elanous 0.2.35 → 0.2.36

package/src/self-implement/run-ttl.ts

@@ -5,13 +5,15 @@
  * Past `tools.selfImplement.runTtlHours` (default 24) since its last commit, the sweep makes one pre-emptive move:
  *   · live owning run → one resync memo in its control inbox (same path as SIBLING-RESYNC #24893/#24899),
  *                       at most once per (PR, head sha) — a rebase moves the head and re-arms it
- *   · no live run     → the registered `elanous:needs-rebase` label, once (QUIET-PR-COMMENTS: never a comment);
- *                       when `requestRegate` is supplied, at most one of those stale PRs is also selected
- *                       for a re-gate request (shadow: would-regate observation only; live: one call)
+ *   · no live run     → when `requestRegate` is supplied, at most one of those stale PRs is selected for a
+ *                       re-gate request (shadow: would-regate observation only; live: one call), and the
+ *                       registered `elanous:needs-rebase` label otherwise — once (QUIET-PR-COMMENTS: never a comment)
  *
  * Mode `tools.selfImplement.runTtl.mode`: `shadow` (default) only logs what it would do; `live` writes.
  * Cost bound: a PR opened inside the TTL is still inside its own time-to-landing and is never fetched
- * (`freshByCreation`), already-marked PRs without a live run are skipped before any fetch, at most `maxFetch` last-commit lookups per sweep with `concurrency` in flight, and at most `cap` actions.
+ * (`freshByCreation`), already-marked PRs without a live run are skipped before any fetch, at most `maxFetch`
+ * last-commit lookups per sweep with `concurrency` in flight, and at most `cap` actions — memo, marker and
+ * re-gate request all draw from that one budget, so a sweep never performs more than `cap` side effects.
  *
  * Pure core: every side effect is an injected adapter so tests never touch GitHub or the inbox.
  */
@@ -208,6 +210,12 @@ export async function runRunTtlSweep(input: {
   stalePrs.sort((a, b) => b.ageMs - a.ageMs || a.pr.number - b.pr.number);
   let actions = 0;
   let selectedRegate = false;
+  // One budget for the whole sweep: a memo, a marker and a re-gate request each spend one unit.
+  const spend = (): boolean => {
+    if (actions >= cap) return false;
+    actions += 1;
+    return true;
+  };
   for (const { pr, target, ageMs } of stalePrs) {
     const ageHours = ageMs / 3_600_000;
     const key = `${pr.number}:${pr.headSha}`;
@@ -220,10 +228,10 @@ export async function runRunTtlSweep(input: {
         continue;
       }
       if (already) { alreadyMemoed.push(pr.number); continue; }
-    }
-    if (!target.alive && pr.labels.includes(RUN_TTL_MARKER_LABEL)) { alreadyMarked.push(pr.number); continue; }
-    if (actions >= cap) { skippedOverCap.push(pr.number); continue; }
-    actions += 1;
+    } else if (pr.labels.includes(RUN_TTL_MARKER_LABEL)) { alreadyMarked.push(pr.number); continue; }
+    // The move this PR makes — memo, re-gate, or marker — takes the budget slot up front, so a sweep
+    // never emits more than `cap` side effects no matter how many of them a single PR would attract.
+    if (!spend()) { skippedOverCap.push(pr.number); continue; }
     if (target.alive) {
       if (mode === 'shadow') {
         memo.push(pr.number);
@@ -248,15 +256,31 @@ export async function runRunTtlSweep(input: {
       }
     }
     const reason = target.alive ? 'memo-failed' : target.reason;
-    const canRegate = Boolean(input.requestRegate) && !target.alive && !selectedRegate;
-    if (mode === 'shadow') {
-      label.push(pr.number);
-      emit('would-label', { pr: pr.number, label: RUN_TTL_MARKER_LABEL, reason, ageHours: Math.floor(ageHours) });
-      if (canRegate) {
-        selectedRegate = true;
+    // A re-gate request is the stronger move and spends the same budget as the marker, so it goes
+    // first: at `cap` 1 a sweep either re-gates (no marker) or — with no adapter — only marks.
+    if (Boolean(input.requestRegate) && !target.alive && !selectedRegate) {
+      selectedRegate = true;
+      if (mode === 'shadow') {
         regate.push(pr.number);
         emit('would-regate', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
+      } else {
+        try {
+          await input.requestRegate!(pr);
+          regate.push(pr.number);
+          emit('regate-requested', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
+        } catch (error) {
+          emit('regate-failed', { pr: pr.number, error: String(error) });
+        }
+      }
+      // The marker that used to ride along must buy its own slot — at `cap` 1 there is none left.
+      if (!spend()) {
+        emit('label-deferred-cap', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
+        continue;
       }
+    }
+    if (mode === 'shadow') {
+      label.push(pr.number);
+      emit('would-label', { pr: pr.number, label: RUN_TTL_MARKER_LABEL, reason, ageHours: Math.floor(ageHours) });
       continue;
     }
     try {
@@ -267,16 +291,6 @@ export async function runRunTtlSweep(input: {
       failed.push(pr.number);
       emit('label-failed', { pr: pr.number, error: String(error) });
     }
-    if (canRegate) {
-      selectedRegate = true;
-      try {
-        await input.requestRegate!(pr);
-        regate.push(pr.number);
-        emit('regate-requested', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
-      } catch (error) {
-        emit('regate-failed', { pr: pr.number, error: String(error) });
-      }
-    }
   }
   return summary(result());
 }

package/src/self-implement/scope-adjacency.ts

@@ -30,7 +30,9 @@ export function classifyOutOfScope(outsideFiles: readonly string[], declaredPath
 export type ScopeExpansionKind = 'neighbour' | 'caller-or-registration' | 'paired-test' | 'other';
 export interface ScopeExpansionFile { path: string; kind: ScopeExpansionKind }
 export interface ScopeExpansion { files: ScopeExpansionFile[]; count: number }
-export type ScopeStopReason = 'deletion' | 'protected-path' | 'over-cap' | 'name-cap';
+/** Every stop reason, in report order — the one source; the Pod parent (self-implement.ts) reads held results against it. */
+export const SCOPE_STOP_REASONS = ['deletion', 'protected-path', 'over-cap', 'name-cap'] as const;
+export type ScopeStopReason = (typeof SCOPE_STOP_REASONS)[number];
 
 /** Accepted outside files above this count stop the run: past it the change is no longer «the goal, adapted». */
 export const SCOPE_EXPANSION_CAP = 10;

package/src/self-implement/seams.ts

@@ -91,7 +91,7 @@ import { emitDecision } from '../live/detail-switch.js';
 import { gateDecision, reviewDecision, mergeDecision } from './decision-events.js';
 import { LogStore } from '../mss/logging/log-store.js';
 import { instanceNameForStateDir } from '../instance-identity.js';
-import { queryStructuredChildProviderErrors } from './orchestrator.js';
+import { queryStructuredChildProviderErrors, readHarvestPrBody, updateHarvestPrBody } from './orchestrator.js';
 import { buildImplementReport } from './off-diff-evidence.js';
 import { countReflectFactConflicts, type MustFixRefutation, type ReflectEvidenceFacts, type ReflectGateFacts } from './reflect-mustfix.js';
 import { isSupervisorDecisionSection, splitGoalSections, supervisorGoalDigest } from './goal-digest.js';
@@ -202,6 +202,11 @@ export function observeGateBaselineLocation(cwd: string): { branch: string | nul
 /** self-implement 자식만의 종료 보고 보존 규칙. 범용 control brain 기본 프롬프트에는 넣지 않는다. */
 export const SELF_IMPLEMENT_COMPLETION_REPORT_HINT = '자식이 최종 요약 또는 GOAL-COMPLETE 완료 마커를 출력 중이면 목표가 달성돼 보여도 done이 아니라 wait을 선택하라. 완료 보고가 끝날 때까지 기다려야 한다.';
 
+/** Set by the Kubernetes Job manifest only for the Pod child process. */
+export function podChildDependenciesRequired(env: NodeJS.ProcessEnv): boolean {
+  return Boolean(env.ELANOUS_POD_NAME?.trim());
+}
+
 /** self-implement 실행 경계가 범용 brain에 전용 종료-보고 규칙을 주입한다. */
 export function createSelfImplementControlBrain(opts: Omit<LlmControlBrainOpts, 'systemHint'>) {
   // ⭐ 이 부모에 쓸 provider 가 «하나도» 없으면(NoLlmProviderAvailableError) BRAIN-FAST 이전처럼 «지연 해석»
@@ -1739,6 +1744,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         worktreeRoot: configuredWorktreeRoot(),
         resetExisting: true,
         reuseOwnedWorktree: true,
+        requireDependencies: podChildDependenciesRequired(process.env),
         ...(base ? { base } : {}),
         ...(runId ? { currentOwner: `dev:${runId}` } : {}),
       });
@@ -1906,6 +1912,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
             ...(onProgress ? { onProgress } : {}), // part2-B — execute judge 로 라이브 델타 전달(PTY 경로만).
             ...(onSurfaceProgress ? { onSurfaceProgress } : {}), // Sparse parent-surface lines; raw execute-judge delta remains onProgress only.
             ...(onSupervisorInput ? { onSupervisorInput } : {}),
+            ...(process.env.ELANOUS_POD_VERIFIED_PR_SOURCE === '1' ? { verifiedPrSource: true } : {}),
             ...(onLifecycleScreenClassification ? { onLifecycleScreenClassification } : {}),
             ...(roundContext ? { roundContext } : {}),
           });
@@ -2309,7 +2316,8 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       //   `tc`(변경파일 tsc) **전에** 실행해서, tsc 가 깨져 **최종 게이트가 실패한 런에도**
       //   base 를 다시 돌리고 `gate.log` 를 바꿨다 ⇒ *"게이트 실패 경로 무변경"* 경계 위반.
       //   ⇒ 조건을 최종 판정과 같은 식으로 묶는다.
-      const gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && expose.passed && (dependencyGate?.passed ?? true);
+      let gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && expose.passed && (dependencyGate?.passed ?? true);
+      let changedTestEvidenceNote = '';
       const verifyIdentity = gateVerifyIdentity(ctx?.runId);
       if (gatePassed && scope.skipTestStep) {
         verifyByBreaking = { ran: false, distinguishes: 0, 'does-not-distinguish': 0, unknown: 0, skippedReason: scope.reason };
@@ -2352,6 +2360,34 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         //     그것을 검사하는 테스트는 아무것도 증명하지 못한다(리뷰 2R 이 그 Goodhart 를 잡았다).
         const editedTests = scope.testArgs!.filter((file) => !scope.pulledInRelatedTests.includes(file));
         const verify = (o.runVerifyByBreaking ?? runVerifyByBreaking)(cwd, editedTests, baselineRefs.get(cwd));
+        // A passing head bundle covers all edited tests. An existing test needs a
+        // measured failing base run. A new test absent from the fixed base is a
+        // structural RED witness even when copying it to base cannot load its new
+        // module/export; that loader failure is not an executable base assertion.
+        // Mobile base measurement is separate and is not a RED witness here.
+        const measured = new Map(verify.files.map((entry) => [entry.file, entry]));
+        const eligible = editedTests.filter((file) => /\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(file));
+        const red = eligible.filter((file) => {
+          const entry = measured.get(file);
+          return entry?.classification === 'missing-at-base'
+            || (entry?.classification === 'distinguishes' && entry.base.status === 'test-fail');
+        });
+        const structuralRed = red.filter((file) => measured.get(file)?.classification === 'missing-at-base');
+        const executedBaseFailures = red.length - structuralRed.length;
+        const complete = eligible.length === 0 || red.length > 0;
+        changedTestEvidenceNote = `\n\n[changed-test-evidence] head=pass; base-fail=${executedBaseFailures}/${eligible.length}; red-witness=${red.length}/${eligible.length}; verdict=${eligible.length === 0 ? 'not-applicable' : complete ? 'proved' : 'unproved'}`
+          + `; red-missing-at-base=${structuralRed.length}`
+          + (structuralRed.length > 0
+            ? '; structural-red=the new test file is absent from the fixed base, so a runnable base assertion is not required'
+            : '')
+          + (!complete ? `; no-red-witness=${eligible.join(', ')}` : '')
+          + (editedTests.length !== eligible.length ? `; mobile-or-other-excluded=${editedTests.length - eligible.length}` : '');
+        debug.log('self-implement', 'gate.changed-test-evidence', {
+          head: 'pass', baseFailed: executedBaseFailures, redWitnesses: red.length, edited: editedTests.length,
+          eligible: eligible.length, verdict: eligible.length === 0 ? 'not-applicable' : complete ? 'proved' : 'unproved', red,
+          redMissingAtBase: structuralRed,
+        }, { level: complete ? 'info' : 'warn' });
+        if (!complete) gatePassed = false;
         // ⛔⭐⭐⭐ **조건은 테스트 전용 변경이나 특정 정방향 분류가 아니라, 편집 테스트의 네 정방향 분류 전체다.**
         //   (리뷰 R3 must-fix — 내가 PR 경계에 *"혼합 변경에서는 조건상 안 돈다"* 고 «틀리게» 적었다).
         //   ⇒ 소스와 테스트가 «함께» 바뀐 PR 에서도 그 분류가 나오면 «돈다». 그리고 그게 맞다:
@@ -2423,6 +2459,14 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           skipped: true, reason: why, testStep: why, ...verifyIdentity, ...emptyVerifyCounts,
         }, { level: 'warn' });
       }
+      if (gatePassed && scope.reason === 'changed-tests' && !changedTestEvidenceNote
+        && scope.testArgs?.some((file) => /\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(file))) {
+        gatePassed = false;
+        changedTestEvidenceNote = '\n\n[changed-test-evidence] verdict=unproved; head/base pair was not measured';
+        debug.log('self-implement', 'gate.changed-test-evidence', {
+          verdict: 'unproved', reason: 'head/base pair was not measured',
+        }, { level: 'warn' });
+      }
       // ⭐ 거짓통과 방지 표기(제1원칙 관측 · 2026-07-26) — test 스텝을 건너뛰면 `passed:true` 가
       //   **"검증됨"으로 오독**될 수 있다. 그건 integrity-gate 의 `ranNothing` 가드가 막으려던
       //   거짓통과를 스코프 축소가 우회로 되살리는 것이다 ⇒ 게이트 로그에 **명시**한다.
@@ -2485,7 +2529,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         : '';
       return {
         passed: gatePassed,
-        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}${expose.log ? `\n\n${expose.log}` : ''}`,
+        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${changedTestEvidenceNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}${expose.log ? `\n\n${expose.log}` : ''}`,
         testStepExecuted: !testStepSkipped && testStep !== undefined && !testStep.skipped,
         scopeReason,
         comparisonBaseStatus: observationChanges.comparisonBaseStatus,
@@ -2705,6 +2749,8 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, env: ghAutomationEnv(process.env),
       });
     },
+    readPrBodyForHarvest: readHarvestPrBody,
+    updatePrBodyForHarvest: updateHarvestPrBody,
     readPrFiles: async ({ number, cwd, base }) => readPrFilesWithRateLimitFallback({
       number, cwd, env: ghAutomationEnv(process.env), ...(base ? { base } : {}),
     }),
@@ -2988,6 +3034,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           `첫 줄은 정확히 하나: BUDGET: EXTEND | BUDGET: SUFFICIENT | BUDGET: UNCONVERGEABLE | BUDGET: CONTRACT-CONFLICT`,
           `둘째 줄: REASON: <한 문장>. 이후에만 진단을 쓴다.`,
           `EXTEND는 새 지적이 좁아져 한 라운드 더로 풀릴 때만, SUFFICIENT는 리뷰만 실패했고 gate는 통과했으며 남은 지적이 비블로커·스코프 밖일 때만, UNCONVERGEABLE은 같은 지적 반복·스코프 밖 요구·근거 없는 반복 리뷰일 때다.`,
+          `단 구조적으로 불가능한 증거 요구(예: base 에 없는 신규 파일·모듈의 시험에 base 실패 목격을 요구 · [changed-test-evidence] verdict=unproved 가 missing-at-base 때문인 것)는 반복돼도 UNCONVERGEABLE 이 아니라 CONTRACT-CONFLICT 다(REASON 에 그 요구가 불가능한 이유). 조각 미션에서 다음 조각 몫(호출부·배선·후속 조각이 맡은 일)을 이번 조각에 요구하는 지적만 남았고 gate 가 통과했으면 SUFFICIENT 다.`,
           `CONTRACT-CONFLICT는 현장과 골의 수용·보존 계약 또는 리뷰 지적이 정면으로 충돌하여, 검증된 수용 기준 완화 뒤 다음 라운드가 수정된 골 기준으로 계속해야 할 때 쓴다. 타당한 자식 REFUTE는 이 판단의 근거가 될 수 있지만 제출이 없어도 구현과 계약만으로 동시에 만족시킬 수 없는 충돌이면 이 값을 선택한다. 이 경우 REASON에는 반드시 어떤 계획 줄이 현장과 어긋나는지 쓴다. 골의 ## ACCEPTANCE CRITERIA 안에서 정확히 한 수용 기준 행을 식별할 수 있으면 이어서 반드시 TARGET: <## ACCEPTANCE CRITERIA 안의 전체 원문 한 줄>, EXPECTED: <그 TARGET 행의 현재 한 줄>, REPLACEMENT: <그 TARGET 행에서 완화한 한 줄>을 각각 개행 없는 한 줄로 출력한다. TARGET은 첫 콜론 앞 접두·식별값이나 설명문이 아니라 수용 기준 행 전체와 정확히 일치해야 하며, EXPECTED와 REPLACEMENT도 같은 TARGET 행에서 유래한 단일 수용 기준 행이어야 한다. 셋 중 하나라도 확정할 수 없거나 대상·원문이 다중 일치하면 세 줄을 쓰지 말고 REASON에 적용 불가 사유만 기록한다.`,
           `REFUTE 제출이 있으면 각 항목을 실제로 판정한 경우에만 이후 줄에 정확히 \`REFUTE [findingId]: ACCEPT\` 또는 \`REFUTE [findingId]: REJECT\`로 남겨라. BUDGET verdict는 개별 REFUTE 판정이 아니며, REFUTE 줄이 없으면 개별 수락·기각은 기록되지 않는다.`,
           `너는 자율 구현 rework 진단가다. 현재 라운드 ${round}/${effectiveMax}, 종류는 ${kind}이다.`,
@@ -3004,7 +3051,16 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           `이후 진단은 다음 구현 에이전트가 근본부터 고치도록 각 항목에 1)왜 실패했나 2)어떻게 고칠까를 간결히 5개 이내로 쓴다.`,
         ].join('\n');
         try {
-          const out = await o.llmReview!(prompt);
+          const raw = await o.llmReview!(prompt);
+          const reclass = (await import('./rework-policy.js')).reclassifyImpossibleEvidence(raw, note);
+          const out = reclass.response;
+          if (reclass.applied) {
+            try {
+              debug.log('self-implement', 'supervisor-impossible-evidence', {
+                runId, kind, round, from: 'UNCONVERGEABLE', to: 'CONTRACT-CONFLICT', markers: reclass.markers,
+              });
+            } catch { /* 관측은 fail-soft */ }
+          }
           try {
             debug.log('self-implement', 'diagnose.done', {
               runId,

package/src/self-implement/wiring-check.ts

@@ -0,0 +1,358 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import ts from 'typescript';
+import { importCandidates } from './pwa-import-graph.js';
+
+export interface UnwiredExport {
+  file: string;
+  name: string;
+  reason: 'no-production-importer';
+}
+
+export interface WiringCheckResult {
+  checked: number;
+  unwired: UnwiredExport[];
+  failure?: string;
+}
+
+export interface WiringCheckInput {
+  cwd: string;
+  changedFiles: readonly string[];
+  /**
+   * Undefined means the file did not exist at the run's resolved base.
+   * A read that could not be completed (timeout, git error) must throw so the
+   * check records a failure instead of treating every old export as new.
+   */
+  readBaseFile: (file: string) => string | undefined;
+  readFile?: (absolutePath: string) => string;
+  listFiles?: (cwd: string) => string[];
+}
+
+export interface BaseGitResult {
+  status: number | null;
+  signal?: string | null;
+  errorCode?: string;
+  stdout: string;
+  stderr: string;
+}
+export type BaseGitRun = (args: string[]) => BaseGitResult;
+
+function gitFailed(result: BaseGitResult): boolean {
+  return result.status !== 0 || !!result.signal || !!result.errorCode;
+}
+
+function describeGit(result: BaseGitResult): string {
+  return [
+    `status=${result.status}`,
+    result.signal ? `signal=${result.signal}` : '',
+    result.errorCode ? `error=${result.errorCode}` : '',
+    result.stderr.trim().split(/\r?\n/)[0] ?? '',
+  ].filter(Boolean).join(' ');
+}
+
+/**
+ * Reads a file at `base`. Absence is decided by a successful tree listing that
+ * names nothing; any timeout or git error throws (`base-read-failed`).
+ */
+export function gitBaseFileReader(run: BaseGitRun, base: string): (file: string) => string | undefined {
+  return (file) => {
+    const listed = run(['ls-tree', '-z', '--name-only', base, '--', file]);
+    if (gitFailed(listed)) throw new Error(`base-read-failed: ${file}: ls-tree ${describeGit(listed)}`);
+    if (!listed.stdout.split('\0').some((entry) => entry === file)) return undefined;
+    const shown = run(['show', `${base}:${file}`]);
+    if (gitFailed(shown)) throw new Error(`base-read-failed: ${file}: show ${describeGit(shown)}`);
+    return shown.stdout;
+  };
+}
+
+// Only the repository's executable wrapper and root CLI module are known
+// dynamic/public entry surfaces. Ordinary domain index modules are analyzable.
+const ENTRYPOINT = /^(?:bin\/|src\/index\.tsx?$)/;
+const SOURCE = /^(?:src\/|scripts\/|apps\/pwa\/src\/).+\.tsx?$/;
+const TEST = /(?:^|\/)(?:test\/|__tests__\/)|(?:\.test|\.spec|\.d)\.tsx?$/;
+
+function productionFiles(cwd: string): string[] {
+  const files: string[] = [];
+  const walk = (dir: string): void => {
+    let entries;
+    try { entries = readdirSync(join(cwd, dir), { withFileTypes: true }); }
+    catch (cause) {
+      if ((cause as NodeJS.ErrnoException).code === 'ENOENT') return;
+      throw cause;
+    }
+    for (const entry of entries) {
+      const file = `${dir}/${entry.name}`;
+      if (entry.isDirectory() && !entry.name.startsWith('.') && entry.name !== 'node_modules') walk(file);
+      else if (entry.isFile() && SOURCE.test(file) && !TEST.test(file)) files.push(file);
+    }
+  };
+  for (const root of ['src', 'scripts', 'apps/pwa/src']) walk(root);
+  return files;
+}
+
+function sourceFile(file: string, content: string): ts.SourceFile {
+  const absolute = resolve(file);
+  return ts.createSourceFile(absolute, content, ts.ScriptTarget.Latest, true, absolute.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+}
+
+function hasModifier(node: ts.Node, kind: ts.SyntaxKind): boolean {
+  const modifiers = ts.canHaveModifiers(node) ? ts.getModifiers(node) : undefined;
+  return !!modifiers?.some((modifier) => modifier.kind === kind);
+}
+
+/** True when the statement produces a value at runtime (not ambient, not erased). */
+function isRuntimeDeclaration(statement: ts.Statement): boolean {
+  if (hasModifier(statement, ts.SyntaxKind.DeclareKeyword)) return false;
+  if (ts.isFunctionDeclaration(statement)) return !!statement.body;
+  if (ts.isEnumDeclaration(statement)) return !hasModifier(statement, ts.SyntaxKind.ConstKeyword);
+  return ts.isClassDeclaration(statement) || ts.isVariableStatement(statement);
+}
+
+/** Public export name → local binding name (null when the default export has no local name). */
+function exportedValues(source: ts.SourceFile): Map<string, string | null> {
+  const names = new Map<string, string | null>();
+  for (const statement of source.statements) {
+    const exported = hasModifier(statement, ts.SyntaxKind.ExportKeyword);
+    const isDefault = hasModifier(statement, ts.SyntaxKind.DefaultKeyword);
+    if (exported && isRuntimeDeclaration(statement)) {
+      if (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isEnumDeclaration(statement)) {
+        if (isDefault) names.set('default', statement.name?.text ?? null);
+        else if (statement.name) names.set(statement.name.text, statement.name.text);
+      }
+      if (ts.isVariableStatement(statement)) {
+        for (const declaration of statement.declarationList.declarations) {
+          if (ts.isIdentifier(declaration.name)) names.set(declaration.name.text, declaration.name.text);
+        }
+      }
+    }
+    if (ts.isExportAssignment(statement) && !statement.isExportEquals) {
+      if (!ts.isIdentifier(statement.expression)) names.set('default', null);
+      else if (bindingIdentifier(source, statement.expression.text)) names.set('default', statement.expression.text);
+    }
+    if (ts.isExportDeclaration(statement) && !statement.isTypeOnly && !statement.moduleSpecifier
+      && statement.exportClause && ts.isNamedExports(statement.exportClause)) {
+      for (const element of statement.exportClause.elements) {
+        const localName = (element.propertyName ?? element.name).text;
+        // Re-exporting a type alias, interface or ambient binding creates no runtime value.
+        if (!element.isTypeOnly && bindingIdentifier(source, localName)) names.set(element.name.text, localName);
+      }
+    }
+  }
+  return names;
+}
+
+const checkerCache = new WeakMap<ts.SourceFile, ts.TypeChecker>();
+
+function checkerFor(source: ts.SourceFile): ts.TypeChecker {
+  const cached = checkerCache.get(source);
+  if (cached) return cached;
+  const options: ts.CompilerOptions = { noResolve: true, noLib: true, target: ts.ScriptTarget.Latest };
+  const host = ts.createCompilerHost(options);
+  const getSourceFile = host.getSourceFile.bind(host);
+  host.getSourceFile = (fileName, languageVersion, onError, shouldCreateNewSourceFile) =>
+    resolve(fileName) === source.fileName
+      ? source
+      : getSourceFile(fileName, languageVersion, onError, shouldCreateNewSourceFile);
+  const program = ts.createProgram([source.fileName], options, host);
+  const checker = program.getTypeChecker();
+  checkerCache.set(source, checker);
+  return checker;
+}
+
+/** The runtime binding for `name` in this file, or undefined (types and ambient declarations have none). */
+function bindingIdentifier(source: ts.SourceFile, name: string): ts.Identifier | undefined {
+  const fromBindingName = (node: ts.BindingName): ts.Identifier | undefined => {
+    if (ts.isIdentifier(node)) return node.text === name ? node : undefined;
+    for (const element of node.elements) {
+      if (ts.isOmittedExpression(element)) continue;
+      const found = fromBindingName(element.name);
+      if (found) return found;
+    }
+    return undefined;
+  };
+  for (const statement of source.statements) {
+    if ((ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement)
+      || ts.isEnumDeclaration(statement)) && statement.name?.text === name) {
+      if (isRuntimeDeclaration(statement)) return statement.name;
+      continue;
+    }
+    if (ts.isVariableStatement(statement) && isRuntimeDeclaration(statement)) {
+      for (const declaration of statement.declarationList.declarations) {
+        const found = fromBindingName(declaration.name);
+        if (found) return found;
+      }
+    }
+    if (ts.isImportDeclaration(statement) && statement.importClause && !statement.importClause.isTypeOnly) {
+      const clause = statement.importClause;
+      if (clause.name?.text === name) return clause.name;
+      if (clause.namedBindings && ts.isNamespaceImport(clause.namedBindings)
+        && clause.namedBindings.name.text === name) return clause.namedBindings.name;
+      if (clause.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+        const found = clause.namedBindings.elements.find((element) => !element.isTypeOnly && element.name.text === name)?.name;
+        if (found) return found;
+      }
+    }
+  }
+  return undefined;
+}
+
+function isClassExtends(node: ts.Node): boolean {
+  const parent = node.parent;
+  if (!parent || !ts.isExpressionWithTypeArguments(parent) || parent.expression !== node) return false;
+  const clause = parent.parent;
+  return ts.isHeritageClause(clause) && clause.token === ts.SyntaxKind.ExtendsKeyword
+    && (ts.isClassDeclaration(clause.parent) || ts.isClassExpression(clause.parent));
+}
+
+function inTypePosition(node: ts.Node): boolean {
+  if (isClassExtends(node)) return false;
+  for (let parent = node.parent; parent; parent = parent.parent) {
+    if (ts.isTypeNode(parent)) return true;
+  }
+  return false;
+}
+
+/**
+ * A reference wires an export only when the value is consumed: invoked, passed,
+ * registered, rendered, read from, returned or extended. A bare reference
+ * (`void fresh`, `fresh;`, `const alias = fresh`) does not.
+ */
+function isConsumingReference(node: ts.Expression): boolean {
+  let expression: ts.Node = node;
+  while (expression.parent && (ts.isParenthesizedExpression(expression.parent) || ts.isNonNullExpression(expression.parent)
+    || ts.isAsExpression(expression.parent) || ts.isSatisfiesExpression(expression.parent)
+    || ts.isTypeAssertionExpression(expression.parent))) expression = expression.parent;
+  const parent = expression.parent;
+  if (!parent) return false;
+  if (isClassExtends(expression)) return true;
+  if (ts.isCallExpression(parent) || ts.isNewExpression(parent)) {
+    return parent.expression === expression || !!parent.arguments?.some((argument) => argument === expression);
+  }
+  if (ts.isTaggedTemplateExpression(parent)) return parent.tag === expression;
+  if (ts.isJsxOpeningElement(parent) || ts.isJsxSelfClosingElement(parent)) return parent.tagName === expression;
+  if (ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) return parent.expression === expression;
+  if (ts.isSpreadElement(parent) || ts.isArrayLiteralExpression(parent) || ts.isShorthandPropertyAssignment(parent)
+    || ts.isJsxExpression(parent) || ts.isDecorator(parent) || ts.isReturnStatement(parent)) return true;
+  if (ts.isPropertyAssignment(parent)) return parent.initializer === expression;
+  if (ts.isArrowFunction(parent)) return parent.body === expression;
+  return false;
+}
+
+function hasBindingUse(source: ts.SourceFile, binding: ts.Identifier): boolean {
+  const checker = checkerFor(source);
+  const symbol = checker.getSymbolAtLocation(binding);
+  if (!symbol) return false;
+  let used = false;
+  const visit = (node: ts.Node): void => {
+    if (used) return;
+    if (ts.isIdentifier(node) && node !== binding) {
+      const parent = node.parent;
+      // Declarations, export lists and property keys do not consume a value.
+      if (!(('name' in parent) && parent.name === node && !ts.isShorthandPropertyAssignment(parent))
+        && !ts.isImportSpecifier(parent)
+        && !ts.isImportClause(parent)
+        && !ts.isNamespaceImport(parent)
+        && !ts.isExportSpecifier(parent)
+        && !(ts.isPropertyAccessExpression(parent) && parent.name === node)
+        && !(ts.isPropertyAssignment(parent) && parent.name === node)
+        && !inTypePosition(node)
+        && checker.getSymbolAtLocation(node) === symbol
+        && isConsumingReference(node)) used = true;
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return used;
+}
+
+function resolvesTo(importer: string, specifier: string, target: string, available: ReadonlySet<string>, cwd: string): boolean {
+  if (!specifier.startsWith('.')) return false;
+  const base = relative(cwd, resolve(cwd, dirname(importer), specifier)).split(sep).join('/');
+  return importCandidates(base).find((candidate) => available.has(candidate)) === target;
+}
+
+function consumesExport(source: ts.SourceFile, importer: string, target: string, name: string, available: ReadonlySet<string>, cwd: string): boolean {
+  for (const statement of source.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)
+      || !resolvesTo(importer, statement.moduleSpecifier.text, target, available, cwd)) continue;
+    const clause = statement.importClause;
+    if (!clause || clause.isTypeOnly) continue;
+    if (name === 'default' && clause.name && hasBindingUse(source, clause.name)) return true;
+    const bindings = clause.namedBindings;
+    if (bindings && ts.isNamedImports(bindings)) {
+      for (const element of bindings.elements) {
+        if (element.isTypeOnly || (element.propertyName ?? element.name).text !== name) continue;
+        if (hasBindingUse(source, element.name)) return true;
+      }
+    }
+    if (bindings && ts.isNamespaceImport(bindings)) {
+      const checker = checkerFor(source);
+      const namespaceSymbol = checker.getSymbolAtLocation(bindings.name);
+      let used = false;
+      const visit = (node: ts.Node): void => {
+        if (used) return;
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)
+          && node.name.text === name && !inTypePosition(node)
+          && checker.getSymbolAtLocation(node.expression) === namespaceSymbol
+          && isConsumingReference(node)) used = true;
+        ts.forEachChild(node, visit);
+      };
+      visit(source);
+      if (used) return true;
+    }
+  }
+  return false;
+}
+
+/** Advisory only: absence is a warning, because dynamic registration can escape static import analysis. */
+export function findUnwiredExports(input: WiringCheckInput): WiringCheckResult {
+  const cwd = resolve(input.cwd);
+  const readFile = input.readFile ?? ((file: string) => readFileSync(file, 'utf8'));
+  const candidates: { file: string; name: string; localName: string | null }[] = [];
+  const parsedChanged = new Map<string, ts.SourceFile>();
+  try {
+    for (const file of [...new Set(input.changedFiles)]) {
+      if (!SOURCE.test(file) || TEST.test(file) || ENTRYPOINT.test(file)) continue;
+      let content: string;
+      try { content = readFile(join(cwd, file)); }
+      catch (cause) {
+        // A file deleted by the run has no current exports to wire; any other read error stays a failure.
+        if ((cause as NodeJS.ErrnoException).code === 'ENOENT') continue;
+        throw cause;
+      }
+      const current = sourceFile(join(cwd, file), content);
+      const base = input.readBaseFile(file);
+      const old = base === undefined ? new Map<string, string | null>() : exportedValues(sourceFile(join(cwd, file), base));
+      parsedChanged.set(file, current);
+      for (const [name, localName] of exportedValues(current)) {
+        if (!old.has(name)) candidates.push({ file, name, localName });
+      }
+    }
+    if (candidates.length === 0) return { checked: 0, unwired: [] };
+    const files = [...new Set((input.listFiles ?? productionFiles)(cwd))];
+    const available = new Set(files);
+    const unresolved = candidates.filter(({ file, localName }) => {
+      if (localName === null) return true;
+      const source = parsedChanged.get(file)!;
+      const binding = bindingIdentifier(source, localName);
+      return !binding || !hasBindingUse(source, binding);
+    });
+    const imported = new Set<string>();
+    for (const importer of files) {
+      if (TEST.test(importer) || unresolved.every(({ file }) => file === importer)) continue;
+      const content = readFile(join(cwd, importer));
+      if (!content.includes('import')) continue;
+      const source = sourceFile(join(cwd, importer), content);
+      for (const { file, name } of unresolved) {
+        if (file !== importer && consumesExport(source, importer, file, name, available, cwd)) imported.add(`${file}\0${name}`);
+      }
+    }
+    return {
+      checked: candidates.length,
+      unwired: unresolved.filter(({ file, name }) => !imported.has(`${file}\0${name}`))
+        .map(({ file, name }) => ({ file, name, reason: 'no-production-importer' as const })),
+    };
+  } catch (cause) {
+    return { checked: candidates.length, unwired: [], failure: cause instanceof Error ? cause.message : String(cause) };
+  }
+}

package/src/shell-env-bootstrap.ts

@@ -50,7 +50,7 @@
 
 /// <reference path="./vendor-types.d.ts" />
 
-import { spawnSync } from 'node:child_process';
+import { spawnSync, type SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
 import { basename } from 'node:path';
 import { debug } from './debug/log.js';
 
@@ -136,7 +136,8 @@ export function runPrintenvCapture(): Record<string, string> | null {
   const shellStart = performance.now();
   let res: ReturnType<typeof spawnSync>;
   try {
-    res = spawnSync(shell, ['-l', '-i', '-c', 'printenv'], {
+    // `detached` is honoured by spawnSync (uv_spawn → setsid) but missing from SpawnSyncOptions.
+    const opts: SpawnSyncOptionsWithStringEncoding & { detached: boolean } = {
       env: seedEnv,
       encoding: 'utf8',
       timeout: TIMEOUT_MS,
@@ -144,7 +145,13 @@ export function runPrintenvCapture(): Record<string, string> | null {
       stdio: ['ignore', 'pipe', 'pipe'],
       // Don't inherit our stdio — rc files that run `clear` or issue
       // OSC sequences would corrupt our TUI output otherwise.
-    });
+      // TUI-SIGTTIN-SUSPEND (10-23 n8n): an interactive shell opens /dev/tty even with stdin ignored and
+      // takes the terminal's foreground group for its own job control; it never hands it back (exec'd
+      // printenv · SIGKILL on timeout), so the TUI's next stdin read stops it with SIGTTIN. `detached`
+      // = setsid: no controlling tty, so the capture cannot touch the TUI's terminal at all.
+      detached: true,
+    };
+    res = spawnSync(shell, ['-l', '-i', '-c', 'printenv'], opts);
   } catch {
     logBootPhase('login-env.shell', shellStart, 'error');
     return null;
@@ -169,7 +176,7 @@ export async function warmCapturedEnv(spawn: typeof Bun.spawn = Bun.spawn): Prom
   const start = Date.now();
   const shellStart = performance.now();
   try {
-    const proc = spawn([seed.shell, '-l', '-i', '-c', 'printenv'], { env: seed.seedEnv as Record<string, string>, stdin: 'ignore', stdout: 'pipe', stderr: 'ignore' });
+    const proc = spawn([seed.shell, '-l', '-i', '-c', 'printenv'], { env: seed.seedEnv as Record<string, string>, stdin: 'ignore', stdout: 'pipe', stderr: 'ignore', detached: true });
     // A grandchild (e.g. a pyenv rehash) can keep the stdout pipe open after the shell is killed,
     // so the timeout settles the race itself instead of waiting for EOF.
     let timer: ReturnType<typeof setTimeout> | undefined;