elanous 0.2.22 → 0.2.23

package/catalog/models/openai/gpt-6-astra.yaml

@@ -9,6 +9,12 @@ family: gpt-6
 #     sharing a catalog generation family"*. 그 기전을 쓴다(grok 이 이미 이 방식이다).
 #   ⇒ 이제 `sol` 별칭의 후보는 {gpt-6-sol, gpt-5.6-sol} 이고 최신이 «하나»로 정해진다.
 familyShortcut: astra
+# 📏 창·출력 상한 — 2026-10-10 MK(MODEL-ROUTING-MATRIX) · 출처 둘이 «같은 값»일 때만 채운다:
+#   ⑴ developers.openai.com/api/내부 문서 `gpt-6-astra` (2026-09-23 대조 · src/intelligence-map/model-catalog.ts 의 contextWindow 1_050_000 ⊕ sol·astra notes «입력 922K · 출력 128K»)
+#   ⑵ OpenRouter `GET /api/v1/models` 실호출 2026-10-10T05:10Z — openai/gpt-6-astra: context_length 1050000 · top_provider.max_completion_tokens 128000
+#   ⛔ 이 칸이 비어 있으면 `resolver` 의 minContextSize 판정이 `contextSize ?? 0` 으로 읽어 이 모델을 «창 0»으로 떨군다.
+contextSize: 1050000
+outputMaxTokens: 128000
 # 출시일 — 「unknown-missing-release-date」를 «승인 목록에 더하지 않고» 없앤다.
 #   출처: developers.openai.com/api/내부 문서 `gpt-6-astra` ⊕ 2026-09-09 구독 실측
 releaseDate: 2026-09-03

package/catalog/models/openai/gpt-6-luna.yaml

@@ -9,6 +9,12 @@ family: gpt-6
 #     sharing a catalog generation family"*. 그 기전을 쓴다(grok 이 이미 이 방식이다).
 #   ⇒ 이제 `sol` 별칭의 후보는 {gpt-6-sol, gpt-5.6-sol} 이고 최신이 «하나»로 정해진다.
 familyShortcut: luna
+# 📏 창·출력 상한 — 2026-10-10 MK(MODEL-ROUTING-MATRIX) · 창은 출처 둘이 같은 값 · 출력은 ⑵ 하나(아래):
+#   ⑴ src/intelligence-map/model-catalog.ts 의 gpt-6-luna contextWindow 1_050_000 (09-23 대조) — 출력 128,000 의 luna 직접 근거는 ⑵ 하나다(같은 세대 sol·astra 의 OpenAI 문서가 출력 128K)
+#   ⑵ OpenRouter `GET /api/v1/models` 실호출 2026-10-10T05:10Z — openai/gpt-6-luna: context_length 1050000 · top_provider.max_completion_tokens 128000
+#   ⛔ 이 칸이 비어 있으면 `resolver` 의 minContextSize 판정이 `contextSize ?? 0` 으로 읽어 이 모델을 «창 0»으로 떨군다.
+contextSize: 1050000
+outputMaxTokens: 128000
 # 출시일 — 「unknown-missing-release-date」를 «승인 목록에 더하지 않고» 없앤다.
 #   출처: developers.openai.com/api/내부 문서 `gpt-6-luna` (2026-09-23 firecrawl 직접)
 releaseDate: 2026-09-22

package/catalog/models/openai/gpt-6-sol.yaml

@@ -9,6 +9,12 @@ family: gpt-6
 #     sharing a catalog generation family"*. 그 기전을 쓴다(grok 이 이미 이 방식이다).
 #   ⇒ 이제 `sol` 별칭의 후보는 {gpt-6-sol, gpt-5.6-sol} 이고 최신이 «하나»로 정해진다.
 familyShortcut: sol
+# 📏 창·출력 상한 — 2026-10-10 MK(MODEL-ROUTING-MATRIX) · 출처 둘이 «같은 값»일 때만 채운다:
+#   ⑴ developers.openai.com/api/내부 문서 `gpt-6-sol` (2026-09-23 대조 · src/intelligence-map/model-catalog.ts 의 contextWindow 1_050_000 ⊕ sol·astra notes «입력 922K · 출력 128K»)
+#   ⑵ OpenRouter `GET /api/v1/models` 실호출 2026-10-10T05:10Z — openai/gpt-6-sol: context_length 1050000 · top_provider.max_completion_tokens 128000
+#   ⛔ 이 칸이 비어 있으면 `resolver` 의 minContextSize 판정이 `contextSize ?? 0` 으로 읽어 이 모델을 «창 0»으로 떨군다.
+contextSize: 1050000
+outputMaxTokens: 128000
 # 출시일 — 「unknown-missing-release-date」를 «승인 목록에 더하지 않고» 없앤다.
 #   출처: developers.openai.com/api/내부 문서 `gpt-6-sol` (2026-09-23 firecrawl 직접)
 releaseDate: 2026-09-22

package/graphs/log-horizon/log-horizon-watch.yaml

@@ -0,0 +1,25 @@
+graph_id: log-horizon-watch
+loop:
+  title: Log retention horizon watch
+  owner: TC
+  trigger:
+    cron: '23 * * * *'
+    events: [manual]
+version: 1
+entry_node: sample
+terminal_nodes: [done, failed]
+nodes:
+  - node_id: sample
+    kind: agent
+    recipe: cmd:log-horizon-sample
+    max_visits: 1
+  - node_id: done
+    kind: gate
+    max_visits: 1
+  - node_id: failed
+    kind: gate
+    max_visits: 1
+edges:
+  - from: sample
+    on: outcome
+    map: { ok: done, fail: failed, error: failed }

package/graphs/log-horizon/recipes.yaml

@@ -0,0 +1,3 @@
+log-horizon-sample:
+  command: 'bun "$ELANOUS_GRAPH_DIR/../../src/mss/logging/horizon-watch.ts" --json'
+  timeout_ms: 120000

package/graphs/release/recipes.yaml

@@ -45,7 +45,7 @@ publish:
   approval: 'v{{input.version}} 공개 발행 — 되돌릴 수 없다. 승인하시겠습니까?'
 publish-command:
   command: 'bun scripts/release-loop/publish-node.ts'
-  timeout_ms: 1800000
+  # The node may wait until input.publishAt; runPublish bounds the actual publication subprocess to 30 minutes.
 npm-publish:
   command: 'bun scripts/release-loop/npm-publish-node.ts'
   # 40m default wait + two 5m commands + up to 83 bounded 15s registry inspections.

package/graphs/release/release-loop.yaml

@@ -14,13 +14,15 @@ nodes:
   - { node_id: version-release, kind: git, recipe: 'cmd:version-release', max_visits: 1 }
   - { node_id: cutoff, kind: judge, recipe: 'cmd:cutoff', max_visits: 1 }
   - { node_id: checklist-gate, kind: gate, recipe: 'cmd:checklist-gate', max_visits: 1 }
+  # cmd:docs dispatches by graph node ID: bounded prefetch before gate, TUI join after upgrade, docs write after both.
+  - { node_id: prefetch, kind: agent, recipe: 'cmd:docs', max_visits: 1 }
   - { node_id: gate, kind: gate, recipe: 'cmd:gate', max_visits: 1, notify: start }
   - { node_id: mac-smoke, kind: gate, recipe: 'cmd:mac-smoke', max_visits: 1 }
   - { node_id: export-check, kind: gate, recipe: 'cmd:export-check', max_visits: 1 }
   - { node_id: pwa, kind: gate, recipe: 'cmd:pwa', max_visits: 1, notify: start }
   - { node_id: prepare, kind: agent, recipe: 'cmd:prepare', max_visits: 1, notify: start }
   - { node_id: upgrade, kind: gate, recipe: 'cmd:upgrade', max_visits: 1 }
-  - { node_id: tui, kind: gate, recipe: 'cmd:tui', max_visits: 1 }
+  - { node_id: tui, kind: gate, recipe: 'cmd:docs', max_visits: 1 }
   - { node_id: docs, kind: agent, recipe: 'cmd:docs', max_visits: 1 }
   - { node_id: known-issues, kind: agent, recipe: 'cmd:known-issues', max_visits: 1 }
   - { node_id: notes-check, kind: gate, recipe: 'cmd:notes-check', max_visits: 1 }
@@ -39,7 +41,9 @@ nodes:
 edges:
   - { from: version-release, on: outcome, map: { ok: cutoff, fail: failed, error: failed } }
   - { from: cutoff, on: outcome, map: { ok: checklist-gate, fail: failed, error: failed } }
-  - { from: checklist-gate, on: outcome, map: { ok: gate, fail: failed, error: failed } }
+  - { from: checklist-gate, on: outcome, map: { ok: prefetch, fail: failed, error: failed } }
+  # Prefetch never gates: even a crashed prefetch node is a cache miss — the late nodes take their original paths.
+  - { from: prefetch, on: outcome, map: { ok: gate, fail: gate, error: gate } }
   - { from: gate, on: outcome, map: { ok: mac-smoke, fail: failed, error: failed } }
   # Warning-only: a macOS failure or unmeasured run never blocks publishing — auto-approve shows it as a warning row.
   - { from: mac-smoke, on: outcome, map: { ok: export-check, fail: export-check, error: export-check } }

package/graphs/release-rehearsal/recipes.yaml

@@ -0,0 +1,12 @@
+tick:
+  command: >-
+    bun -e 'const repo=process.env.ELANOUS_GRAPH_DIR+"/../..";
+    const run=Bun.spawnSync(["bun", repo+"/bin/elanous.mjs", "release", "rehearsal", "tick", "--apply", "--json"],
+    {cwd:process.env.ELANOUS_REHEARSAL_GIT_CWD || repo,stdout:"pipe",stderr:"pipe"});
+    const stdout=new TextDecoder().decode(run.stdout).trim();
+    const stderr=new TextDecoder().decode(run.stderr).trim();
+    if (run.exitCode !== 0) { let why=""; try { why=JSON.parse(stdout).error ?? ""; } catch {} throw new Error(stderr || why || "rehearsal tick exit " + run.exitCode); }
+    const result=JSON.parse(stdout);
+    if (result.ok !== true) throw new Error(result.error ?? "rehearsal tick failed");
+    console.log(JSON.stringify({outcome:"ok",tick:result}));'
+  timeout_ms: 5400000

package/graphs/release-rehearsal/release-rehearsal.yaml

@@ -0,0 +1,17 @@
+graph_id: release-rehearsal
+loop:
+  title: 판 컷 전 가벼운 RC 리허설
+  description: 판 일정의 컷 −7h · −150m 단계를 15분마다 살펴서 단계당 한 번만 실행
+  owner: OP
+  trigger:
+    cron: '*/15 * * * *'
+    events: [manual]
+version: 1
+entry_node: tick
+terminal_nodes: [done, failed]
+nodes:
+  - { node_id: tick, kind: judge, recipe: 'cmd:tick', max_visits: 1 }
+  - { node_id: done, kind: gate, max_visits: 1 }
+  - { node_id: failed, kind: gate, max_visits: 1 }
+edges:
+  - { from: tick, on: outcome, map: { ok: done, fail: failed, error: failed } }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "elanous",
   "mcpName": "io.github.ElanvitalAI/elanous",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "Self-healing coding harness where eyes, hands, and memory all turn on one sentence — it authors its own goals, implements them in isolated worktrees, and reviews its own work.",
   "license": "Apache-2.0",
   "author": "Elanvital AI",
@@ -93,10 +93,13 @@
     "@agentclientprotocol/sdk": "1.5.0",
     "@antv/infographic": "^0.2.20",
     "@aws-sdk/client-secrets-manager": "^3.1043.0",
+    "@aws-sdk/credential-provider-node": "3.972.39",
     "@discordjs/voice": "^0.19.2",
     "@google-cloud/secret-manager": "^6.1.2",
     "@google/gemini-cli": "0.38.0",
     "@google/genai": "^1.51.0",
+    "@smithy/hash-node": "4.2.14",
+    "@smithy/signature-v4": "5.3.14",
     "@xterm/headless": "^6.0.0",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",

package/scripts/bench-report.ts

@@ -1,15 +1,17 @@
 #!/usr/bin/env bun
 // 벤치 한 판(runId) → 팔 × 지표 표. RFC-fleet-supervisor-substrates-benchmark-and-token-accounting §F5 · 2026-09-25.
-//   bun scripts/bench-report.ts --run <runId> [--since 24h] [--json]
-// 입력은 호스트 로그 셋뿐이다(새 저장소 0):
+//   bun scripts/bench-report.ts --run <runId> [--since 24h] [--json] [--bn1 <관측.json>]
+// 기본 입력은 호스트 로그 셋뿐이다(새 저장소 0). BN1은 선택적 별도 관측 파일이다.
+// 기본 로그 입력:
 //   ① `self-dev.orchestrate substrate`   — 팔 선언(benchArms: id·provider·model)
 //   ② `self-implement.pod job-applied`   — spaceId ↔ armId
 //   ③ `self-dev.orchestrate job.done`    — taskId·stage·prUrl·durationMs ⊕ (E4) gatePassed·reviewVerdict·reviewMustFixCount
 //   ④ `llm-usage` site=`pod-rollup:*`    — Pod 가 잰 사용량(armId 별)
 // ⛔ runId 로만 거른다 — `--all --include-test` 의 «모든 우주»가 섞여도 runId 는 한 판이다.
 // ⛔ 이음이 끊긴 칸은 0 으로 채우지 않고 `null`(못 이음)로 둔다.
-// ⛔ 이 표로 팔을 «비교»하지 않는다 — 팔 밖 모델 행(leak)이 0이고 팔마다 표본이 쌓인 뒤에만(A/B 매뉴얼 · 결론 금지).
+// ⛔ 기본 표로 팔을 «비교»하지 않는다 — 팔 밖 모델 행(leak)이 0이고 팔마다 표본이 쌓인 뒤에만(A/B 매뉴얼 · 결론 금지). BN1도 네 팔 동일 골 측정 전 결론 금지.
 import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 export interface LogRow { category?: string; event?: string; data?: Record<string, unknown> | null }
@@ -120,6 +122,68 @@ export function buildBenchReport(rows: readonly LogRow[], runId: string): { runI
   return { runId, arms: [...arms.values()].sort((x, y) => (x.armId < y.armId ? -1 : 1)), unjoinedJobs, ...(image ? { image } : {}) };
 }
 
+export const BN1_ARMS = ['Codex', 'OpenClaw', 'Hermes', '엘라누스'] as const;
+export type Bn1Arm = typeof BN1_ARMS[number];
+export interface Bn1Input {
+  runId: string;
+  goals: Array<{ id: string; text: string }>;
+  observations: Array<{
+    goalId: string;
+    arm: Bn1Arm;
+    completed: boolean | null;
+    humanInterventions: number | null;
+    durationMs: number | null;
+    costUsd: number | null;
+    evidence: string;
+  }>;
+}
+
+/** BN1 is a separate, opt-in experiment: no inference from pod stage, calls or known-cost subtotal. */
+export function buildBn1Comparison(input: Bn1Input, runId: string) {
+  if (!input || typeof input.runId !== 'string' || !input.runId.trim() || input.runId !== runId || !Array.isArray(input.goals) || !input.goals.length || !Array.isArray(input.observations)) throw new Error('BN1: runId 또는 골 셋이 유효하지 않음');
+  const goals = new Set<string>();
+  for (const goal of input.goals) {
+    if (typeof goal?.id !== 'string' || !goal.id.trim() || typeof goal.text !== 'string' || !goal.text.trim() || goals.has(goal.id)) throw new Error('BN1: 빈 골 또는 중복 골');
+    goals.add(goal.id);
+  }
+  const observed = new Map<string, Bn1Input['observations'][number]>();
+  for (const row of input.observations) {
+    if (!row || typeof row.goalId !== 'string' || typeof row.arm !== 'string') throw new Error('BN1: 알 수 없거나 중복된 골/팔');
+    const key = `${row.goalId}\u0000${row.arm}`;
+    if (!goals.has(row.goalId) || !BN1_ARMS.includes(row.arm) || observed.has(key)) throw new Error('BN1: 알 수 없거나 중복된 골/팔');
+    if (typeof row.evidence !== 'string' || !row.evidence.trim()) throw new Error('BN1: 관측 근거가 없음');
+    if (row.completed !== null && typeof row.completed !== 'boolean') throw new Error('BN1: 완주 값은 boolean 또는 null');
+    for (const value of [row.humanInterventions, row.durationMs, row.costUsd]) {
+      if (value === undefined || (value !== null && (typeof value !== 'number' || !Number.isFinite(value) || value < 0))) throw new Error('BN1: 수치는 0 이상 또는 null');
+    }
+    if (row.humanInterventions !== null && !Number.isInteger(row.humanInterventions)) throw new Error('BN1: 사람 개입 수는 정수');
+    observed.set(key, row);
+  }
+  const comparedGoals = input.goals.map((goal) => {
+    const arms = BN1_ARMS.map((arm) => {
+      const row = observed.get(`${goal.id}\u0000${arm}`);
+      return { arm, completed: row?.completed ?? null, humanInterventions: row?.humanInterventions ?? null,
+        durationMs: row?.durationMs ?? null, costUsd: row?.costUsd ?? null, evidence: row?.evidence ?? null };
+    });
+    return { id: goal.id, text: goal.text, arms };
+  });
+  const fieldsComplete = comparedGoals.every((goal) => goal.arms.every((arm) =>
+    arm.completed !== null && arm.humanInterventions !== null && arm.durationMs !== null && arm.costUsd !== null && arm.evidence !== null));
+  return { runId, fieldsComplete, goals: comparedGoals };
+}
+
+export function renderBn1Comparison(rep: ReturnType<typeof buildBn1Comparison>): string {
+  const value = (v: number | boolean | null): string => v === null ? '못 잼' : typeof v === 'boolean' ? (v ? '완주' : '미완주') : String(v);
+  const cell = (text: string): string => text.replaceAll('|', '\\|').replaceAll('\n', '<br>');
+  return ['## BN1 · 같은 골 대조 (X1 격리 설치와 짝)', '',
+    `측정 칸 완비: ${rep.fieldsComplete ? '네 팔 관측값 기입 완료(출처와 조건 별도 검증 필요)' : '아니오 — 미관측 칸 존재'}`,
+    '', '| 골 | 공유 골 입력(미확정 가능) | 팔 | 끝까지 | 사람 개입 수 | 시간(ms) | 비용(USD) | 근거 |',
+    '|---|---|---|---|---|---|---|---|',
+    ...rep.goals.flatMap((goal) => goal.arms.map((row) => `| ${cell(goal.id)} | ${cell(goal.text)} | ${row.arm} | ${value(row.completed)} | ${value(row.humanInterventions)} | ${value(row.durationMs)} | ${value(row.costUsd)} | ${row.evidence === null ? '못 잼' : cell(row.evidence)} |`)),
+    '', 'X1 짝 실측(격리 설치·첫 실행, 개발 골 대조 아님): docs/measurements/X1-inner-pty-openclaw-hermes-install-2026-10-03.md',
+    '못 잼은 0이 아니라 미관측이다. 동일 골 네 팔의 근거가 모이기 전 비교 우열은 판정하지 않는다.'].join('\n');
+}
+
 export function renderBenchReport(rep: ReturnType<typeof buildBenchReport>): string {
   const k = (n: number): string => (n >= 10_000 ? `${Math.round(n / 1000)}k` : String(n));
   const lines = [
@@ -146,6 +210,21 @@ if (import.meta.main) {
   const arg = (name: string): string | undefined => { const i = process.argv.indexOf(name); return i > 0 ? process.argv[i + 1] : undefined; };
   const runId = arg('--run');
   if (!runId) { console.error('사용: bun scripts/bench-report.ts --run <runId> [--since 24h] [--json]'); process.exit(2); }
+  const bn1Path = arg('--bn1');
+  if (process.argv.includes('--bn1') && (!bn1Path || bn1Path.startsWith('--'))) {
+    console.error('BN1 입력 실패: --bn1 <관측.json> 경로 필요');
+    process.exit(2);
+  }
+  let bn1: ReturnType<typeof buildBn1Comparison> | undefined;
+  if (bn1Path) {
+    try { bn1 = buildBn1Comparison(JSON.parse(readFileSync(bn1Path, 'utf8')) as Bn1Input, runId); }
+    catch (error) { console.error(`BN1 입력 실패: ${error instanceof Error ? error.message : String(error)}`); process.exit(2); }
+  }
+  // BN1 external arms have no self-dev pod logs. Do not require legacy bench arms for their report.
+  if (bn1) {
+    console.log(process.argv.includes('--json') ? JSON.stringify(bn1) : renderBn1Comparison(bn1));
+    process.exit(0);
+  }
   const bin = join(dirname(import.meta.dir), 'bin', 'elanous.mjs');
   const rows: LogRow[] = [];
   for (const q of [['--category', 'self-dev.orchestrate'], ['--category', 'self-implement.pod'], ['--event', 'llm-usage']]) {

package/scripts/ci-typecheck-changed.ts

@@ -24,6 +24,15 @@ function gitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
   return env;
 }
 
+/**
+ * tsc 를 띄울 env — 호출자(runTsc)가 넘긴 env(= tscEnv · 20GB 힙)를 «바탕»으로 GIT_* 만 걷는다.
+ * 🩸 2026-10-09: 이 자리가 `env: gitEnv()`(process.env 바탕)로 덮어 tscEnv 의 힙이 사라졌다 → 호스트 재게이트 tsc 가
+ *   ≈4GB(V8 기본)에서 OOM · merge-ready 자식이 `host-regate-failed` 로 «실패» 기록(오늘 5건).
+ */
+export function tscExecEnv(callerEnv: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv {
+  return gitEnv(callerEnv ?? tscEnv());
+}
+
 /** git 조회용 — 명령 실패는 호출자가 빈 출력과 구분할 수 있게 전파한다. */
 function sh(cmd: string, cwd = process.cwd()): string {
   return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], cwd, env: gitEnv() });
@@ -880,7 +889,7 @@ function inspectTscResult(tsc: TscRun, changed: ReadonlySet<string>, baseline: R
 export function runGate(io: Partial<GateIo> = {}): void {
   const cwd = io.cwd ?? process.cwd();
   const defaultChanged = () => changedTsFiles((cmd) => sh(cmd, cwd), process.env, cwd, io.baseRef);
-  const { changedTsFiles: getChanged = defaultChanged, runTscCmd = (cmd: string) => runTsc(cmd, ((command, options) => execSync(command, { ...options, cwd, env: gitEnv() })) as typeof execSync), log = (message: string) => console.log(message), warn = (message: string) => console.warn(message), error = (message: string) => console.error(message), exit = ((code: number) => process.exit(code)) as GateIo['exit'] } = io;
+  const { changedTsFiles: getChanged = defaultChanged, runTscCmd = (cmd: string) => runTsc(cmd, ((command, options) => execSync(command, { ...options, cwd, env: tscExecEnv(options?.env) })) as typeof execSync), log = (message: string) => console.log(message), warn = (message: string) => console.warn(message), error = (message: string) => console.error(message), exit = ((code: number) => process.exit(code)) as GateIo['exit'] } = io;
   const readBaselineDiagnostics = io.readBaselineDiagnostics ?? ((base: string, command: string) => readMergeBaseDiagnostics(base, command, cwd));
   // Set 주입은 기존 테스트 심이며 기준 revision이 없다. 실제 ChangedTsFiles 경로만 Git 관측을 요구한다.
   const requiredExportFields = io.requiredExportFields ?? ((changed: ReadonlySet<string>, base: string) => base === 'injected test seam'

package/scripts/hq/hq-fence-wrapper.sh

@@ -0,0 +1,148 @@
+#!/bin/sh
+# FENCE-LIGHT (0.2.23) — sourced by the installed hq-fence wrapper (src/hq/fence-wrapper.ts renderHqFenceWrapper),
+# from the installed package root, only when "$CONFIG_DIR/hq/lease-cache" exists. Inherits ROLE, "$@", BUN, ENTRY,
+# CONFIG_DIR, LOG, log_line, alert. Always exits.
+#
+# Cache line (written only by a successful holder renewal in hqHeartbeat; removed at every heartbeat start,
+# by every successful lease action and by every CLI «do not run»):
+#   <holder> <generation> <expiresAt> <host> <machine> <confirmedAt>
+#
+# Fast path (no bun, no network) ONLY when every check below holds; anything else is DECISION=cli, i.e. the
+# same installed CLI decision as before (`hq fence --role`), under the role's time limit.
+#   holder = cache host = ~/.elanous-hq/host · machine = `hostname` · confirmedAt <= now < confirmedAt+660
+#   now < expiresAt <= confirmedAt+660 · local.json starts {"holder":<it>,"generation":<it> · seen-generation <= it
+#   Every file one line; numbers without leading zeros (an arithmetic error must never abort before the CLI).
+# There is no fast «skip»: a cache that names another holder goes to the CLI.
+#
+# Time limit per role (seconds). The watchdog is GNU timeout: it puts the fenced command in its own process
+# group and signals only that group (TERM, then KILL after 5s) — never anything by name.
+case "$ROLE" in
+  telegram-poller|release-run) LIMIT=3600 ;;
+  seat-loop) LIMIT=1800 ;;
+  cron|conatus) LIMIT=900 ;;
+  git-push|ledger-cli) LIMIT=120 ;;
+  *) LIMIT= ;;
+esac
+
+# Watchdog: PATH first (cron PATH is /usr/bin:/bin), then Homebrew coreutils. HQ_FENCE_WATCHDOGS overrides the
+# absolute candidates (tests). None found = the legacy CLI command without a limit, with one evidence line.
+TIMEOUT=
+for t in timeout gtimeout ${HQ_FENCE_WATCHDOGS-/opt/homebrew/bin/timeout /opt/homebrew/bin/gtimeout /usr/local/bin/timeout /usr/local/bin/gtimeout}; do
+  case "$t" in
+    /*) if [ -x "$t" ]; then TIMEOUT=$t; break; fi ;;
+    *) p=$(command -v "$t" 2>/dev/null) && [ -n "$p" ] && { TIMEOUT=$p; break; } ;;
+  esac
+done
+
+DECISION=cli
+WHY=
+FL_CACHE="$CONFIG_DIR/hq/lease-cache"
+FL_HOST_FILE="$HOME/.elanous-hq/host"
+FL_LOCAL="$CONFIG_DIR/hq/local.json"
+FL_SEEN="$HOME/.elanous-hq/seen-generation"
+if [ -z "$LIMIT" ]; then WHY=unknown-role
+elif [ $# -eq 0 ] || [ -z "$*" ]; then WHY=no-command
+elif [ -z "$TIMEOUT" ]; then WHY=no-watchdog
+elif [ -L "$FL_CACHE" ] || [ ! -f "$FL_CACHE" ] || [ ! -r "$FL_CACHE" ]; then WHY=cache-unreadable
+elif [ -L "$FL_HOST_FILE" ] || [ ! -f "$FL_HOST_FILE" ] || [ ! -r "$FL_HOST_FILE" ]; then WHY=no-host-file
+elif [ ! -f "$FL_LOCAL" ] || [ ! -r "$FL_LOCAL" ]; then WHY=no-local-state
+else
+  HOLDER= GENERATION= EXPIRES= CACHE_HOST= CACHE_MACHINE= CONFIRMED= EXTRA= THIS_HOST= LOCAL_LINE= SEEN=
+  CACHE_MORE=0 LOCAL_MORE=0
+  # Each file must be exactly one newline-terminated line: a second read that succeeds, or that hits EOF
+  # with unterminated text, means more content.
+  { IFS=' ' read -r HOLDER GENERATION EXPIRES CACHE_HOST CACHE_MACHINE CONFIRMED EXTRA || CACHE_MORE=1
+    _FL_REST=; if IFS= read -r _FL_REST || [ -n "$_FL_REST" ]; then CACHE_MORE=1; fi; } < "$FL_CACHE"
+  IFS= read -r THIS_HOST < "$FL_HOST_FILE" || true
+  { IFS= read -r LOCAL_LINE || LOCAL_MORE=1
+    _FL_REST=; if IFS= read -r _FL_REST || [ -n "$_FL_REST" ]; then LOCAL_MORE=1; fi; } < "$FL_LOCAL"
+  WHY=malformed
+  case "$HOLDER" in ''|*[!A-Za-z0-9_.-]*) ;; *)
+  case "$CACHE_MACHINE" in ''|*[!A-Za-z0-9_.-]*) ;; *)
+  case "$GENERATION" in ''|0*|*[!0-9]*) ;; *)
+  case "$EXPIRES" in ''|0*|*[!0-9]*) ;; *)
+  case "$CONFIRMED" in ''|0*|*[!0-9]*) ;; *)
+    if [ "$CACHE_MORE" = 1 ] || [ -n "$EXTRA" ] || [ "${#GENERATION}" -gt 15 ] || [ "${#EXPIRES}" -gt 12 ] || [ "${#CONFIRMED}" -gt 12 ]; then WHY=malformed
+    elif [ "$HOLDER" != "$THIS_HOST" ] || [ "$CACHE_HOST" != "$THIS_HOST" ]; then WHY=not-this-host
+    else
+      THIS_MACHINE=$(hostname)
+      THIS_MACHINE=${THIS_MACHINE%.local}
+      NOW=$(date +%s)
+      if [ "$CACHE_MACHINE" != "$THIS_MACHINE" ]; then WHY=other-machine
+      elif [ "$CONFIRMED" -gt "$NOW" ] || [ "$NOW" -ge "$((CONFIRMED + 660))" ] \
+        || [ "$EXPIRES" -le "$NOW" ] || [ "$EXPIRES" -gt "$((CONFIRMED + 660))" ]; then WHY=stale
+      else
+        # The CLI's own host-local view must name the same holder and generation as its leading top-level
+        # fields — hq.ts writeLocal is JSON.stringify({ holder, generation, ... }) on one line. Anchored at «{»,
+        # so a nested or later «holder» never matches; any other shape goes to the CLI.
+        if [ "$LOCAL_MORE" = 1 ]; then WHY=local-malformed
+        else
+          case "$LOCAL_LINE" in
+            '{"holder":"'"$HOLDER"'","generation":'"$GENERATION"[,}]*) WHY= ;;
+            *) WHY=local-mismatch ;;
+          esac
+        fi
+        if [ -z "$WHY" ] && [ -f "$FL_SEEN" ]; then
+          IFS= read -r SEEN < "$FL_SEEN" || true
+          case "$SEEN" in
+            ''|0*|*[!0-9]*) WHY=seen-unreadable ;;
+            *) if [ "${#SEEN}" -gt 15 ] || [ "$SEEN" -gt "$GENERATION" ]; then WHY=seen-newer-generation; fi ;;
+          esac
+        fi
+        if [ -z "$WHY" ]; then DECISION=run; WHY=fresh-holder; fi
+      fi
+    fi
+  ;; esac ;; esac ;; esac ;; esac ;; esac
+fi
+
+if [ "$DECISION" = run ]; then
+  export ELANOUS_HQ_GENERATION="$GENERATION"
+  "$TIMEOUT" -k 5 "$LIMIT" /bin/sh -c "$*"
+  rc=$?
+elif [ -n "$TIMEOUT" ] && [ -n "$LIMIT" ]; then
+  # Same installed CLI decision as the legacy wrapper, bounded by the role limit.
+  "$TIMEOUT" -k 5 "$LIMIT" "$BUN" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence --role "$ROLE" -- /bin/sh -c "$*"
+  rc=$?
+else
+  # Unknown role (the CLI rejects it) or no watchdog binary: exactly the legacy command, unbounded.
+  if [ "$WHY" = no-watchdog ]; then log_line "fence watchdog unavailable (role=$ROLE) - CLI fence without time limit"; fi
+  "$BUN" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence --role "$ROLE" -- /bin/sh -c "$*"
+  rc=$?
+fi
+
+TIMED_OUT=0
+if [ -n "$TIMEOUT" ] && [ -n "$LIMIT" ] && { [ "$rc" -eq 124 ] || [ "$rc" -eq 137 ]; }; then
+  TIMED_OUT=1
+  log_line "fence timeout role=$ROLE limit=${LIMIT}s rc=$rc decision=$DECISION reason=$WHY"
+  echo "hq-fence: timeout role=$ROLE limit=${LIMIT}s rc=$rc" >&2
+fi
+
+# LOOPCHECK-FENCE streak: the CLI records it on its own path; the fast path (and a CLI killed by the watchdog)
+# records through bun only when it matters — a failure, or a success that must reset a nonzero streak.
+if [ "$DECISION" = run ] || [ "$TIMED_OUT" = 1 ]; then
+  RECORD=0
+  if [ "$rc" -ne 0 ]; then RECORD=1
+  else
+    FL_OUTCOME="$CONFIG_DIR/hq/fence-outcomes/$ROLE.json"
+    if [ -f "$FL_OUTCOME" ]; then
+      OUTCOME_LINE=
+      IFS= read -r OUTCOME_LINE < "$FL_OUTCOME" || true
+      case "$OUTCOME_LINE" in '{"consecutiveFailures":0,'*) ;; *) RECORD=1 ;; esac
+    fi
+  fi
+  if [ "$RECORD" = 1 ]; then
+    "$TIMEOUT" -k 5 20 "$BUN" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence-wrapper record "$ROLE" "$rc" \
+      || log_line "fence outcome record failed (role=$ROLE rc=$rc)"
+  fi
+fi
+
+if [ "$rc" -ne 0 ]; then
+  if [ -n "$TIMEOUT" ]; then
+    # Bounded: an unavailable owner channel must not strand a cron fence.
+    "$TIMEOUT" -k 5 20 "$BUN" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence-wrapper alert "hq-fence: fence failed (rc=$rc, role=$ROLE)" \
+      || { echo "hq-fence: owner alert failed: fence failed (rc=$rc, role=$ROLE)" >&2; log_line "owner alert failed: fence failed (rc=$rc, role=$ROLE)"; }
+  else
+    alert "hq-fence: fence failed (rc=$rc, role=$ROLE)"
+  fi
+fi
+exit "$rc"

package/scripts/lib/typecheck-ratchet.ts

@@ -0,0 +1,51 @@
+import { resolve } from 'node:path';
+import ts from 'typescript';
+
+/** Select root files affected by changed TypeScript files through the resolved reverse-import graph.
+ * Paths in rootNames are preserved for the compiler; changed paths may be relative to cwd.
+ * This is selection only: the caller owns project scope, hub policy and compiler execution.
+ */
+export function selectAffectedRootNames(
+  rootNames: readonly string[],
+  changedFiles: ReadonlySet<string>,
+  compilerOptions: ts.CompilerOptions,
+  host: ts.ModuleResolutionHost = ts.sys,
+  cwd = process.cwd(),
+): string[] {
+  const absolute = (file: string) => resolve(cwd, file);
+  const roots = new Set(rootNames.map(absolute));
+  const queue = [...changedFiles].filter((file) => /\.[cm]?tsx?$/.test(file)).map(absolute);
+  // No changed TypeScript file: nothing can be affected, so the dependency graph is never read.
+  if (queue.length === 0) return [];
+  const reverse = new Map<string, Set<string>>();
+  const pending = [...roots];
+  const visited = new Set<string>();
+
+  while (pending.length > 0) {
+    const file = pending.pop()!;
+    if (visited.has(file)) continue;
+    visited.add(file);
+    const source = host.readFile?.(file);
+    if (source === undefined) throw new Error(`Cannot read typecheck root dependency: ${file}`);
+    for (const imported of ts.preProcessFile(source, true, true).importedFiles) {
+      const dependency = ts.resolveModuleName(imported.fileName, file, compilerOptions, host).resolvedModule?.resolvedFileName;
+      if (!dependency) continue;
+      const path = absolute(dependency);
+      if (!reverse.has(path)) reverse.set(path, new Set());
+      reverse.get(path)!.add(file);
+      if (!visited.has(path)) pending.push(path);
+    }
+  }
+
+  // A deleted module cannot be resolved from the current tree. Without a previous
+  // dependency graph, an empty reverse edge is not evidence that no root imports it.
+  if (queue.some((file) => !host.fileExists(file))) return [...rootNames];
+  const affected = new Set<string>();
+  while (queue.length > 0) {
+    const file = queue.pop()!;
+    if (affected.has(file)) continue;
+    affected.add(file);
+    for (const importer of reverse.get(file) ?? []) queue.push(importer);
+  }
+  return rootNames.filter((file) => affected.has(absolute(file)));
+}

package/scripts/openai-relay-server.ts

@@ -17,11 +17,15 @@ import { resolveGrokCredential } from '../src/grok/credential.js';
 import { debug } from '../src/debug/log.js';
 import { getOpenAiRelaySharedSecret, hydrateEnvFromKeyCache } from '../src/config.js';
 import { registerLogStoreSink } from '../src/mss/logging/log-store.js';
+import { getUserConfig } from '../src/user-config.js';
 
 // ⛔ 독립 프로세스라 데몬의 부팅 배선을 안 탄다 — 스토어 싱크를 «직접» 단다.
 //    이걸 안 달면 debug.log 가 화면에만 남고 `elanous logs` 조회에 «영영 안 닿는다»
 //    (2026-08-23 실측: nexus.openai-relay 는 닿았고 이 프로세스 자기 로그는 0건이었다).
-registerLogStoreSink(debug.registerSink.bind(debug), 'openai-relay');
+// 🩸 10-09 22:2x: 보존 설정 없이 등록하면 기본 상한 500MB 로 시작 보존이 돈다 — 운영 config 는 4000MB 인데
+//    레일 설치마다 재기동되는 이 프로세스가 1.1GB logs.db 의 행을 최대 50% 지웠다(«지운 주체가 안 보이는» 소실).
+//    다른 독립 스크립트처럼 config 의 보존 값을 넘긴다.
+registerLogStoreSink(debug.registerSink.bind(debug), 'openai-relay', getUserConfig().logs.retention);
 
 const MODELS_PATH = '/v1/models';
 const HEALTH_PATH = '/healthz';