elanous 0.2.31 → 0.2.34

package/scripts/hq/standby-snapshot.ts

@@ -193,8 +193,33 @@ function pushSurvival(target: string, local: string, manifest: Manifest, root: s
   rmSync(staging, { recursive: true, force: true });
 }
 
+/** Flags that need a value before any snapshot work (STANDBY-SURVIVAL-KEEP-ARGS · mirror parseVerifyArgs / parsePromoteArgs). */
+export const SURVIVAL_VALUE_FLAGS = ['--survival-keep', '--survival-keep-daily', '--prune-survival'] as const;
+
+/** Throw when a survival-keep / prune-survival flag is present without its value/target — same rule as `${flag} requires a value`. */
+export function assertSurvivalKeepArgs(argv: string[]): void {
+  for (const flag of SURVIVAL_VALUE_FLAGS) {
+    for (let i = 0; i < argv.length; i += 1) {
+      const token = argv[i];
+      if (token.startsWith(`${flag}=`)) {
+        if (token === `${flag}=`) throw new Error(`${flag} requires a value`);
+        continue;
+      }
+      if (token !== flag) continue;
+      const value = argv[i + 1];
+      if (!value || value.startsWith('--')) throw new Error(`${flag} requires a value`);
+    }
+  }
+}
+
 if (import.meta.main) {
   const argv = process.argv.slice(2);
+  try {
+    assertSurvivalKeepArgs(argv);
+  } catch (error) {
+    console.error(`standby-snapshot: ${String(error)}`);
+    process.exit(2);
+  }
   const val = (k: string) => { const i = argv.indexOf(k); return i >= 0 ? argv[i + 1] : undefined; };
   const tier = (val('--tier') ?? 'core') as Tier;
   if (tier !== 'core' && tier !== 'big' && tier !== 'obs') { console.error('--tier core|big|obs'); process.exit(2); }

package/scripts/measure-si-task-cpu.ts

@@ -0,0 +1,143 @@
+#!/usr/bin/env bun
+/** Read-only, point-in-time CPU measurement of si-task Pods. No Jobs or Pods are created. */
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+type Pod = {
+  metadata?: { name?: string; creationTimestamp?: string };
+  status?: { phase?: string; containerStatuses?: Array<{ state?: { terminated?: { finishedAt?: string } } }> };
+  spec?: { containers?: Array<{ name?: string; resources?: { requests?: { cpu?: string } } }> };
+};
+type PodMetric = { metadata?: { name?: string }; timestamp?: string; containers?: Array<{ name?: string; usage?: { cpu?: string } }> };
+type KubeList<T> = { items?: T[] };
+
+export type CpuObservation = {
+  dateKst: string;
+  context: string;
+  namespace: string;
+  measuredAt: string;
+  coverage: 'point-in-time-current-pods-only';
+  podsSeenToday: number;
+  unknownOverlapPods: number;
+  podsWithMetric: number;
+  podsWithoutMetric: number;
+  oldestMetricAgeSeconds: number | null;
+  cpuMillis: { p50: number | null; p95: number | null; max: number | null };
+  candidates: Array<{ request: string; requestMillis: number; p95OfRequest: number | null; observedComparison: string; decision: string }>;
+  pods: Array<{ name: string; phase: string; requestMillis: number | null; usageMillis: number | null; metricTimestamp: string | null; metricAgeSeconds: number | null }>;
+};
+
+/** Kubernetes CPU quantity to millicores; null means unusable evidence. */
+export function cpuMillis(value: unknown): number | null {
+  if (typeof value !== 'string') return null;
+  const match = /^(\d+(?:\.\d+)?)(n|u|m)?$/.exec(value);
+  if (!match) return null;
+  const factor = match[2] === 'n' ? 0.000001 : match[2] === 'u' ? 0.001 : match[2] === 'm' ? 1 : 1000;
+  const result = Number(match[1]) * factor;
+  return Number.isFinite(result) ? result : null;
+}
+
+function percentile(sorted: readonly number[], fraction: number): number | null {
+  if (!sorted.length) return null;
+  return Math.round(sorted[Math.ceil(fraction * sorted.length) - 1]! * 100) / 100;
+}
+
+export function measureSiTaskCpu(
+  pods: KubeList<Pod>, metrics: KubeList<PodMetric>,
+  options: { dateKst: string; context: string; namespace: string; now?: Date },
+): CpuObservation {
+  const start = Date.parse(`${options.dateKst}T00:00:00+09:00`);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(options.dateKst) || !Number.isFinite(start)
+    || new Date(start + 9 * 60 * 60 * 1000).toISOString().slice(0, 10) !== options.dateKst)
+    throw new Error(`invalid KST date: ${options.dateKst}`);
+  const end = start + 24 * 60 * 60 * 1000;
+  const now = options.now ?? new Date();
+  const byName = new Map((metrics.items ?? []).map((metric) => [metric.metadata?.name, metric]));
+  let unknownOverlapPods = 0;
+  const rows = (pods.items ?? []).filter((pod) => {
+    const name = pod.metadata?.name ?? '';
+    const created = Date.parse(pod.metadata?.creationTimestamp ?? '');
+    const finished = pod.status?.containerStatuses?.map((item) => Date.parse(item.state?.terminated?.finishedAt ?? ''))
+      .filter(Number.isFinite).sort((a, b) => b - a)[0];
+    const terminal = ['Succeeded', 'Failed'].includes(pod.status?.phase ?? '');
+    if (!name.startsWith('si-task-') || !Number.isFinite(created) || created >= end) return false;
+    if (created < start && terminal && finished === undefined) {
+      unknownOverlapPods++;
+      return false;
+    }
+    return !terminal || finished === undefined || finished >= start;
+  }).map((pod) => {
+    const name = pod.metadata!.name!;
+    const metric = byName.get(name);
+    const timestamp = Date.parse(metric?.timestamp ?? '');
+    const values = metric?.containers?.map((item) => cpuMillis(item.usage?.cpu)) ?? [];
+    const expected = pod.spec?.containers ?? [];
+    const namesMatch = expected.every((container) => !container.name || metric?.containers?.some((item) => item.name === container.name));
+    const containersComplete = expected.length > 0 && values.length === expected.length && namesMatch;
+    // Missing any container value is missing Pod usage, not a zero.
+    const ageSeconds = Math.round((now.getTime() - timestamp) / 1000);
+    const usageMillis = Number.isFinite(timestamp) && timestamp >= start && timestamp < end
+      && ageSeconds >= -120 && ageSeconds <= 120
+      && containersComplete && values.every((value) => value !== null)
+      ? Math.round((values as number[]).reduce((sum, value) => sum + value, 0) * 100) / 100 : null;
+    const requests = pod.spec?.containers?.map((item) => cpuMillis(item.resources?.requests?.cpu)) ?? [];
+    return {
+      name, phase: pod.status?.phase ?? 'Unknown',
+      requestMillis: requests.length > 0 && requests.every((value) => value !== null)
+        ? Math.round((requests as number[]).reduce((sum, value) => sum + value, 0) * 100) / 100 : null,
+      usageMillis, metricTimestamp: Number.isFinite(timestamp) ? metric!.timestamp! : null,
+      metricAgeSeconds: Number.isFinite(timestamp) ? ageSeconds : null,
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const measured = rows.flatMap((row) => row.usageMillis === null ? [] : [row.usageMillis]).sort((a, b) => a - b);
+  const ages = rows.flatMap((row) => row.metricAgeSeconds === null ? [] : [row.metricAgeSeconds]);
+  const oldestMetricAgeSeconds = ages.length ? Math.max(...ages) : null;
+  const stale = rows.some((row) => row.metricTimestamp !== null && row.metricAgeSeconds !== null
+    && (Date.parse(row.metricTimestamp) < start || Date.parse(row.metricTimestamp) >= end
+      || row.metricAgeSeconds < -120 || row.metricAgeSeconds > 120));
+  const p95 = percentile(measured, 0.95);
+  const candidates = [250, 500, 1000].map((requestMillis) => ({
+    request: requestMillis === 1000 ? '1' : `${requestMillis}m`, requestMillis,
+    p95OfRequest: p95 === null ? null : Math.round(p95 / requestMillis * 1000) / 10,
+    observedComparison: p95 === null ? 'unmeasured' : p95 <= requestMillis ? 'observed-p95-within-request' : 'observed-p95-above-request',
+    // A single metrics-server snapshot cannot justify a request change, even with full current-Pod coverage.
+    decision: stale ? 'stale-snapshot' : p95 === null ? 'unmeasured'
+      : measured.length < rows.length || unknownOverlapPods > 0 ? 'incomplete-coverage' : 'needs-time-series',
+  }));
+  return {
+    dateKst: options.dateKst, context: options.context, namespace: options.namespace,
+    measuredAt: now.toISOString(), coverage: 'point-in-time-current-pods-only',
+    podsSeenToday: rows.length, unknownOverlapPods, podsWithMetric: measured.length, podsWithoutMetric: rows.length - measured.length,
+    oldestMetricAgeSeconds,
+    cpuMillis: { p50: percentile(measured, 0.5), p95, max: measured.at(-1) ?? null }, candidates, pods: rows,
+  };
+}
+
+function kubectl(args: string[]): unknown {
+  const result = spawnSync('kubectl', args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 20_000 });
+  if (result.error || result.status !== 0) throw new Error(`kubectl ${args.at(-1)} failed: ${result.error?.message ?? result.stderr?.trim() ?? result.status}`);
+  return JSON.parse(result.stdout);
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const option = (flag: string): string | undefined => {
+    const index = args.indexOf(flag);
+    return index < 0 ? undefined : args[index + 1];
+  };
+  const usage = 'Usage: bun scripts/measure-si-task-cpu.ts [--context pool-node-b] [--namespace elanous-test] [--date YYYY-MM-DD] [--pods-json FILE --metrics-json FILE]';
+  const known = new Set(['--context', '--namespace', '--date', '--pods-json', '--metrics-json']);
+  if (args.includes('--help')) { console.log(usage); process.exit(0); }
+  if (args.some((arg, index) => index % 2 === 0 ? !known.has(arg) : arg.startsWith('--')) || args.length % 2) throw new Error(usage);
+  const podsPath = option('--pods-json');
+  const metricsPath = option('--metrics-json');
+  const offline = Boolean(podsPath || metricsPath);
+  const context = option('--context') ?? (offline ? 'unknown' : 'pool-node-b');
+  const namespace = option('--namespace') ?? (offline ? 'unknown' : 'elanous-test');
+  const dateKst = option('--date') ?? new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(new Date());
+  if (Boolean(podsPath) !== Boolean(metricsPath)) throw new Error('both --pods-json and --metrics-json are required for offline input');
+  const pods = podsPath ? JSON.parse(readFileSync(podsPath, 'utf8')) : kubectl(['--context', context, '-n', namespace, 'get', 'pods', '-o', 'json']);
+  const metrics = metricsPath ? JSON.parse(readFileSync(metricsPath, 'utf8'))
+    : kubectl(['--context', context, 'get', '--raw', `/apis/metrics.k8s.io/v1beta1/namespaces/${encodeURIComponent(namespace)}/pods`]);
+  console.log(JSON.stringify(measureSiTaskCpu(pods, metrics, { dateKst, context, namespace }), null, 2));
+}

package/scripts/public-export.ts

@@ -283,6 +283,45 @@ export function scanLeaks(root: string, files: readonly string[], markers = LEAK
   return hits;
 }
 
+/** Code literals are reported separately for the crown marker: they are not document/comment leakage. */
+function codeLiteralRanges(file: string, text: string): Array<[number, number]> {
+  if (!/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(file)) return [];
+  const scanner = ts.createScanner(ts.ScriptTarget.Latest, false, /\.(?:tsx|jsx)$/iu.test(file) ? ts.LanguageVariant.JSX : ts.LanguageVariant.Standard, text);
+  const ranges: Array<[number, number]> = [];
+  for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
+    if (token === ts.SyntaxKind.StringLiteral || token === ts.SyntaxKind.NoSubstitutionTemplateLiteral ||
+        token === ts.SyntaxKind.TemplateHead || token === ts.SyntaxKind.TemplateMiddle || token === ts.SyntaxKind.TemplateTail) {
+      ranges.push([scanner.getTokenPos(), scanner.getTextPos()]);
+    }
+  }
+  return ranges;
+}
+
+export function splitCodeLiteralCeoMarks(files: readonly string[], contents: ReadonlyMap<string, string>, hits: readonly LeakHit[]): { leaks: LeakHit[]; codeLiterals: LeakHit[] } {
+  const leaks: LeakHit[] = [];
+  const codeLiterals: LeakHit[] = [];
+  const fileSet = new Set(files);
+  const classification = new Map<string, Set<number>>();
+  for (const file of new Set(hits.filter((hit) => hit.marker === 'ceo-mark' && !/\.(?:test|spec)\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(hit.file)).map((hit) => hit.file))) {
+    const text = contents.get(file);
+    if (text === undefined || !fileSet.has(file)) continue;
+    const ranges = codeLiteralRanges(file, text);
+    const lines = new Set<number>();
+    let offset = 0;
+    text.split('\n').forEach((line, index) => {
+      const marks = [...line.matchAll(/\u{1F451}/gu)];
+      if (marks.length && marks.every((mark) => ranges.some(([from, to]) => offset + mark.index! >= from && offset + mark.index! + mark[0].length <= to))) lines.add(index + 1);
+      offset += line.length + 1;
+    });
+    classification.set(file, lines);
+  }
+  for (const hit of hits) {
+    if (hit.marker !== 'ceo-mark' || /\.(?:test|spec)\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(hit.file)) { leaks.push(hit); continue; }
+    (classification.get(hit.file)?.has(hit.line) ? codeLiterals : leaks).push(hit);
+  }
+  return { leaks, codeLiterals };
+}
+
 /**
  * 🆕 `runtime-path-outside-export` — 공개되는 «코드»가 공개본에 «없는» 저장소 경로를 문자열로 쥐고 있다.
  * 계기: `docs/graph-templates/**` 가 허용 목록에서 빠져 공개본 영상 라인이 실행 중에 죽을 뻔했다(🅣 · `#20098`).
@@ -448,12 +487,13 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
       }
       console.error(`exported ${files.length} files (+${Object.keys(config.replace).length} replaced) → ${target}`);
     }
-    const hits = [
+    const rawHits = [
       ...gitIgnoredExportFiles(root, files).filter(inScope).map((file) => ({ marker: 'export-gitignored', file, line: 0, text: '공개본 .gitignore 에 걸린다 — 커밋하면 사라진다' })),
       ...scanLeaks(root, scanned, LEAK_MARKERS, transformed.contents, realDocs),
       ...(redactions ? scanLeaks(root, scanned, privateIdentifierMarkers(redactions), transformed.contents, realDocs) : []),
       ...(!redactions && !noPrivateList ? [{ marker: 'private-identifiers-unchecked', file: privateRedactionsPath(), line: 0, text: 'private redaction list missing' }] : []),
     ];
+    const { leaks: hits, codeLiterals } = splitCodeLiteralCeoMarks(scanned, transformed.contents, rawHits);
     const advisory = scanRuntimePaths(root, files, tracked, transformed.contents).filter((h) => inScope(h.file));
     const summary = summarizeLeaks(hits);
     const advisorySummary = summarizeLeaks(advisory);
@@ -464,6 +504,7 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
     if (json) {
       console.log(JSON.stringify({
         files: scanned.length, leaks: hits.length, summary, before: { leaks: before.length, summary: beforeSummary }, transforms: transformed.counts, privateRedactions,
+        codeLiterals: { hits: codeLiterals.length, summary: summarizeLeaks(codeLiterals), items: all ? codeLiterals : codeLiterals.slice(0, limit) },
         shownHits: shown.length, truncated, omittedHits: hits.length - shown.length,
         ...(pathPrefix ? { pathPrefix } : {}), hits: shown,
         advisory: { hits: advisory.length, summary: advisorySummary, judge: RUNTIME_PATH_JUDGE, items: all ? advisory : advisory.slice(0, limit) },
@@ -473,6 +514,7 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
       console.log(`leak check — ${scanned.length} files${pathPrefix ? ` under ${pathPrefix}` : ''} · ${hits.length} hits`);
       for (const [marker, s] of Object.entries(summary)) console.log(`  ${marker.padEnd(20)} ${String(s.files).padStart(5)} files  ${String(s.hits).padStart(6)} lines`);
       for (const hit of shown) console.log(`  ${hit.marker}  ${hit.file}:${hit.line}  ${hit.text}`);
+      if (codeLiterals.length) console.log(`code literals (not document/comment leakage) — ceo-mark ${codeLiterals.length} lines`);
       if (truncated) console.log(`  … ${hits.length - shown.length} more hits not shown — use --all, or narrow with --path <prefix> (⛔ «not in this list» ≠ «no leak»)`);
       if (advisory.length) console.log(`advisory (not counted) — runtime-path-outside-export ${advisory.length} lines · ${advisorySummary['runtime-path-outside-export']?.files ?? 0} files · judge = ${RUNTIME_PATH_JUDGE}`);
     }

package/scripts/ratchets/test-interference-patterns.allowlist.txt

@@ -77,7 +77,6 @@ body-dynamic-import	src/nexus/index.test.ts	1
 body-dynamic-import	src/pty-shell/pty-control-stance.test.ts	12
 body-dynamic-import	src/pty-shell/tui-run-state.test.ts	1
 body-dynamic-import	src/registry/catalog-discovery-fold.test.ts	1
-body-dynamic-import	src/self-dev/ask-launch-flow.test.ts	2
 body-dynamic-import	src/self-dev/dev-cli.test.ts	1
 body-dynamic-import	src/self-dev/dev-pipeline.test.ts	1
 body-dynamic-import	src/self-dev/entrance-registry.test.ts	3
@@ -222,7 +221,6 @@ chdir-without-restore	src/task-orchestrator/surfaces/dev-harness.test.ts	1
 chdir-without-restore	src/task-orchestrator/surfaces/pod-no-result.test.ts	2
 chdir-without-restore	src/task-orchestrator/surfaces/pod-ta-land-owner.test.ts	1
 chdir-without-restore	src/task-orchestrator/surfaces/self-implement-pod-oom-retry.test.ts	1
-chdir-without-restore	src/task-orchestrator/surfaces/self-implement-pod.test.ts	19
 chdir-without-restore	src/task-orchestrator/surfaces/self-implement.test.ts	1
 chdir-without-restore	test/llm-codex-dedup-guard.test.ts	1
 chdir-without-restore	test/oauth/codex-account-mirror.test.ts	1

package/scripts/ratchets/train-side-invariants.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Train-side sentinel for the eight real HARD 0.2.32 regressions. Run on the
+# merged side tree before the changed-file gate; never interpret a missing test
+# or an incomplete run as a pass.
+set -u
+
+files=(
+  scripts/ratchets/test-interference-patterns.test.ts
+  src/domains/finance-cli.test.ts
+  src/instance/state-dir-provenance-ratchet.test.ts
+  src/self-implement/graph-yaml.test.ts
+  src/self-implement/self-cli-sink-surface.test.ts
+  test/identity-env.test.ts
+  test/no-absolute-path-imports.test.ts
+  test/scenarios/integration.test.ts
+)
+
+if [[ ${1:-} == --list ]]; then
+  printf '%s\n' "${files[@]}"
+  exit 0
+fi
+if [[ $# -gt 1 ]]; then
+  echo 'TRAIN_INVARIANTS_UNMEASURED invalid-arguments'
+  exit 2
+fi
+cd "${1:-.}" || { echo 'TRAIN_INVARIANTS_UNMEASURED repo-unreadable'; exit 2; }
+command -v bun >/dev/null 2>&1 || { echo 'TRAIN_INVARIANTS_UNMEASURED bun-missing'; exit 2; }
+
+for file in "${files[@]}"; do
+  if [[ ! -f $file ]]; then
+    echo "TRAIN_INVARIANTS_UNMEASURED missing-file=$file"
+    exit 2
+  fi
+done
+
+for file in "${files[@]}"; do
+  echo "TRAIN_INVARIANTS_START $file"
+  bun test "$file"
+  rc=$?
+  if [[ $rc -ne 0 ]]; then
+    echo "TRAIN_INVARIANTS_FAIL file=$file rc=$rc"
+    exit 1
+  fi
+done
+echo "TRAIN_INVARIANTS_PASS files=${#files[@]}"

package/scripts/release-loop/auto-approve-node.ts

@@ -15,8 +15,12 @@ const outcomeMetric = (name: string, node: Record<string, unknown> | undefined):
   verdict: node?.outcome === undefined ? 'unmeasured' : node.outcome === 'ok' ? 'pass' : 'fail',
 });
 
-/** Rows shown in auto-approval.md but never counted toward the 8 blocking metrics. */
+/** Rows outside the original eight fixed metrics. TUI regressions have their own HITL gate below. */
 export const WARNING_ONLY = new Set(['tui-regress', 'mac-smoke']);
+export const BLOCKING_METRIC_NAMES = [
+  'gate regressions and measurement', 'bun version', 'upgrade', 'tui', 'notes-check',
+  'public leak and prepare completeness', 'docs notes page', 'installation files',
+] as const;
 
 /** `ok` · `warn` (a failure) · `unmeasured` (error or no output) — the macOS smoke never blocks publishing. */
 function macSmokeLevel(node: Record<string, unknown> | undefined): 'ok' | 'warn' | 'unmeasured' {
@@ -42,40 +46,50 @@ export function runAutoApprove(context: GraphContext = readGraphContext(), deps:
     catch { distCount = undefined; }
   }
   const gateErrorAbsent = gate && !Object.hasOwn(gate, 'error');
-  const regressStatus = regressWarning(validatedTuiRegress(context.outputs.tui?.regress));
+  const regress = validatedTuiRegress(context.outputs.tui?.regress);
+  const regressStatus = regressWarning(regress);
+  const failedCheckIds = 'unmeasured' in regress ? null : regress.results.filter((result) => !result.ok).map((result) => result.id);
+  const failedLabel = failedCheckIds === null ? 'unmeasured' : `${failedCheckIds.length} [${failedCheckIds.join(', ') || '-'}]`;
+  const regressNeedsApproval = regressStatus.level !== 'ok';
   const macSmoke = context.outputs['mac-smoke'];
   const metrics: ApprovalMetric[] = [
-    { name: 'gate regressions and measurement', value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
+    { name: BLOCKING_METRIC_NAMES[0], value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
       verdict: !gate || gate.outcome === undefined || !Array.isArray(gate.introduced) ? 'unmeasured'
         : gate.outcome === 'ok' && gate.introduced.length === 0 && gateErrorAbsent ? 'pass' : 'fail' },
-    { name: 'bun version', value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
+    { name: BLOCKING_METRIC_NAMES[1], value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
       verdict: !pinned ? 'unmeasured' : bunVersion === pinned ? 'pass' : 'fail' },
-    outcomeMetric('upgrade', context.outputs.upgrade),
-    outcomeMetric('tui', context.outputs.tui),
-    outcomeMetric('notes-check', context.outputs['notes-check']),
-    { name: 'public leak and prepare completeness', value: `prepare=${prepare?.outcome ?? 'missing'}`,
+    outcomeMetric(BLOCKING_METRIC_NAMES[2], context.outputs.upgrade),
+    outcomeMetric(BLOCKING_METRIC_NAMES[3], context.outputs.tui),
+    outcomeMetric(BLOCKING_METRIC_NAMES[4], context.outputs['notes-check']),
+    { name: BLOCKING_METRIC_NAMES[5], value: `prepare=${prepare?.outcome ?? 'missing'}`,
       verdict: prepare?.outcome === undefined ? 'unmeasured' : prepare.outcome === 'ok' ? 'pass' : 'fail' },
-    { name: 'docs notes page', value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
+    { name: BLOCKING_METRIC_NAMES[6], value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
       verdict: context.outputs.docs?.outcome === undefined || context.outputs.docs.notes === undefined ? 'unmeasured'
         : context.outputs.docs.outcome === 'ok' && typeof context.outputs.docs.notes === 'string' && context.outputs.docs.notes.trim() ? 'pass' : 'fail' },
-    { name: 'installation files', value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
+    { name: BLOCKING_METRIC_NAMES[7], value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
       verdict: prepare?.outcome !== 'ok' ? prepare?.outcome === undefined ? 'unmeasured' : 'fail'
         : distCount === undefined ? 'unmeasured' : distCount === 5 ? 'pass' : 'fail' },
-    // Warning-only and last, so the numbered rows 1–8 keep their places in auto-approval.md (V1g follow-up).
-    { name: 'tui-regress', value: regressStatus.level, reason: regressStatus.line, verdict: 'pass' },
+    // Kept after the eight fixed metrics; a failed or unmeasured subcheck requires the existing approve-publish HITL node.
+    { name: 'tui-regress', value: regressStatus.level, reason: regressStatus.line,
+      verdict: regressStatus.level === 'ok' ? 'pass' : regressStatus.level === 'warn' ? 'fail' : 'unmeasured' },
     // MAC1: the macOS smoke is warning-only too (ship with known issues) — shown, never counted.
     { name: 'mac-smoke', value: macSmokeLevel(macSmoke), reason: typeof macSmoke?.summary === 'string' ? macSmoke.summary : undefined, verdict: 'pass' },
   ];
-  const outcome = metrics.filter((metric) => !WARNING_ONLY.has(metric.name)).every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
+  const outcome = metrics.filter((metric) => !WARNING_ONLY.has(metric.name)).every((metric) => metric.verdict === 'pass')
+    && !regressNeedsApproval ? 'ok' as const : 'fail' as const;
   const report = join(root, 'release', version, 'auto-approval.md');
   const lines = [`# v${version} auto-approval`, '', `Outcome: ${outcome}`, '', '| # | Metric | Value | Verdict |', '|---|---|---|---|',
     ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${[metric.value, metric.reason].filter(Boolean).join(' — ').replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
+    '', `TUI subcheck: ${regressStatus.level} · failed ${failedLabel} · ${regressNeedsApproval ? 'HITL 수용/정지 필요' : '자동 판정 가능'}`,
     '', '## 되돌리는 법', `gh release edit v${version} --draft`, `git tag -d v${version} && git push origin :refs/tags/v${version}`, '해당 docs PR revert', ''];
   mkdirSync(dirname(report), { recursive: true });
   writeFileSync(report, lines.join('\n'));
-  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics });
-  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => !WARNING_ONLY.has(metric.name) && metric.verdict === 'pass').length}/8`,
-    ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
+  const tuiSubcheck = { runId: context.runId ?? null, level: regressStatus.level,
+    fail: failedCheckIds?.length ?? null, failedCheckIds, approvalRequired: regressNeedsApproval };
+  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics, tuiSubcheck });
+  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const,
+    summary: `auto approval ${outcome}: ${metrics.filter((metric) => !WARNING_ONLY.has(metric.name) && metric.verdict === 'pass').length}/8${regressNeedsApproval ? ` · tui-regress ${regressStatus.level} failed ${failedLabel} → HITL` : ''}`,
+    runId: context.runId ?? null, tuiSubcheck, ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
 }
 
 if (import.meta.main) {

package/scripts/release-loop/gate-closure.ts

@@ -11,6 +11,9 @@ import { sourceCandidates } from '../../src/self-implement/importer-test-index.j
 
 /** Files the closure follows (code). Changing anything else that is not a test or inert Markdown is a full gate. */
 export const CODE_FILE = /\.(?:[cm]?[jt]sx?)$/;
+/** One release input whose readers use a literal basename in readFileSync(join(import.meta.dir, ...)).
+ *  Other JSON stays a full gate until its dependency edge is proved. */
+export const TRACEABLE_RELEASE_JSON = 'scripts/release-loop/known-issues-0.2.33-approved.json';
 const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
 /** Test-side helpers: their filesystem scans and unresolved code paths make a test opaque (production code is trusted to
  *  reach code only through imports and the literal paths below). */
@@ -159,7 +162,8 @@ export function buildClosureGraph(tree: ClosureTree, options: ClosureOptions = {
     for (const match of code.matchAll(LITERAL)) {
       const value = match[2]!;
       if (!value || value.length > 300 || value.includes('${') || /\s/.test(value) || /^[a-z]+:/i.test(value)) continue;
-      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value);
+      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value)
+        || value === TRACEABLE_RELEASE_JSON.split('/').at(-1);
       if (!pathLike) continue;
       const plain = value.replace(/\/$/, '');
       const hit = resolveLiteral(file, plain);

package/scripts/release-loop/gate-diff.ts

@@ -12,7 +12,7 @@ export function parseFailures(output: string): string[] {
     const line = raw.trim();
     const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
     if (header) { file = header[1]; continue; }
-    const failed = /^\(fail\)[ \t]+(.+?)(?:[ \t]+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    const failed = /^\(fail\)[ \t]+(.+?)(?:[ \t]+\[[\d.]+(?:ms|s)\])?[ \t]*$/.exec(raw);
     if (failed && file) failures.add(`${file} > ${failed[1]!.trim()}`);
   }
   return [...failures].sort();