elanous 0.2.29 → 0.2.32

package/scripts/cron-run.ts

@@ -16,7 +16,7 @@ import { ensureCronNodePath } from '../src/domains/cron-path.js';
 ensureCronNodePath();
 
 async function main(): Promise<void> {
-  const argv = process.argv.slice(2);
+  const { argv, maxRuntimeMs } = extractMaxRuntimeArgs(process.argv.slice(2)); // 래퍼 옵션은 대상 앞에서만 소비한다.
   const hasScheduleId = argv[0] === '--schedule-id';
   const scheduleId = hasScheduleId ? argv.splice(0, 2)[1] : undefined;
   if (hasScheduleId && (!scheduleId?.trim() || scheduleId === '--shell')) {
@@ -90,6 +90,9 @@ async function main(): Promise<void> {
   const child = spawn(interpreter, [target, ...targetArgs], {
     stdio: ['ignore', 'inherit', 'pipe'],
     env: { ...process.env },
+    // ⓐ detached — 자식이 프로세스 그룹 리더가 된다. 상한 초과 kill 은 그룹 전체
+    // (자식의 자식까지)를 죽린다: process.kill(-pid).
+    detached: true,
   });
   let errTail = '';
   child.stderr?.on('data', (chunk: Buffer) => {
@@ -97,14 +100,53 @@ async function main(): Promise<void> {
     errTail = (errTail + chunk.toString()).slice(-2000); // 바운디드
   });
 
+  // ⓐ 상한 타이머 — 넘으면 자식 프로세스 그룹 전체를 SIGKILL 하고 관측 플래그를 올린다.
+  // 진단(stderr 한 줄)은 여기서, 관측 기록은 기존 finish() 경로가 그대로 맡는다(fail-open 불변).
+  // ⚠ 리더가 이미 종료했다고 조기 반환하지 않는다(리뷰 must-fix): 리더만 죽고 손자가 stderr
+  //   파이프를 쥔 채 남으면 close 가 영영 안 와 관측도 반환도 없다. 이 경로에서도 그룹(트리)
+  //   종료를 시도하고, close 가 오지 않으면 finish 를 직접 불러 관측·반환을 마무리한다.
+  let overrun = false;
+  let finished = false;
+  let forwardedExit: number | null = null;
+  let signalKillTimer: ReturnType<typeof setTimeout> | null = null;
+  const timer: ReturnType<typeof setTimeout> | null = maxRuntimeMs > 0
+    ? setTimeout(() => {
+        if (child.pid === undefined || finished) return;
+        overrun = true;
+        const leaderGone = child.exitCode !== null || child.signalCode !== null;
+        try { process.stderr.write(`cron-run overrun: ${maxRuntimeMs}ms 상한 초과 — 자식 트리(pid ${child.pid}) 종료${leaderGone ? ' — 리더 이미 종료, 파이프를 쥔 손자 정리' : ''}\n`); } catch { /* */ }
+        try { process.kill(-child.pid, 'SIGKILL'); }
+        catch { try { child.kill('SIGKILL'); } catch { /* 이미 종료 */ } }
+        // 그룹 밖(setsid) 잔존자가 파이프를 계속 쥐면 close 가 오지 않는다 — 관측까지 여기서
+        // 마무리한다. close 가 정상적으로 오면 finish 의 멱등 가드가 이 호출을 흡수한다.
+        setTimeout(() => finish(child.exitCode), OVERRUN_CLOSE_GRACE_MS);
+      }, maxRuntimeMs)
+    : null;
+
   const finish = (code: number | null): void => {
-    const exit = code ?? 0;
+    if (finished) return; // 멱등 — close·error·상한 유예 경로가 겹쳐도 관측·반환은 1회
+    finished = true;
+    // 신호를 받은 뒤 리더가 먼저 닫혀도, SIGTERM을 무시하고 stdio를 닫은 손자가
+    // 그룹에 남을 수 있다. close가 온 시점에도 그룹 전체를 마지막으로 거둔다.
+    if (forwardedExit !== null && child.pid !== undefined) {
+      try { process.kill(-child.pid, 'SIGKILL'); } catch { /* 그룹 이미 종료 */ }
+    }
+    if (timer !== null) clearTimeout(timer);
+    if (signalKillTimer !== null) clearTimeout(signalKillTimer);
+    process.removeListener('SIGINT', onSigInt);
+    process.removeListener('SIGTERM', onSigTerm);
+    const exit = overrun ? 124 : forwardedExit ?? code ?? 0;
     try {
       const durationMs = Date.now() - start;
       const status: 'ok' | 'error' = exit === 0 ? 'ok' : 'error';
+      const overrunNote = overrun
+        ? `cron-run overrun: killed ${target} (pid ${child.pid ?? '?'}) after ${durationMs}ms — cap ${maxRuntimeMs}ms`
+        : null;
       const record = {
         status, exit, durationMs, via: 'crontab' as const,
-        error: exit === 0 ? null : errTail.trim().split('\n').slice(-3).join('\n') || `exit ${exit}`,
+        error: overrunNote
+          ? [overrunNote, ...errTail.trim().split('\n').slice(-3).filter(Boolean)].join('\n')
+          : exit === 0 ? null : errTail.trim().split('\n').slice(-3).join('\n') || `exit ${exit}`,
       };
       const options = { ...(db ? { db } : {}), ...(id ? { id } : {}), prevStatus };
       const diagnostic = (kind: 'prerequisite' | 'registry record skipped' | 'registry selection ambiguous' | 'import' | 'record', error: unknown): Promise<void> => {
@@ -144,8 +186,59 @@ async function main(): Promise<void> {
       process.exit(exit);
     }
   };
+  const forwardSignal = (signal: 'SIGINT' | 'SIGTERM'): void => {
+    if (finished || forwardedExit !== null) return;
+    forwardedExit = signal === 'SIGINT' ? 130 : 143;
+    if (child.pid === undefined) { finish(forwardedExit); return; }
+    try { process.kill(-child.pid, signal); }
+    catch { try { child.kill(signal); } catch { /* 이미 종료 */ } }
+    signalKillTimer = setTimeout(() => {
+      try { process.kill(-child.pid!, 'SIGKILL'); }
+      catch { try { child.kill('SIGKILL'); } catch { /* 이미 종료 */ } }
+      finish(forwardedExit);
+    }, OVERRUN_CLOSE_GRACE_MS);
+  };
+  const onSigInt = (): void => forwardSignal('SIGINT');
+  const onSigTerm = (): void => forwardSignal('SIGTERM');
+  process.on('SIGINT', onSigInt);
+  process.on('SIGTERM', onSigTerm);
   child.on('close', finish);
   child.on('error', (e) => { process.stderr.write(`cron-run spawn error: ${e.message}\n`); finish(1); });
 }
 
+const MAX_TIMER_MS = 2_147_483_647;
 void main().catch(() => process.exit(0));
+
+// ⓐ LOGS-RETENTION-46MIN: 실행 시간 상한 — 상한 없이 살아남은 옛 판 크론이 6시간마다
+// «오래된 행 50%» 삭제를 겹쳐 돌려 보존 창을 무너뜨린 사고(10-12)의 재발 방지.
+// 우선순위: --max-runtime-ms > CRON_RUN_MAX_RUNTIME_MS > 기본 30분. 0 이하는 상한 끔.
+//
+// 래퍼 플래그는 대상 앞에서만 읽는다. 대상 뒤의 같은 이름은 자식 인자다.
+// ⚠ main() 안쪽이 아니라 여기(helper)에 두는 이유: main() 머리에 줄을 늘리면 위쪽
+//   registerLogStoreSink 호출의 줄번호가 움직여 log-store-retention-callers.test.ts
+//   가 git 색인과 대비하는 검사를 깬다(부메랑).
+function extractMaxRuntimeArgs(argv: string[]): { argv: string[]; maxRuntimeMs: number } {
+  const args = [...argv];
+  if (args[0] === '--schedule-id') args.splice(0, 2);
+  if (args[0] === '--max-runtime-ms') {
+    const raw = args[1];
+    const parsed = Number(raw);
+    if (!raw || !Number.isSafeInteger(parsed) || parsed < 0 || parsed > MAX_TIMER_MS) {
+      process.stderr.write(`cron-run: --max-runtime-ms 인자는 0~${MAX_TIMER_MS} 사이의 정수여야 합니다\n`);
+      process.exit(2);
+    }
+    const flagIndex = argv.indexOf('--max-runtime-ms');
+    return { argv: argv.filter((_, index) => index !== flagIndex && index !== flagIndex + 1), maxRuntimeMs: parsed };
+  }
+  const rawEnv = process.env.CRON_RUN_MAX_RUNTIME_MS;
+  const fromEnv = Number(rawEnv);
+  if (rawEnv?.trim() && fromEnv > MAX_TIMER_MS) {
+    process.stderr.write(`cron-run: CRON_RUN_MAX_RUNTIME_MS 인자는 0~${MAX_TIMER_MS} 사이의 정수여야 합니다\n`);
+    process.exit(2);
+  }
+  return { argv, maxRuntimeMs: rawEnv?.trim() && Number.isSafeInteger(fromEnv) && fromEnv >= 0 && fromEnv <= MAX_TIMER_MS ? fromEnv : 30 * 60_000 };
+}
+
+// ⓐ 상한 시점의 그룹 종료 뒤에도 close 가 오지 않는 경로(파이프를 쥔 그룹 밖 손자)에서
+// 관측(finish)을 마무리할 때까지 기다리는 유예.
+const OVERRUN_CLOSE_GRACE_MS = 2_000;

package/scripts/detect-test-interference.ts

@@ -1,4 +1,9 @@
 #!/usr/bin/env bun
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { prepareIsolatedTestEnv } from './lib/deterministic-env.js';
+
 export const EXIT_NO_INTERFERENCE = 0;
 export const EXIT_INTERFERENCE = 1;
 export const EXIT_INVALID_INPUT = 2;
@@ -19,7 +24,7 @@ export type BunTestChild = {
   exited: Promise<number>;
   signalCode: string | null;
 };
-export type BunSpawn = (options: { cmd: string[]; cwd: string; stdout: 'pipe'; stderr: 'pipe' }) => BunTestChild;
+export type BunSpawn = (options: { cmd: string[]; cwd: string; env: NodeJS.ProcessEnv; stdout: 'pipe'; stderr: 'pipe' }) => BunTestChild;
 
 export type MeasuredRun = {
   files: string[];
@@ -45,10 +50,38 @@ export const MAX_ISOLATED_FAILURE_FILES = 8;
 
 const defaultBunSpawn: BunSpawn = (options) => Bun.spawn(options) as unknown as BunTestChild;
 
-export async function runBunTest(files: readonly string[], spawn: BunSpawn = defaultBunSpawn, cwd: string = process.cwd()): Promise<RunnerResult> {
-  const child = spawn({ cmd: [process.execPath, 'test', ...files], cwd, stdout: 'pipe', stderr: 'pipe' });
-  const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
-  return { stdout, stderr, exitCode, signal: child.signalCode };
+/**
+ * ⛔ 2026-10-16 사고(R7 · OP #8751) — 이 러너가 `bun test` 를 env 지정 없이 띄워 호스트 재게이트가 mbp 의 실 HOME·운영
+ * config 를 시험에 물려줬다. seam 이 빠진 시험 둘(tasks-cli · COORD-ONE)이 운영 `taskAgent.parentHost` 목록으로 진짜 ssh
+ * 발사를 해 원격 prod 런 25 · draft PR 11 이 생겼다.
+ * ⇒ 시험은 «게이트와 같은» 격리 env 로 띄운다(`prepareIsolatedTestEnv` — 임시 HOME ⊕ 임시 ELANOUS_STATE_DIR ⊕ 자격·실행
+ *   정체성·`ELANOUS_STATE_DIR_SOURCE` 제거 · PATH 보존) ⊕ 원격 부모 끔(`ELANOUS_TA_PARENT_HOST=off`).
+ */
+export async function isolatedBunTestEnv(sourceEnv: NodeJS.ProcessEnv = process.env): Promise<{ env: NodeJS.ProcessEnv; cleanup: () => void }> {
+  // ⛔ Import the side-effect-free lib, never `test-deterministic.ts`: that file pulls `typescript` and Bun stream
+  //    types into every graph that reaches this runner — the PWA tsc program failed on it (#28474 train · 10-16).
+  const root = mkdtempSync(join(tmpdir(), 'elanous-interference-test-'));
+  const cleanup = (): void => {
+    try { rmSync(root, { recursive: true, force: true }); }
+    catch (error) {
+      // 판정은 막지 않되 숨기지 않는다 — 남은 임시 뿌리는 경로로 찾을 수 있게 한 줄 남긴다(리뷰 should-fix).
+      try { process.stderr.write(`[detect-test-interference] temp env root cleanup failed: ${root}: ${error instanceof Error ? error.message : String(error)}\n`); } catch { /* ignore */ }
+    }
+  };
+  try {
+    return { env: { ...prepareIsolatedTestEnv(sourceEnv, root), ELANOUS_TA_PARENT_HOST: 'off' }, cleanup };
+  } catch (error) { cleanup(); throw error; }
+}
+
+export async function runBunTest(files: readonly string[], spawn: BunSpawn = defaultBunSpawn, cwd: string = process.cwd(), sourceEnv: NodeJS.ProcessEnv = process.env): Promise<RunnerResult> {
+  const isolated = await isolatedBunTestEnv(sourceEnv);
+  try {
+    const child = spawn({ cmd: [process.execPath, 'test', ...files], cwd, env: isolated.env, stdout: 'pipe', stderr: 'pipe' });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { stdout, stderr, exitCode, signal: child.signalCode };
+  } finally {
+    isolated.cleanup();
+  }
 }
 
 export function parseFailureCount(output: string): number | null {

package/scripts/gate-pr-cache.ts

@@ -0,0 +1,65 @@
+#!/usr/bin/env bun
+/** Read-only OP train adapter: one JSON decision, never launches a gate or edits a queue. */
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path';
+import { decidePrGateCache } from './release-loop/gate-pr-cache.js';
+import { buildClosureGraph, gitClosureTree, testsReachingChanged } from './release-loop/gate-closure.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const argv = process.argv.slice(2);
+const option = (name: string): string | undefined => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : undefined;
+};
+const summaryPath = option('--summary');
+const repo = option('--repo');
+const head = option('--head')?.toLowerCase();
+const main = option('--main')?.toLowerCase();
+const singlePr = argv.includes('--single-pr');
+if (!summaryPath || !repo || !head || !main || !SHA.test(head) || !SHA.test(main) || !singlePr) {
+  console.error('usage: bun scripts/gate-pr-cache.ts --summary <author-summary.json> --repo <git-repo> --head <PR-head40> --main <main40> --single-pr');
+  process.exit(2);
+}
+const git = (args: string[]): { status: number | null; stdout: string } => {
+  // git-spawn-allow: read-only object ancestry and path diff; this adapter never checks out or mutates.
+  const result = spawnSync('git', args, { cwd: resolve(repo), encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  return { status: result.status, stdout: result.stdout ?? '' };
+};
+let summary: unknown;
+try { summary = JSON.parse(readFileSync(summaryPath, 'utf8')); } catch { summary = null; }
+const base = summary && typeof summary === 'object' && 'base40' in summary && typeof summary.base40 === 'string'
+  ? summary.base40.toLowerCase() : '';
+const baseAncestorOfHead = SHA.test(base) && git(['merge-base', '--is-ancestor', base, head]).status === 0;
+const baseAncestorOfMain = SHA.test(base) && git(['merge-base', '--is-ancestor', base, main]).status === 0;
+const diff = baseAncestorOfMain ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', `${base}..${main}`]) : null;
+const mainChangedFiles = diff?.status === 0 ? diff.stdout.split(/\r?\n/).filter(Boolean) : null;
+const docs = mainChangedFiles?.filter((file) => /\.md$/.test(file));
+const added = docs?.length ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', '--diff-filter=A', `${base}..${main}`]) : null;
+const inertDocsAddedOnly = docs ? (!docs.length || (added?.status === 0 && docs.every((file) => added.stdout.split(/\r?\n/).includes(file)))) : null;
+let affectedTests: string[] | null = null;
+let sourceDependencyOverlap: boolean | null = null;
+if (mainChangedFiles && summary && typeof summary === 'object' && 'cohort' in summary && Array.isArray(summary.cohort)) {
+  const code = mainChangedFiles.filter((file) => /\.[cm]?[jt]sx?$/.test(file));
+  if (!code.length) { affectedTests = []; sourceDependencyOverlap = false; }
+  else try {
+    const tree = gitClosureTree(resolve(repo), head);
+    const prDiff = SHA.test(base) ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', `${base}..${head}`]) : null;
+    const prChanged = prDiff?.status === 0 ? prDiff.stdout.split(/\r?\n/).filter(Boolean) : null;
+    if (prChanged && code.every((file) => tree.files.includes(file))
+      && prChanged.every((file) => /\.[cm]?[jt]sx?$/.test(file) || (/\.md$/.test(file) && !/(?:^|\/)(?:test|tests|__tests__|fixtures|__fixtures__|__snapshots__|__mocks__)\//.test(file)))) {
+      const graph = buildClosureGraph(tree);
+      const seen = new Set(prChanged.filter((file) => /\.[cm]?[jt]sx?$/.test(file)));
+      const pending = [...seen];
+      while (pending.length) for (const dependency of graph.forward.get(pending.pop()!) ?? []) {
+        if (!seen.has(dependency)) { seen.add(dependency); pending.push(dependency); }
+      }
+      if ([...seen].some((file) => graph.opaque.has(file) || !graph.tracked.has(file))) throw new Error('PR source closure opaque');
+      sourceDependencyOverlap = code.some((file) => seen.has(file));
+      const closure = testsReachingChanged(tree, code, summary.cohort);
+      if (closure.ok) affectedTests = closure.tests;
+    }
+  } catch { /* unknown radius means full gate */ }
+}
+console.log(JSON.stringify(decidePrGateCache({ summary, head, main, singlePr,
+  baseAncestorOfHead, baseAncestorOfMain, mainChangedFiles, inertDocsAddedOnly, affectedTests, sourceDependencyOverlap }), null, 2));

package/scripts/gh-surface/capture.ts

@@ -0,0 +1,126 @@
+import { closeSync, constants, openSync, writeSync } from 'node:fs';
+
+// Only fixed gh vocabulary and validated field identifiers may cross this boundary.
+// Do not add positional arguments or error messages to the persisted record.
+const SUBCOMMANDS: Record<string, ReadonlySet<string>> = {
+  auth: new Set(['status', 'login', 'logout', 'token', 'refresh', 'setup-git']),
+  project: new Set(['list', 'view', 'create', 'edit', 'delete', 'close', 'field-list', 'item-list']),
+  cache: new Set(['list', 'delete']),
+  codespace: new Set(['list', 'view', 'create', 'delete', 'ssh']),
+  'ssh-key': new Set(['list', 'add', 'delete']),
+  api: new Set(['graphql']),
+  issue: new Set(['list', 'view', 'create', 'edit', 'close', 'reopen', 'comment', 'status']),
+  pr: new Set(['list', 'view', 'create', 'edit', 'checkout', 'merge', 'close', 'reopen', 'comment', 'checks', 'diff', 'status', 'ready', 'review']),
+  repo: new Set(['view', 'list', 'clone', 'create', 'edit', 'fork', 'sync']),
+  run: new Set(['list', 'view', 'watch', 'rerun', 'cancel', 'download']),
+  workflow: new Set(['list', 'view', 'run', 'enable', 'disable']),
+  release: new Set(['list', 'view', 'create', 'edit', 'delete', 'download', 'upload']),
+  label: new Set(['list', 'create', 'edit', 'delete', 'clone']),
+  search: new Set(['code', 'commits', 'issues', 'prs', 'repos']),
+  gist: new Set(['list', 'view', 'create', 'edit', 'delete', 'clone']),
+  secret: new Set(['list', 'set', 'delete']),
+  variable: new Set(['list', 'set', 'delete']),
+};
+// A syntactically valid identifier can still be a token passed as a --json value.
+// Unknown names are counted, never copied into the log. Extend only from gh's documented fields.
+const FIELDS = new Set([
+  'additions', 'assignees', 'author', 'baseRefName', 'body', 'changedFiles', 'closed',
+  'closedAt', 'comments', 'commits', 'createdAt', 'databaseId', 'deletions', 'files',
+  'headRefName', 'headRepository', 'id', 'isDraft', 'isPrivate', 'labels', 'latestReviews',
+  'maintainerCanModify', 'mergeCommit', 'mergeStateStatus', 'mergeable', 'mergedAt',
+  'mergedBy', 'milestone', 'name', 'number', 'owner', 'projectCards', 'projectItems',
+  'reactionGroups', 'reviewDecision', 'reviewRequests', 'reviews', 'state', 'status',
+  'title', 'updatedAt', 'url', 'viewerCanUpdate', 'viewerDidAuthor', 'workflowName',
+]);
+const MAX_FIELDS = 100;
+// Option arity is command-specific. Unsupported forms must not silently hide --json.
+// This is deliberately a narrow allowlist, not a global inventory of gh flags.
+const VALUE_OPTIONS_BY_COMMAND: Record<string, ReadonlySet<string>> = {
+  'api graphql': new Set(['--field', '--raw-field', '-H', '--header', '--method', '-X', '--input']),
+  'pr list': new Set(['-R', '--repo', '--limit', '-L', '--state', '-s', '--author', '--base', '--head', '--search', '-S', '--label', '-l', '--assignee', '-a', '--jq', '-q', '--template', '-t']),
+  'pr view': new Set(['-R', '--repo', '--jq', '-q', '--template', '-t']),
+  'issue list': new Set(['-R', '--repo', '--limit', '-L', '--state', '-s', '--author', '--assignee', '-a', '--label', '-l', '--search', '-S', '--jq', '-q', '--template', '-t']),
+  'run list': new Set(['-R', '--repo', '--limit', '-L', '-w', '--workflow', '--branch', '--jq', '-q', '--template', '-t']),
+};
+const SWITCH_OPTIONS_BY_COMMAND: Record<string, ReadonlySet<string>> = {
+  'repo list': new Set(['-s', '--source']),
+  'pr create': new Set(['-w', '--web']),
+};
+const UNIVERSAL_SWITCH_OPTIONS = new Set(['--help', '-h']);
+
+type CaptureRow = { command: string; fields: string[] | 'unknown'; unknown: boolean };
+
+export function classifyGhCall(args: readonly string[]): CaptureRow {
+  const root = args[0];
+  const sub = args[1];
+  const command = root && Object.hasOwn(SUBCOMMANDS, root)
+    ? root === 'api' ? (sub === 'graphql' ? 'api graphql' : 'api')
+      : sub && SUBCOMMANDS[root]!.has(sub) ? `${root} ${sub}` : 'unknown'
+    : 'unknown';
+  let unknown = command === 'unknown';
+  let fields: string[] = [];
+  let seen = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === '--') break;
+    if (VALUE_OPTIONS_BY_COMMAND[command]?.has(arg)) {
+      const value = args[++i];
+      if (!value || value.startsWith('-')) unknown = true;
+      continue;
+    }
+    if (SWITCH_OPTIONS_BY_COMMAND[command]?.has(arg) || UNIVERSAL_SWITCH_OPTIONS.has(arg)) continue;
+    // Sensitive payload options consume one argument without inspecting or retaining its contents.
+    if (arg === '--body' || arg === '-f' || arg === '-F') {
+      const value = args[++i];
+      if (value === undefined || value.startsWith('-')) {
+        unknown = true;
+        i--; // Parse the next option too; a missing payload must never hide --json.
+      }
+      continue;
+    }
+    if (arg === '--json' || arg.startsWith('--json=')) {
+      if (seen || root === 'api') unknown = true;
+      seen = true;
+      const value = arg === '--json' ? args[++i] : arg.slice('--json='.length);
+      const parts = value?.split(',');
+      if (!parts?.length || parts.length > MAX_FIELDS || parts.some((part) => !FIELDS.has(part))) {
+        unknown = true;
+      } else {
+        fields = parts;
+      }
+    } else if (arg.startsWith('--json')) {
+      unknown = true;
+    } else if (arg.startsWith('-') && arg !== '-') {
+      // Unknown options can consume arguments; fail closed rather than infer fields.
+      unknown = true;
+    }
+  }
+  return { command, fields: unknown ? 'unknown' : fields, unknown };
+}
+
+export function captureGhCall(args: readonly string[], file: string): void {
+  const row = JSON.stringify(classifyGhCall(args)) + '\n';
+  const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT, 0o600);
+  try {
+    // One bounded append per invocation: concurrent children cannot interleave JSONL fragments.
+    if (writeSync(fd, row) !== Buffer.byteLength(row)) throw new Error('short JSONL write');
+  } finally {
+    closeSync(fd);
+  }
+}
+
+if (import.meta.main) {
+  const file = process.env.ELANOUS_GH_SURFACE_JSONL;
+  if (!file) {
+    console.error('gh-surface: JSONL destination not configured');
+    process.exitCode = 70;
+  } else {
+    try {
+      captureGhCall(process.argv.slice(2), file);
+    } catch {
+      // Filesystem exception text can contain a path or user input.
+      console.error('gh-surface: capture failed');
+      process.exitCode = 70;
+    }
+  }
+}

package/scripts/gh-surface/gh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Opt-in only: the launcher must prepend this directory to its isolated child's PATH.
+case ${ELANOUS_GH_REAL_BIN-} in
+  /*) ;;
+  *) printf '%s\n' 'gh-surface: real gh absolute path required' >&2; exit 70 ;;
+esac
+if [ ! -f "$ELANOUS_GH_REAL_BIN" ] || [ ! -x "$ELANOUS_GH_REAL_BIN" ] || [ "$ELANOUS_GH_REAL_BIN" -ef "$0" ]; then
+  printf '%s\n' 'gh-surface: real gh unavailable' >&2
+  exit 70
+fi
+case $0 in
+  */*) capture=${0%/*}/capture.ts ;;
+  *) printf '%s\n' 'gh-surface: wrapper path unavailable' >&2; exit 70 ;;
+esac
+capture_pid=
+forward_signal() {
+  signal=$1
+  trap - INT TERM
+  if [ -n "$capture_pid" ]; then
+    # Noninteractive shells may start an async child with SIGINT ignored.
+    # TERM reliably stops capture; the wrapper still exits with the original signal.
+    child_signal=$signal
+    if [ "$signal" = INT ]; then child_signal=TERM; fi
+    kill -s "$child_signal" "$capture_pid" 2>/dev/null || :
+    wait "$capture_pid" 2>/dev/null || :
+  fi
+  kill -s "$signal" "$$"
+}
+trap 'forward_signal INT' INT
+trap 'forward_signal TERM' TERM
+bun "$capture" "$@" &
+capture_pid=$!
+wait "$capture_pid"
+capture_status=$?
+trap - INT TERM
+if [ "$capture_status" -ne 0 ]; then
+  printf '%s\n' 'gh-surface: capture failed' >&2
+  exit 70
+fi
+exec "$ELANOUS_GH_REAL_BIN" "$@"

package/scripts/import-graph-scc.ts

@@ -0,0 +1,38 @@
+#!/usr/bin/env bun
+// Read-only operator/train entry: bun scripts/import-graph-scc.ts --base <full SHA> [--repo <clean checkout>]
+import { reportImportGraphSccForGate } from './release-loop/import-graph-scc-run.js';
+
+function parse(args: readonly string[]): { base40: string; repo: string; format: 'json' | 'table' } | null {
+  if (args.length % 2 !== 0) return null;
+  const values = new Map<string, string>();
+  for (let at = 0; at < args.length; at += 2) {
+    const name = args[at]!;
+    const value = args[at + 1]!;
+    if ((name !== '--base' && name !== '--repo' && name !== '--format') || !value || value.startsWith('-') || values.has(name)) return null;
+    values.set(name, value);
+  }
+  const base40 = values.get('--base');
+  const format = values.get('--format') ?? 'json';
+  return base40 && (format === 'json' || format === 'table')
+    ? { base40, repo: values.get('--repo') ?? process.cwd(), format } : null;
+}
+
+const input = parse(process.argv.slice(2));
+if (!input) {
+  process.stderr.write('usage: bun scripts/import-graph-scc.ts --base <full SHA> [--repo <clean checkout>] [--format json|table]\n');
+  process.exitCode = 2;
+} else {
+  const result = reportImportGraphSccForGate(input.repo, input.base40);
+  if (input.format === 'table' && result.ok) {
+    const { report } = result;
+    const rows = [
+      `HEAD ${result.head40}  BASE ${result.base40}`,
+      `SCC ${report.cycleCount}  largest ${report.largestScc}  cut candidates ${report.cutCandidateTotal}  ${report.measured ? 'measured' : 'unmeasured'}`,
+      'Changed file | Definite tests | Possible tests | Impact',
+      '--- | ---: | ---: | ---',
+      ...report.changedFileImpacts.map((impact) => `${impact.file} | ${impact.affectedTestCount} | ${impact.possibleTestCount} | ${impact.measured ? 'measured' : impact.issues.join('; ')}`),
+    ];
+    process.stdout.write(`${rows.join('\n')}\n`);
+  } else process.stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = !result.ok ? 2 : result.report.measured ? 0 : 1;
+}

package/scripts/install.ps1

@@ -101,6 +101,25 @@ for ($index = 0; $index -lt $RemainingArgs.Count; $index++) {
 if ($Help) { Show-Usage; exit 0 }
 $installLang = if ($env:ELANOUS_INSTALL_LANG) { $env:ELANOUS_INSTALL_LANG } else { [Globalization.CultureInfo]::CurrentUICulture.Name }
 $installLang = if ($installLang -match '^ko(?:-|$)') { 'ko' } else { 'en' }
+
+# WIN-ARM64-VM-TRIAL (0.2.40): Windows on ARM reports ARM64 via PROCESSOR_ARCHITECTURE (ARM64-native
+# host) or PROCESSOR_ARCHITEW6432 (32-bit host on 64-bit Windows). bun, the required runtime, publishes
+# no Windows ARM64 build (its installer fetches bun-windows-x64), so refuse before touching the prefix
+# or the profile. Exit 78 (EX_CONFIG) keeps this distinct from 127 (required command missing) and 1.
+# Third tier (re-issued fragment): a host that spawns PowerShell with a scrubbed environment block still
+# reports its architecture through the .NET runtime (RuntimeInformation, in .NET since 4.7.1, the floor
+# under PowerShell 5.1), so fall back to it only when both environment variables are absent. Guarded to
+# Windows_NT: elsewhere the host architecture says nothing about Windows installability and the gate must
+# keep its pre-fallback behavior. Uppercased: the enum prints Arm64, the check below reads ARM64.
+$osArchitecture = $env:PROCESSOR_ARCHITEW6432
+if (-not $osArchitecture) { $osArchitecture = $env:PROCESSOR_ARCHITECTURE }
+if (-not $osArchitecture -and $env:OS -eq 'Windows_NT') {
+  try { $osArchitecture = ([string][System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture).ToUpperInvariant() } catch { $osArchitecture = $null }
+}
+if ($osArchitecture -eq 'ARM64') {
+  Fail (Say 'Windows on ARM (ARM64) is not supported yet: bun, the required runtime, has no Windows ARM64 build, so nothing was installed. Use x64 Windows for now (WIN-ARM64-VM-TRIAL tracks the first live measurement).' '\uc708\ub3c4\uc6b0 ARM(ARM64)\uc740 \uc544\uc9c1 \uc9c0\uc6d0\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4: \ud544\uc218 \ub7f0\ud0c0\uc784 bun \uc5d0 \uc708\ub3c4\uc6b0 ARM64 \ube4c\ub4dc\uac00 \uc5c6\uc5b4 \uc544\ubb34\uac83\ub3c4 \uc124\uce58\ud558\uc9c0 \uc54a\uc558\uc2b5\ub2c8\ub2e4. \ub2f9\ubd84\uac04 x64 \uc708\ub3c4\uc6b0\ub97c \uc0ac\uc6a9\ud558\uc138\uc694(WIN-ARM64-VM-TRIAL \uce78\uc774 \uccab \uc2e4\uce21\uc744 \ucd94\uc801\ud569\ub2c8\ub2e4).') 78
+}
+
 if (-not $Prefix) {
   $dataHome = if ($env:LOCALAPPDATA) { $env:LOCALAPPDATA } else { Join-Path $HOME 'AppData\Local' }
   $Prefix = if ($env:ELANOUS_INSTALL_PREFIX) { $env:ELANOUS_INSTALL_PREFIX } else { Join-Path $dataHome 'elanous' }