...cmd] : cmd, {
+          cwd: repo, env: options.cgroupRoot && groupPath ? { ...env, ELANOUS_GATE_MEASURE_CGROUP_DIR: groupPath } : env,
+          stdin: groupPath ? 'pipe' : 'ignore', stdout: 'ignore', stderr: 'pipe', detached: true,
+        });
+        let attached = false;
+        if (groupPath) {
+          try {
+            writeFileSync(join(groupPath, 'cgroup.procs'), String(child.pid));
+            attached = true;
+          } catch { /* Without attachment a cgroup OOM counter is not attributable. */ }
+          if (attached) child.stdin!.write('\n');
+          else child.kill(); // Fail closed rather than run an untracked wrapper.
+          child.stdin!.end();
+        }
+        running.add(child.pid);
+        if (!interval) interval = setInterval(sample, 50);
+        sample();
+        const stderr = await new Response(child.stderr).text();
+        const code = await child.exited;
+        sample();
+        running.delete(child.pid);
+        let count: number | null = null;
+        if (groupPath) {
+          try {
+            if (attached) count = oomKills(groupPath);
+          } catch { /* Lost attribution: do not report a definitive zero. */ }
+          try { rmdirSync(groupPath); } catch { /* Another live process may still occupy it. */ }
+        }
+        let xml = '';
+        try { xml = readFileSync(reports[index]!, 'utf8'); } catch { /* An absent JUnit is unmeasured. */ }
+        runs[index] = { code, signal: child.signalCode, xml, stderr, oomKills: count };
+      }));
+    } finally { if (interval) clearInterval(interval); }
+    const cases: Record<string, 'passed' | 'failed'> = Object.create(null);
+    // Only kernel OOM kills attributed to the bundle's private cgroup count.
+    // Neither test stderr nor SIGKILL/137 establishes an OOM cause.
+    let oomCount = 0;
+    let unknownTerminations = 0, complete = true;
+    for (const [index, run] of runs.entries()) {
+      if (run.oomKills !== null) oomCount += run.oomKills;
+      if ((run.signal || (run.code !== 0 && run.code !== 1)) && !run.oomKills) unknownTerminations++;
+      if (run.oomKills) complete = false;
+      try {
+        const batch = readCases(run.xml, groups[index]!);
+        const hasFailure = Object.values(batch).includes('failed');
+        if (![0, 1].includes(run.code ?? -1) || run.signal || (run.code === 0 && hasFailure) || (run.code === 1 && !hasFailure)) complete = false;
+        Object.assign(cases, batch);
+      } catch { complete = false; }
+      if (run.signal || (run.code !== 0 && run.code !== 1)) console.error(`${mode} bundle ${index}: signal=${run.signal ?? 'none'} code=${run.code ?? 'null'} ${run.stderr.slice(-500)}`);
+    }
+    if (peakKb === 0) complete = false;
+    return { mode, durationMs: Math.round(performance.now() - started), peakRssMb: Math.ceil(peakKb / 1024), oomCount, unknownTerminations, oomCountStatus: runs.some((run) => run.oomKills === null) ? 'partial' : 'confirmed',
+      verdict: !complete ? 'unmeasured' : Object.values(cases).includes('failed') ? 'failed' : 'passed', cases, runs: groups.length };
+  };
+  try {
+    const unsharded = await measure('unsharded', [files]);
+    const sharded = await measure('sharded', bundles.map((bundle) => bundle.files));
+    const verdictAgrees = unsharded.verdict !== 'unmeasured' && sharded.verdict !== 'unmeasured'
+      && unsharded.verdict === sharded.verdict
+      && JSON.stringify(Object.entries(unsharded.cases).sort()) === JSON.stringify(Object.entries(sharded.cases).sort());
+    return { commit, machine: (await import('node:os')).hostname(), files: files.length, shards: bundles.length, unsharded, sharded, verdictAgrees };
+  } finally { rmSync(root, { recursive: true, force: true }); }
+}
+
+export async function main(argv: string[] = process.argv.slice(2), repo = process.cwd()): Promise<number> {
+  const take = (flag: string): string | undefined => { const index = argv.indexOf(flag); return index < 0 ? undefined : argv[index + 1]; };
+  if (argv.includes('--help')) {
+    console.error('bun scripts/measure-gate-shards.ts --shards N --measurements <TSV> [--budget-gib 8] (clean main checkout on node-b)');
+    return 0;
+  }
+  const count = Number(take('--shards'));
+  const source = take('--measurements');
+  if (!source || !Number.isSafeInteger(count) || count < 1) throw new Error('--shards N and --measurements TSV are required');
+  const budgetGiB = take('--budget-gib') === undefined ? 8 : Number(take('--budget-gib'));
+  const { commit, files: tracked } = trackedGateFiles(repo);
+  const cdp = new Set(deriveCdpTestPatterns({ cwd: repo }));
+  // Match the deterministic whole-gate CDP exclusion; keep every other tracked test, including install.
+  const files = tracked.filter((file) => !cdp.has(file));
+  const { rss, seconds } = readGateMeasurements(resolve(repo, source));
+  await calibrateMissingGateMeasurements({ repo, files, rss, seconds });
+  const result = await measureGateComparison({ repo, files, commit, shards: count, rss, seconds, budgetGiB });
+  process.stdout.write(JSON.stringify(result) + '\n');
+  return result.verdictAgrees ? 0 : 1;
+}
+
+if (import.meta.main) {
+  try { process.exitCode = await main(); }
+  catch (error) { console.error(error); process.exitCode = 2; }
+}

package/scripts/mission-request-judge.ts

@@ -10,9 +10,14 @@ import { judgeMissionRequests } from '../src/mission-loop/judge.js';
 import { unknownCronFlag } from '../src/domains/cron-flag-contract.js';
 import { ensureCronNodePath } from '../src/domains/cron-path.js';
 import { registerStandaloneLogSink } from '../src/domains/standalone-log-sink.js';
+import { debug } from '../src/debug/log.js';
 
 export type CreateHarnessGoal = (goal: HarnessGoal) => Promise<void> | void;
 
+function logJudge(event: string, data: Record<string, unknown>): void {
+  try { debug.log('mission-fabric.judge', event, data); } catch { /* observation must not change a judgment */ }
+}
+
 /**
  * ⛔ 실패해도 «여기까지 본 것」을 잃지 않는다.
  * 📏 회귀(리뷰 2R must-fix): 카탈로그가 없을 때 옛 CLI 는 「📍 권위 트리 / 📍 요청 카탈로그」 두 줄을
@@ -73,8 +78,23 @@ export async function runMissionRequestJudge(argv: readonly string[], dependenci
   };
   const authorityRoot = resolve(flag('--root') ?? join(dirname(new URL(import.meta.url).pathname), '..'));
   const result = judgeMissionRequests(authorityRoot);
+  logJudge('requests-judged', {
+    authorityRoot: result.authorityRoot, requestCatalog: result.requestCatalog,
+    catalogStatus: result.catalogStatus, requestsScanned: result.requestsScanned,
+    candidateCount: result.judgments.filter(judgment => judgment.status === 'blueprint-candidate').length,
+    invalidCount: result.invalidCount,
+  });
+  for (const judgment of result.judgments) {
+    logJudge('request-decision', {
+      file: judgment.file, status: judgment.status,
+      ...(judgment.status === 'invalid-request' ? { reasons: judgment.reasons } : {}),
+      ...(judgment.status === 'missing-capability' ? { missingCapabilities: judgment.missingCapabilities.map(capability => capability.id) } : {}),
+      ...(judgment.status === 'missing-blueprint' ? { reason: 'missing-blueprint' } : {}),
+    });
+  }
   const lines = [`📍 권위 트리: ${result.authorityRoot}`, `📍 요청 카탈로그: ${result.requestCatalog}`];
   if (result.catalogStatus === 'missing') {
+    logJudge('skipped', { reason: 'request-catalog-missing', requestCatalog: result.requestCatalog });
     const message = '⛔ 요청 카탈로그가 «없다» — 「요청 0건」이 아니라 ***디렉토리 부재***다. root 를 확인하라.';
     throw new MissionRequestJudgeError(message, [...lines, message]);
   }
@@ -91,13 +111,23 @@ export async function runMissionRequestJudge(argv: readonly string[], dependenci
     else lines.push(`✅ ${judgment.file} ⇒ 스키마 통과 · 능력 ${judgment.capabilityCount}개`, '   🟢 블루프린트 «후보» 있음 → 검증 ⑴~⑷');
   }
   lines.push(`📏 훑은 ${result.requestsScanned} · invalid ${result.invalidCount}`);
-  if (!argv.includes('--tick')) return lines;
+  if (!argv.includes('--tick')) {
+    logJudge('skipped', { reason: 'tick-not-requested' });
+    return lines;
+  }
 
   const cycle = dependencies.runCompositeCycle
     ? await dependencies.runCompositeCycle(authorityRoot)
     : await runCompositeCycle(authorityRoot, { createHarnessGoal: dependencies.createHarnessGoal ?? createHarnessGoal });
   lines.push(`🔁 복합 회차 ${cycle.actions.length}건`);
+  if (cycle.actions.length === 0) logJudge('skipped', { reason: 'no-cycle-actions' });
   for (const action of cycle.actions) {
+    logJudge('cycle-decision', {
+      requestId: action.requestId, action: action.action,
+      ...(action.action === 'escalated' || action.action === 'ignored' ? { reason: action.reason } : {}),
+      ...(action.action === 'goal-created' ? { paths: action.goal.paths } : {}),
+      ...(action.action === 'executed' ? { fileDelivery: action.fileDelivery.status } : {}),
+    });
     if (action.action === 'executed') {
       const delivery = action.fileDelivery.status === 'persisted'
         ? `file-delivery persisted · ${action.fileDelivery.path} · ${action.fileDelivery.bytes} bytes`

package/scripts/morning-report.ts

@@ -31,7 +31,7 @@ const report = await composeMorningReport(new Date(), { narrate, heatmapImageUrl
 if (dry) {
   console.log(report);
 } else {
-  const sent = await sendTelegramReport(cfg, report, { markdown: true });
+  const sent = await sendTelegramReport(cfg, report, { markdown: true, kind: 'report' });
   console.error(sent
     ? '[morning-report] sent to report channel ✓'
     : '[morning-report] no report channel configured — skipped');
@@ -39,7 +39,7 @@ if (dry) {
   // 히트맵 이미지 첨부(위에서 캡처한 URL 재사용). fail-soft.
   if (heatmapImageUrl) {
     try {
-      const ok = await sendReportPhoto(cfg, heatmapImageUrl, { caption: '🗺️ S&P 500 히트맵 (finviz)' });
+      const ok = await sendReportPhoto(cfg, heatmapImageUrl, { caption: '🗺️ S&P 500 히트맵 (finviz)', kind: 'report' });
       console.error(ok ? '[morning-report] heatmap image sent ✓' : '[morning-report] heatmap: no report channel');
     } catch (e) { console.error(`[morning-report] heatmap image error: ${e instanceof Error ? e.message : String(e)}`); }
   }

package/scripts/opportunity-scan.ts

@@ -54,7 +54,7 @@ const report = parts.join('\n');
 if (dry) {
   console.log(report);
 } else {
-  const sent = await sendTelegramReport(cfg, report, { markdown: true });
+  const sent = await sendTelegramReport(cfg, report, { markdown: true, kind: 'report' });
   console.error(sent
     ? '[opportunity-scan] sent to report channel ✓'
     : '[opportunity-scan] no report channel — printing:\n' + report);

package/scripts/release-loop/auto-approve-node.ts

@@ -4,15 +4,26 @@ import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
+import { regressWarning, validatedTuiRegress } from './tui-node-checks.js';
 
 export type MetricVerdict = 'pass' | 'fail' | 'unmeasured';
-export interface ApprovalMetric { name: string; value: string; verdict: MetricVerdict }
+export interface ApprovalMetric { name: string; value: string; verdict: MetricVerdict; reason?: string }
 
 const outcomeMetric = (name: string, node: Record<string, unknown> | undefined): ApprovalMetric => ({
   name, value: node?.outcome === undefined ? 'missing' : String(node.outcome),
   verdict: node?.outcome === undefined ? 'unmeasured' : node.outcome === 'ok' ? 'pass' : 'fail',
 });
 
+/** Rows shown in auto-approval.md but never counted toward the 8 blocking metrics. */
+const WARNING_ONLY = new Set(['tui-regress', 'mac-smoke']);
+
+/** `ok` · `warn` (a failure) · `unmeasured` (error or no output) — the macOS smoke never blocks publishing. */
+function macSmokeLevel(node: Record<string, unknown> | undefined): 'ok' | 'warn' | 'unmeasured' {
+  if (node?.outcome === 'ok') return 'ok';
+  if (node?.outcome === 'fail') return 'warn';
+  return 'unmeasured';
+}
+
 export function runAutoApprove(context: GraphContext = readGraphContext(), deps: { instanceRoot?: string; repo?: string; bunVersion?: string } = {}) {
   const { version } = context.input;
   const root = deps.instanceRoot ?? effectiveInstanceRoot();
@@ -30,6 +41,8 @@ export function runAutoApprove(context: GraphContext = readGraphContext(), deps:
     catch { distCount = undefined; }
   }
   const gateErrorAbsent = gate && !Object.hasOwn(gate, 'error');
+  const regressStatus = regressWarning(validatedTuiRegress(context.outputs.tui?.regress));
+  const macSmoke = context.outputs['mac-smoke'];
   const metrics: ApprovalMetric[] = [
     { name: 'gate regressions and measurement', value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
       verdict: !gate || gate.outcome === undefined || !Array.isArray(gate.introduced) ? 'unmeasured'
@@ -47,16 +60,20 @@ export function runAutoApprove(context: GraphContext = readGraphContext(), deps:
     { name: 'installation files', value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
       verdict: prepare?.outcome !== 'ok' ? prepare?.outcome === undefined ? 'unmeasured' : 'fail'
         : distCount === undefined ? 'unmeasured' : distCount === 5 ? 'pass' : 'fail' },
+    // Warning-only and last, so the numbered rows 1–8 keep their places in auto-approval.md (V1g follow-up).
+    { name: 'tui-regress', value: regressStatus.level, reason: regressStatus.line, verdict: 'pass' },
+    // MAC1: the macOS smoke is warning-only too (ship with known issues) — shown, never counted.
+    { name: 'mac-smoke', value: macSmokeLevel(macSmoke), reason: typeof macSmoke?.summary === 'string' ? macSmoke.summary : undefined, verdict: 'pass' },
   ];
-  const outcome = metrics.every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
+  const outcome = metrics.filter((metric) => !WARNING_ONLY.has(metric.name)).every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
   const report = join(root, 'release', version, 'auto-approval.md');
   const lines = [`# v${version} auto-approval`, '', `Outcome: ${outcome}`, '', '| # | Metric | Value | Verdict |', '|---|---|---|---|',
-    ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${metric.value.replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
+    ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${[metric.value, metric.reason].filter(Boolean).join(' — ').replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
     '', '## 되돌리는 법', `gh release edit v${version} --draft`, `git tag -d v${version} && git push origin :refs/tags/v${version}`, '해당 docs PR revert', ''];
   mkdirSync(dirname(report), { recursive: true });
   writeFileSync(report, lines.join('\n'));
   debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics });
-  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => metric.verdict === 'pass').length}/8`,
+  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => !WARNING_ONLY.has(metric.name) && metric.verdict === 'pass').length}/8`,
     ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
 }
 

package/scripts/release-loop/cut-branch.ts

@@ -0,0 +1,84 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+
+export interface CutBranchOptions { version: string; base: string; pick: string[]; dryRun?: boolean; repoRoot?: string; log?: (line: string) => void }
+
+// git-spawn-allow: release branch operations happen only in an isolated temporary worktree; main is never checked out or changed.
+function git(repo: string, args: string[]): string {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (result.status !== 0 || result.error) throw new Error(`git ${args[0]} failed: ${(result.stderr || result.error || result.stdout || 'no output').toString().trim()}`);
+  return result.stdout.trim();
+}
+
+function ancestor(repo: string, sha: string, ref: string): boolean {
+  const result = spawnSync('git', ['merge-base', '--is-ancestor', sha, ref], { cwd: repo });
+  if (result.status !== 0 && result.status !== 1) throw new Error(`git merge-base failed: ${result.error || result.stderr || 'unknown'}`);
+  return result.status === 0;
+}
+
+export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; commit: string | null; dryRun: boolean } {
+  const repo = resolve(opts.repoRoot ?? process.cwd());
+  const branch = `release/${opts.version}`;
+  const log = opts.log ?? console.log;
+  const report = (event: 'created' | 'refused' | 'conflict', reason?: string, commit?: string) =>
+    debug.log('release-loop.cut-branch', event, { version: opts.version, branch, ...(commit ? { commit } : {}), ...(reason ? { reason } : {}) });
+  try {
+    if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
+    if (!opts.pick.length) throw new Error('at least one --pick commit is required');
+    for (const sha of [opts.base, ...opts.pick]) if (!/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
+    git(repo, ['fetch', 'origin', 'main']);
+    const base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
+    if (!ancestor(repo, base, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
+    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
+    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
+    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
+    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
+    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
+    if (git(repo, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`])) throw new Error(`${branch} already exists on origin`);
+    if (spawnSync('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`], { cwd: repo }).status === 0) throw new Error(`${branch} already exists locally`);
+    const pkg = JSON.parse(git(repo, ['show', `${base}:package.json`])) as { version?: unknown };
+    if (pkg.version !== opts.version) throw new Error(`base package.json version ${pkg.version} is not ${opts.version}`);
+    log(`${branch}: ${base} + ${picks.join(' + ')}${opts.dryRun ? ' (dry-run)' : ''}`);
+    if (opts.dryRun) return { branch, commit: null, dryRun: true };
+    const temp = mkdtempSync(join(tmpdir(), 'release-cut-branch-'));
+    const tree = join(temp, 'tree');
+    let added = false;
+    let commit: string | undefined;
+    try {
+      git(repo, ['worktree', 'add', '--detach', tree, base]);
+      added = true;
+      for (const sha of picks) {
+        try { git(tree, ['cherry-pick', sha]); }
+        catch (error) {
+          const files = git(tree, ['diff', '--name-only', '--diff-filter=U']);
+          if (!files) throw error;
+          report('conflict', `cherry-pick ${sha}`);
+          throw new Error(`cherry-pick ${sha} 충돌 — 손으로 풀 곳: ${files.split('\n').join(', ')} (release/${opts.version} 가지는 만들지 않음)`);
+        }
+      }
+      commit = git(tree, ['rev-parse', 'HEAD']);
+      const finalPackage = JSON.parse(git(tree, ['show', 'HEAD:package.json'])) as { version?: unknown };
+      if (finalPackage.version !== opts.version) throw new Error(`picked branch package.json version ${finalPackage.version} is not ${opts.version}`);
+    } finally {
+      try {
+        if (added) git(repo, ['worktree', 'remove', '--force', tree]);
+      } finally { rmSync(temp, { recursive: true, force: true }); }
+    }
+    if (!commit) throw new Error('cherry-pick produced no commit');
+    const push = git(repo, ['push', '--porcelain', `--force-with-lease=refs/heads/${branch}:`, 'origin', `${commit}:refs/heads/${branch}`]);
+    const newBranch = push.split('\n').some((line) => {
+      const [flag, ref, summary] = line.split('\t');
+      return flag === '*' && ref?.endsWith(`:refs/heads/${branch}`) && summary === '[new branch]';
+    });
+    if (!newBranch) throw new Error(`${branch} already exists on origin (push did not create a new branch)`);
+    report('created', undefined, commit);
+    log(`${branch} → ${commit}`);
+    return { branch, commit, dryRun: false };
+  } catch (error) {
+    if (!(error instanceof Error && error.message.includes('충돌'))) report('refused', error instanceof Error ? error.message : String(error));
+    throw error;
+  }
+}

package/scripts/release-loop/gate-node.ts

@@ -125,13 +125,14 @@ export const POD_MEMORY_SOURCE = 'docs/measurements/td1-whole-gate-mechanical-20
 export const POD_SHARD_FILE_CAP = 27;
 
 export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts'];
-/** Whole-repository audits run alone in the nightly test-diet graph, not in release-gate shards. */
+/** Nightly-only whole-repository cases; gate runs the fixture cases in these same files. */
 export const GATE_NIGHTLY_AUDITS: readonly string[] = [
-  'test/f12-sweep.test.ts', // Sweeps the whole repository; 7.8 GB even after TD1a.
-  'scripts/unwired-exports.test.ts', // Compiles and scans all exports; 9.9 GB.
-  'test/guardian/dispatch-surface-contract.test.ts', // Compiles repository-wide dispatch contracts; 8.3 GB.
-  'test/pwa-build-typecheck.test.ts', // Builds and typechecks the whole PWA; 4.2 GB.
-  'test/user-config-mcp.test.ts', // 2.1 GB peak; keep the gate below the 2 GB audit budget.
+  // Replaces F12's real-repo bucket B apps/pwa scope check and its whole-repo export partition check.
+  'test/f12-sweep.test.ts',
+  // Replaces unwired-exports' real src/oauth caller check and its src/ad-pipeline CLI scan.
+  'scripts/unwired-exports.test.ts',
+  // Replaces pwa-build-typecheck's full root tsc and PWA tsc sweeps (PWA build also runs in the release loop).
+  'test/pwa-build-typecheck.test.ts',
 ];
 const tail40 = (output: string) => output.trimEnd().split(/\r?\n/).slice(-40).join('\n');
 const lastStartedTestFile = (output: string, paths: string[]): string | undefined => {
@@ -219,15 +220,15 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // CDP 시험은 `test:deterministic` 이 스스로 뺀다 — 조각에 그것만 남으면 bun «시험 없음» exit 1 을 «불완전»으로 읽었다(09-30 G1d 실측 둘).
     // bun 의 탐색은 숨은 디렉터리(`.x/`)를 안 연다 — 사람의 `bun test` 가 한 번도 안 돌리는 빈 픽스처가 조각에 혼자 남아 «Ran 0 tests» 를 «불완전»으로 읽었다(09-30 G1e 5번 조각).
     const assignable = files.filter((file) => !cdpPatterns.includes(file) && !POD_SWEEP_INTEGRATION_ONLY.includes(file)
-      && !GATE_NIGHTLY_AUDITS.includes(file) && !file.split('/').some((part) => part.startsWith('.')));
+      && !file.split('/').some((part) => part.startsWith('.')));
     const integrationOnly = files.filter((file) => POD_SWEEP_INTEGRATION_ONLY.includes(file));
     if (integrationOnly.length) debug.log('release-loop.gate', 'pod-sweep-integration-only', { files: integrationOnly });
-    const nightlyAudits = files.filter((file) => GATE_NIGHTLY_AUDITS.includes(file));
-    if (nightlyAudits.length) debug.log('release-loop.gate', 'pod-sweep-nightly-audit', { files: nightlyAudits });
     if (!assignable.length) throw new Error('sweep incomplete: no tests ran');
     const durations = pod.durationSource ? readFileDurations(pod.durationSource) : new Map<string, number>();
     const memory = readFileMemory(join(tree, POD_MEMORY_SOURCE));
-    const heavy = new Set(assignable.filter((file) => (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
+    // The TD1 measurements predate the fixture-only gate; do not isolate those five files at their old 2–13 GB peaks.
+    const fixtureOnly = new Set([...GATE_NIGHTLY_AUDITS, 'test/guardian/dispatch-surface-contract.test.ts', 'test/user-config-mcp.test.ts']);
+    const heavy = new Set(assignable.filter((file) => !fixtureOnly.has(file) && (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
     const light = assignable.filter((file) => !heavy.has(file));
     const shards = [
       ...(light.length ? planShards(light, durations, shardCount) : []),
@@ -437,9 +438,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const outputs: string[] = [];
       let total = { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 };
       for (const group of groups) {
-        if (!group.paths.length || !files.some((f) => !GATE_NIGHTLY_AUDITS.includes(f) && group.paths.some((p) => f === p || f.startsWith(`${p}/`)))) continue;
+        if (!group.paths.length || !files.some((f) => group.paths.some((p) => f === p || f.startsWith(`${p}/`)))) continue;
         const start = Date.now();
-        const groupIgnores = [...new Set([...cdpPatterns, ...GATE_NIGHTLY_AUDITS])]
+        const groupIgnores = [...new Set(cdpPatterns)]
           .filter((pattern) => files.includes(pattern) && group.paths.some((p) => pattern === p || pattern.startsWith(`${p}/`)))
           .flatMap((pattern) => ['--path-ignore-patterns', pattern]);
         const run = await command('bun', ['run', 'test:deterministic', ...groupIgnores, ...group.paths.map(asPath)], tree);
@@ -508,7 +509,7 @@ function readBaseline(root: string, version: string): { commit: string; failures
   return record;
 }
 
-function baselineCommit(root: string, version: string): string {
+export function baselineCommit(root: string, version: string): string {
   const path = join(root, 'release', version, 'release.json');
   const manifest: unknown = JSON.parse(readFileSync(path, 'utf8'));
   const commit = manifest && typeof manifest === 'object' && 'sourceCommit' in manifest ? manifest.sourceCommit : undefined;