elanous 0.2.37 → 0.2.38

package/scripts/public-export.ts

@@ -101,14 +101,74 @@ function redactionPattern(from: string): RegExp {
   const post = /[A-Za-z0-9]$/.test(from) ? '(?![A-Za-z0-9])' : '';
   return new RegExp(`${pre}${escapeRegExp(from)}${post}`, 'gu');
 }
+const CODE_FILE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu;
+type RedactionProblem = { marker: 'private-redaction-identifier' | 'private-redaction-syntax' | 'private-source-syntax'; file: string; line: number; text: string };
+class PrivateRedactionError extends Error {
+  constructor(message: string, readonly hits: readonly RedactionProblem[]) { super(message); }
+}
+
+function codeIdentifierRanges(file: string, text: string): Array<{ start: number; end: number; name: string }> {
+  if (!CODE_FILE.test(file)) return [];
+  const scanner = ts.createScanner(ts.ScriptTarget.Latest, false,
+    /\.(?:tsx|jsx)$/iu.test(file) ? ts.LanguageVariant.JSX : ts.LanguageVariant.Standard, text);
+  const ranges: Array<{ start: number; end: number; name: string }> = [];
+  for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
+    if (token === ts.SyntaxKind.Identifier || token === ts.SyntaxKind.PrivateIdentifier
+      || token >= ts.SyntaxKind.FirstKeyword && token <= ts.SyntaxKind.LastKeyword) {
+      ranges.push({ start: scanner.getTokenPos(), end: scanner.getTextPos(), name: scanner.getTokenText() });
+    }
+  }
+  return ranges;
+}
+
+function assertRedactionsAvoidIdentifiers(file: string, text: string, redactions: readonly PrivateRedaction[]): void {
+  if (!CODE_FILE.test(file) || !redactions.some((redaction) => text.includes(redaction.from))) return;
+  const identifiers = codeIdentifierRanges(file, text);
+  if (!identifiers.length) return;
+  const hits: RedactionProblem[] = [];
+  for (const redaction of redactions) {
+    for (const match of text.matchAll(redactionPattern(redaction.from))) {
+      const start = match.index;
+      const token = identifiers.find((entry) => start < entry.end && start + match[0].length > entry.start);
+      if (!token) continue;
+      const line = text.slice(0, token.start).split('\n').length;
+      hits.push({ marker: 'private-redaction-identifier', file, line, text: token.name });
+    }
+  }
+  const unique = [...new Map(hits.map((hit) => [`${hit.file}:${hit.line}:${hit.text}`, hit])).values()];
+  if (unique.length) throw new PrivateRedactionError(`private redaction would change code identifiers: ${unique.slice(0, 12).map((hit) => `${hit.file}:${hit.line} ${hit.text}`).join(', ')}${unique.length > 12 ? ` (+${unique.length - 12} more)` : ''}`, unique);
+}
+
+function firstCodeParseError(file: string, text: string): { line: number; message: string } | null {
+  if (!CODE_FILE.test(file)) return null;
+  const kind = /\.(?:tsx|jsx)$/iu.test(file) ? ts.ScriptKind.TSX
+    : /\.(?:js|mjs|cjs)$/iu.test(file) ? ts.ScriptKind.JS : ts.ScriptKind.TS;
+  const parsed = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false, kind) as ts.SourceFile & { parseDiagnostics: readonly ts.Diagnostic[] };
+  const first = parsed.parseDiagnostics[0];
+  return first ? { line: parsed.getLineAndCharacterOfPosition(first.start ?? 0).line + 1,
+    message: ts.flattenDiagnosticMessageText(first.messageText, ' ') } : null;
+}
+
+function assertRedactedCodeParses(file: string, before: string, after: string): void {
+  const failure = firstCodeParseError(file, after);
+  if (!failure) return;
+  const baseline = firstCodeParseError(file, before);
+  const issue = baseline ?? failure;
+  const marker = baseline ? 'private-source-syntax' : 'private-redaction-syntax';
+  const label = baseline ? 'source code was already invalid before redaction' : 'private redaction produced invalid code';
+  throw new PrivateRedactionError(`${label} at ${file}:${issue.line}: ${issue.message}`,
+    [{ marker, file, line: issue.line, text: issue.message }]);
+}
+
 export function applyPrivateRedactions(contents: ReadonlyMap<string, string>, redactions: readonly PrivateRedaction[]): { contents: Map<string, string>; files: number; places: number } {
   const result = new Map(contents);
   let files = 0; let places = 0;
   for (const [file, text] of result) {
     if (text.includes('\u0000')) continue;
+    assertRedactionsAvoidIdentifiers(file, text, redactions);
     let out = text; let changed = 0;
     for (const r of redactions) out = out.replace(redactionPattern(r.from), () => { changed++; return r.to; });
-    if (changed) { result.set(file, out); files++; places += changed; }
+    if (changed) { assertRedactedCodeParses(file, text, out); result.set(file, out); files++; places += changed; }
   }
   return { contents: result, files, places };
 }
@@ -461,7 +521,14 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
     // ⭐ 개인 치환표(저장소 밖) — 규칙 변환 «뒤»에 건다. 없으면 «못 봤다»로 막는다.
     const redactions = loadPrivateRedactions();
     const noPrivateList = argv.includes('--no-private-list');
-    const redacted = redactions ? applyPrivateRedactions(transformedByRules.contents, redactions) : { contents: transformedByRules.contents, files: 0, places: 0 };
+    let redacted: ReturnType<typeof applyPrivateRedactions>;
+    try { redacted = redactions ? applyPrivateRedactions(transformedByRules.contents, redactions) : { contents: transformedByRules.contents, files: 0, places: 0 }; }
+    catch (error) {
+      console.error(`⛔ ${error instanceof Error ? error.message : String(error)}`);
+      if (json && error instanceof PrivateRedactionError) console.log(JSON.stringify({ files: scanned.length,
+        leaks: error.hits.length, hits: error.hits }));
+      return 1;
+    }
     const transformed = { contents: redacted.contents, counts: transformedByRules.counts };
     const privateRedactions = { table: privateRedactionsPath(), loaded: redactions !== null, entries: redactions?.length ?? 0, files: redacted.files, places: redacted.places };
     if (redactions) console.error(`private redactions: ${redacted.files} files · ${redacted.places} places (${redactions.length} entries · ${privateRedactionsPath()})`);

package/scripts/ratchets/next-tui-entry-budget.ts

@@ -0,0 +1,124 @@
+import ts from 'typescript';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+
+export const ENTRY_LINE_LIMIT = 4_000;
+export const ENTRY_MODULE_LIMIT = 1_188;
+export const INDEX_MODULE_LIMIT = 1_264;
+const DASHBOARD_BASELINE = 'src/dashboard/loop-scheduler.ts';
+
+export interface AuditResult { errors: string[]; notes: string[]; entryModules: number; indexModules: number; oversized: Array<{ file: string; lines: number }> }
+
+function walkTs(root: string): string[] {
+  return readdirSync(root).flatMap((name) => {
+    const path = join(root, name);
+    return statSync(path).isDirectory() ? walkTs(path) : /\.(?:[cm]?ts|tsx)$/.test(path) ? [path] : [];
+  });
+}
+
+function isInside(root: string, path: string): boolean {
+  const rel = relative(root, path);
+  return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !resolve(path).startsWith(`${resolve(root, 'node_modules')}${sep}`));
+}
+
+function staticClosure(repo: string, entry: string): Set<string> {
+  const configPath = join(repo, 'tsconfig.json');
+  const config = ts.readConfigFile(configPath, ts.sys.readFile);
+  if (config.error) throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, '\n'));
+  const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, repo);
+  if (parsed.errors.length) throw new Error(parsed.errors.map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n')).join('; '));
+  const options = parsed.options;
+  const seen = new Set<string>();
+  const visit = (file: string): void => {
+    const abs = resolve(file);
+    if (seen.has(abs)) return;
+    seen.add(abs);
+    const source = ts.createSourceFile(abs, readFileSync(abs, 'utf8'), ts.ScriptTarget.Latest, true);
+    for (const node of source.statements) {
+      if (ts.isImportDeclaration(node)) {
+        if (node.importClause?.isTypeOnly || !ts.isStringLiteral(node.moduleSpecifier)) continue;
+        const specifier = node.moduleSpecifier.text;
+        const result = ts.resolveModuleName(specifier, abs, options, ts.sys).resolvedModule;
+        if (!result) {
+          if (specifier.startsWith('.') || specifier.startsWith('/')) throw new Error(`unresolved static import ${relative(repo, abs)} -> ${specifier}`);
+          continue;
+        }
+        if (isInside(repo, result.resolvedFileName)) visit(result.resolvedFileName);
+      } else if (ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        if (node.isTypeOnly) continue;
+        const specifier = node.moduleSpecifier.text;
+        const result = ts.resolveModuleName(specifier, abs, options, ts.sys).resolvedModule;
+        if (!result) {
+          if (specifier.startsWith('.') || specifier.startsWith('/')) throw new Error(`unresolved static re-export ${relative(repo, abs)} -> ${specifier}`);
+          continue;
+        }
+        if (isInside(repo, result.resolvedFileName)) visit(result.resolvedFileName);
+      }
+    }
+  };
+  visit(entry);
+  return seen;
+}
+
+export function entryBudgetAffected(changedFiles: readonly string[]): boolean {
+  if (changedFiles.some((file) => file === 'bin/elanous.mjs' || file === 'tsconfig.json' || file === 'scripts/ratchets/next-tui-entry-budget.ts')) return true;
+  // Any source edit can add/remove an importer or delete a module from a base
+  // closure. The changed tree alone cannot prove non-membership in the base graph.
+  return changedFiles.some((file) => /^src\/.+\.[cm]?[jt]sx?$/.test(file));
+}
+
+export function audit(repo: string): AuditResult {
+  const errors: string[] = [];
+  const notes: string[] = [];
+  const tuiFiles = [join(repo, 'src/tui.ts'), ...walkTs(join(repo, 'src/tui'))];
+  const oversized = tuiFiles.map((file) => {
+    const contents = readFileSync(file, 'utf8');
+    const lines = contents.length === 0 ? 0 : contents.split(/\r?\n/).length - (contents.endsWith('\n') ? 1 : 0);
+    return { file: relative(repo, file), lines };
+  })
+    .filter(({ lines }) => lines > ENTRY_LINE_LIMIT);
+  for (const item of oversized) errors.push(`${item.file}: ${item.lines} lines exceeds ${ENTRY_LINE_LIMIT}`);
+
+  const entryClosure = staticClosure(repo, join(repo, 'src/tui/entry.ts'));
+  const entryPaths = [...entryClosure].map((file) => relative(repo, file).replaceAll('\\', '/'));
+  if (entryClosure.size > ENTRY_MODULE_LIMIT) errors.push(`Next entry static module count ${entryClosure.size} exceeds ${ENTRY_MODULE_LIMIT}`);
+  else if (entryClosure.size < ENTRY_MODULE_LIMIT) notes.push(`tighten entry module cap ${ENTRY_MODULE_LIMIT} -> ${entryClosure.size}`);
+  const forbiddenIndex = entryPaths.filter((p) => p === 'src/index.ts');
+  if (forbiddenIndex.length) errors.push('Next entry statically imports forbidden src/index.ts');
+  const dashboard = entryPaths.filter((p) => p.startsWith('src/dashboard/'));
+  const unexpectedDashboard = dashboard.filter((p) => p !== DASHBOARD_BASELINE);
+  if (unexpectedDashboard.length) errors.push(`forbidden dashboard static imports: ${unexpectedDashboard.join(', ')}`);
+  if (dashboard.includes(DASHBOARD_BASELINE)) notes.push(`${DASHBOARD_BASELINE} is temporary baseline; remove at NEXT-TUI-EXTRACT-FROM-INDEX`);
+
+  const binPath = join(repo, 'bin/elanous.mjs');
+  const bin = readFileSync(binPath, 'utf8');
+  // The deployment entry sends every unrecognized route to src/index.ts. The current
+  // light router does not claim --tui next, so measure that fallback's static closure.
+  const binSource = ts.createSourceFile(binPath, bin, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+  let importsIndex = false;
+  const visitBin = (node: ts.Node): void => {
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword
+      && node.arguments[0] && ts.isStringLiteral(node.arguments[0])
+      && /(?:^|\/)src\/index\.ts$/.test(node.arguments[0].text.replaceAll('\\', '/'))) importsIndex = true;
+    ts.forEachChild(node, visitBin);
+  };
+  visitBin(binSource);
+  const indexClosure = importsIndex ? staticClosure(repo, join(repo, 'src/index.ts')) : new Set<string>();
+  if (importsIndex && indexClosure.size > INDEX_MODULE_LIMIT) errors.push(`bin --tui next index static module count ${indexClosure.size} exceeds ${INDEX_MODULE_LIMIT}`);
+  else if (importsIndex && indexClosure.size < INDEX_MODULE_LIMIT) notes.push(`tighten index module cap ${INDEX_MODULE_LIMIT} -> ${indexClosure.size} after entry extraction`);
+  else if (!importsIndex) notes.push('bin has no dynamic import of src/index.ts; index fallback budget no longer applies');
+  return { errors, notes, entryModules: entryClosure.size, indexModules: indexClosure.size, oversized };
+}
+
+if (import.meta.main) {
+  try {
+    const result = audit(resolve(dirname(new URL(import.meta.url).pathname), '../..'));
+    console.log(`NEXT_TUI_ENTRY_BUDGET entryModules=${result.entryModules} indexModules=${result.indexModules} oversized=${result.oversized.length}`);
+    for (const note of result.notes) console.log(`NOTE ${note}`);
+    for (const error of result.errors) console.error(`FAIL ${error}`);
+    process.exitCode = result.errors.length ? 1 : 0;
+  } catch (error) {
+    console.error(`UNMEASURED ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 2;
+  }
+}

package/scripts/ratchets/train-side-invariants.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Train-side sentinel for the eight real HARD 0.2.32 regressions. Run on the
+# Train-side sentinel for the HARD regressions and release-critical invariants. Run on the
 # merged side tree before the changed-file gate; never interpret a missing test
 # or an incomplete run as a pass.
 set -u
 
 files=(
   scripts/ratchets/test-interference-patterns.test.ts
+  scripts/ratchets/next-tui-entry-budget.test.ts
   src/domains/finance-cli.test.ts
   src/instance/state-dir-provenance-ratchet.test.ts
   src/self-implement/graph-yaml.test.ts
@@ -13,6 +14,11 @@ files=(
   test/identity-env.test.ts
   test/no-absolute-path-imports.test.ts
   test/scenarios/integration.test.ts
+  test/rules-contract.test.ts
+  test/hook-order-sweep.test.ts
+  src/cli/g6a-commands.test.ts
+  test/spawn-sync-max-buffer.test.ts
+  test/telegram-coding-model-terra.test.ts
 )
 
 if [[ ${1:-} == --list ]]; then

package/scripts/release-loop/cut-branch.ts

@@ -6,7 +6,18 @@ import { join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { isReleaseVersion } from './release-version.js';
 
-export interface CutBranchOptions { version: string; base: string; pick: string[]; append?: boolean; dryRun?: boolean; repoRoot?: string; log?: (line: string) => void }
+export interface CutBranchOptions {
+  version: string;
+  /** Optional only on the --append path (RELEASE-APPEND-BASE-AUTO); required without --append. */
+  base?: string;
+  pick: string[];
+  append?: boolean;
+  dryRun?: boolean;
+  repoRoot?: string;
+  log?: (line: string) => void;
+  /** Run ledger's version-release record ({ commit, branch, base? }) — consulted when --append omits --base. */
+  ledger?: () => { commit?: unknown; base?: unknown; branch?: unknown } | undefined;
+}
 
 // git-spawn-allow: release branch operations happen only in an isolated temporary worktree; main is never checked out or changed.
 function git(repo: string, args: string[]): string {
@@ -21,24 +32,35 @@ function ancestor(repo: string, sha: string, ref: string): boolean {
   return result.status === 0;
 }
 
+/** RELEASE-APPEND-BASE-AUTO: the first parent of a release-branch tip — the commit main was cut from when the branch carries only release-side commits. */
+function firstParent(repo: string, sha: string): string | undefined {
+  const parts = git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(/\s+/);
+  const parent = parts[1];
+  return parent !== undefined && /^[0-9a-f]{40}$/i.test(parent) ? parent : undefined;
+}
+
+/** RELEASE-APPEND-BASE-AUTO: the main cut recorded by the run ledger's version-release node — its base field when present, else the first parent of its commit. Unresolvable records degrade to undefined so the caller keeps its refusal. */
+function ledgerCut(repo: string, recorded: { commit?: unknown; base?: unknown; branch?: unknown } | undefined): string | undefined {
+  if (!recorded) return undefined;
+  try {
+    if (typeof recorded.base === 'string' && /^[0-9a-f]{7,40}$/i.test(recorded.base)) return git(repo, ['rev-parse', '--verify', `${recorded.base}^{commit}`]);
+    if (typeof recorded.commit === 'string' && /^[0-9a-f]{7,40}$/i.test(recorded.commit)) return firstParent(repo, git(repo, ['rev-parse', '--verify', `${recorded.commit}^{commit}`]));
+  } catch { return undefined; }
+  return undefined;
+}
+
 export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; commit: string | null; dryRun: boolean } {
   const repo = resolve(opts.repoRoot ?? process.cwd());
   const branch = `release/${opts.version}`;
   const log = opts.log ?? console.log;
-  const report = (event: 'created' | 'refused' | 'conflict' | 'appended', reason?: string, commit?: string, extra?: Record<string, string | string[]>) =>
+  const report = (event: 'created' | 'refused' | 'conflict' | 'appended' | 'base-resolved' | 'base-corrected', reason?: string, commit?: string, extra?: Record<string, string | string[]>) =>
     debug.log('release-loop.cut-branch', event, { version: opts.version, branch, ...(commit ? { commit } : {}), ...(reason ? { reason } : {}), ...extra });
   try {
     if (!isReleaseVersion(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
     if (!opts.pick.length) throw new Error('at least one --pick commit is required');
-    for (const sha of [opts.base, ...opts.pick]) if (!/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
+    if (opts.base === undefined && !opts.append) throw new Error('--base is required without --append');
+    for (const sha of [opts.base, ...opts.pick]) if (sha !== undefined && !/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
     git(repo, ['fetch', 'origin', 'main']);
-    const base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
-    if (!ancestor(repo, base, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
-    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
-    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
-    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
-    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
-    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
     const remoteLine = git(repo, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]);
     if (remoteLine && !opts.append) throw new Error(`${branch} already exists on origin — use --append to fast-forward more picks onto it`);
     if (!remoteLine && opts.append) throw new Error(`${branch} does not exist on origin — omit --append to create it`);
@@ -50,13 +72,40 @@ export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; comm
       git(repo, ['fetch', 'origin', `refs/heads/${branch}:refs/remotes/origin/${branch}`]);
       remoteTip = git(repo, ['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
       if (advertised !== remoteTip) throw new Error(`${branch} remote tip moved — fast-forward refused (no force push)`);
-      for (const sha of picks) if (ancestor(repo, sha, remoteTip)) throw new Error(`pick ${sha} is already in ${branch}`);
     }
+    // RELEASE-APPEND-BASE-AUTO (OP 0.2.38): a cut commit lives only on the release branch, so the main cut is resolved
+    // before the ancestor refusal — from the run ledger's version-release record, else the release tip's first parent.
+    let base: string;
+    if (opts.base !== undefined) {
+      base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
+    } else {
+      const fromLedger = ledgerCut(repo, opts.ledger?.());
+      const ledgerCandidate = fromLedger !== undefined && ancestor(repo, fromLedger, 'origin/main') ? fromLedger : undefined;
+      const candidate = ledgerCandidate ?? (remoteTip !== undefined ? firstParent(repo, remoteTip) : undefined);
+      if (candidate === undefined || !ancestor(repo, candidate, 'origin/main'))
+        throw new Error(`base ${candidate ?? remoteTip ?? branch} is not an ancestor of origin/main`);
+      base = candidate;
+      report('base-resolved', undefined, base, { source: ledgerCandidate !== undefined ? 'ledger' : 'first-parent' });
+    }
+    if (!ancestor(repo, base, 'origin/main')) {
+      if (!opts.append) throw new Error(`base ${base} is not an ancestor of origin/main`);
+      const parent = firstParent(repo, base);
+      if (parent === undefined || !ancestor(repo, parent, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
+      log(`base ${base} 는 origin/main 에 없다 — 그 부모 ${parent} 를 쓰라 (auto-corrected)`);
+      report('base-corrected', `그 부모 ${parent} 를 쓰라 — ${base} 는 origin/main 에 없다`, base, { parent });
+      base = parent;
+    }
+    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
+    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
+    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
+    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
+    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
+    if (opts.append) for (const sha of picks) if (ancestor(repo, sha, remoteTip!)) throw new Error(`pick ${sha} is already in ${branch}`);
     const versionAt = remoteTip ?? base;
     const pkg = JSON.parse(git(repo, ['show', `${versionAt}:package.json`])) as { version?: unknown };
     if (pkg.version !== opts.version) throw new Error(`${opts.append ? 'release branch' : 'base'} package.json version ${pkg.version} is not ${opts.version}`);
     const start = remoteTip ?? base;
-    log(`${branch}: ${start} + ${picks.join(' + ')}${opts.append ? ' (append)' : ''}${opts.dryRun ? ' (dry-run)' : ''}`);
+    log(`${branch}: ${start} + ${picks.join(' + ')}${opts.append ? ' (append)' : ''}${opts.dryRun ? ' (dry-run)' : ''}${base !== start ? ` · base ${base}` : ''}`);
     if (opts.dryRun) return { branch, commit: null, dryRun: true };
     const temp = mkdtempSync(join(tmpdir(), 'release-cut-branch-'));
     const tree = join(temp, 'tree');