elanous 0.2.37 → 0.2.40

package/scripts/lib/tui-regress-evidence.ts

@@ -0,0 +1,56 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface TuiRegressFailureEvidence {
+  runId: string;
+  event: string;
+  verificationCommand: string;
+  artifactRoot: string;
+  configDir: string;
+  check: { id: string; title: string; role: string };
+  screens: Record<string, string>;
+  pty: { cols: number; rows: number; bootMs: number };
+  environment: {
+    driveTui: string;
+    nodeEnv: string | null;
+    credentialVariablesPresent: string[];
+  };
+  verdict: { ok: boolean; reason: string };
+}
+
+function redactConfig(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(redactConfig);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+      key,
+      /api.?key|token|secret|password|credential/i.test(key) ? '[REDACTED]' : redactConfig(child),
+    ]));
+  }
+  return value;
+}
+
+export function preserveTuiRegressFailure(input: TuiRegressFailureEvidence): string {
+  mkdirSync(input.artifactRoot, { recursive: true });
+  const artifactDir = mkdtempSync(join(input.artifactRoot, `${input.check.id}-`));
+  const screensDir = join(artifactDir, 'screens');
+  mkdirSync(screensDir);
+  for (const [name, screen] of Object.entries(input.screens)) writeFileSync(join(screensDir, `${name}.txt`), screen);
+
+  const configPath = join(input.configDir, 'config.json');
+  let effectiveConfig: unknown = { unavailable: !existsSync(configPath) };
+  if (existsSync(configPath)) {
+    try { effectiveConfig = redactConfig(JSON.parse(readFileSync(configPath, 'utf8'))); }
+    catch (error) { effectiveConfig = { parseError: String(error), bytes: readFileSync(configPath).byteLength }; }
+  }
+  writeFileSync(join(artifactDir, 'effective-config.json'), `${JSON.stringify(effectiveConfig, null, 2)}\n`);
+  writeFileSync(join(artifactDir, 'run.json'), `${JSON.stringify({
+    runId: input.runId,
+    event: input.event,
+    verificationCommand: input.verificationCommand,
+    check: input.check,
+    pty: input.pty,
+    environment: input.environment,
+    verdict: input.verdict,
+  }, null, 2)}\n`);
+  return artifactDir;
+}

package/scripts/morning-report.ts

@@ -4,12 +4,14 @@
 //   bun run scripts/morning-report.ts --dry        # compose only (stdout, no send)
 //   bun run scripts/morning-report.ts --no-narrate # skip the LLM 시장서사 layer
 //   bun run scripts/morning-report.ts --no-upload  # skip S3 상세 업로드(로컬 미리보기)
+//   bun run scripts/morning-report.ts --narrative-model <model>  # 시장서사 LLM 모델 명시(A/B)
 
 import { composeMorningReport } from '../src/domains/morning-report.js';
 import { explainReportRoute, sendTelegramReport, sendReportPhoto } from '../src/telegram-report.js';
 import { getUserConfig } from '../src/user-config.js';
 import { getFirecrawlConfig } from '../src/registry/discovery/config.js';
 import { captureFinvizMapImageUrl } from '../src/domains/finviz-image.js';
+import { parseNarrativeModelArg } from './lib/morning-report-options.js';
 
 import { registerStandaloneLogSink } from '../src/domains/standalone-log-sink.js';
 
@@ -20,6 +22,8 @@ const dry = process.argv.includes('--dry');
 const cfg = getUserConfig();
 const narrate = cfg.finance.morningNarrative !== false && !process.argv.includes('--no-narrate');
 const upload = !process.argv.includes('--no-upload');
+// --narrative-model X / =X — 값이 없으면 parseNarrativeModelArg 가 throw(기본 모델로 조용히 대체하지 않는다).
+const model = parseNarrativeModelArg(process.argv.slice(2));
 
 // finviz S&P 히트맵 이미지 — HTML 상세 리포트에 임베드 + 텔레그램 포토로도 발송. 키 있을 때만.
 let heatmapImageUrl: string | undefined;
@@ -31,7 +35,7 @@ if (cfg.finance.morningHeatmapImage !== false) {
   } catch (e) { console.error(`[morning-report] heatmap capture error: ${e instanceof Error ? e.message : String(e)}`); }
 }
 
-const report = await composeMorningReport(new Date(), { narrate, heatmapImageUrl, upload });
+const report = await composeMorningReport(new Date(), { narrate, heatmapImageUrl, upload, model });
 
 if (dry) {
   console.log(report);

package/scripts/provision-export-redactions.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env bun
+import { provisionExportRedactions } from '../src/task-agent/export-redactions-provision.js';
+
+const host = process.argv[2];
+if (!host || process.argv.length !== 3) {
+  console.error('usage: bun scripts/provision-export-redactions.ts <train-host>');
+  process.exit(2);
+}
+try {
+  provisionExportRedactions(host);
+  console.log(`EXPORT_REDACTIONS_PROVISIONED host=${host}`);
+} catch (error) {
+  console.error(`EXPORT_REDACTIONS_UNMEASURED host=${host}: ${error instanceof Error ? error.message : 'unknown error'}`);
+  process.exitCode = 1;
+}

package/scripts/public-copy-lint.ts

@@ -0,0 +1,122 @@
+#!/usr/bin/env bun
+/** Warning-only public-copy shadow scan. It never edits source or exposes private candidate text. */
+import { existsSync, readFileSync } from 'node:fs';
+import { extname, normalize, relative, resolve, sep } from 'node:path';
+import { PatentLedger } from '../src/patents/ledger.js';
+import { checkBrandText } from './brand/check.js';
+
+export type PublicCopyInput = { label: string; text: string };
+export type PublicCopyFinding = { source: string; line: number; rule: string };
+export type PatentLineMatcher = (text: string) => number[];
+export type PublicCopyScan = {
+  findings: PublicCopyFinding[];
+  excludedSources: Array<{ source: string; reason: 'internal-goal-document' }>;
+  brandRulesAvailable: boolean;
+  patentLedgerAvailable: boolean;
+};
+
+function normalizedLabel(label: string): string | undefined {
+  const slashed = label.replaceAll('\\', '/');
+  if (slashed.startsWith('/')) return undefined;
+  const normalized = normalize(slashed).replaceAll('\\', '/').replace(/^\.\//, '');
+  if (normalized === '..' || normalized.startsWith('../')) return undefined;
+  return normalized;
+}
+
+function allowedNormalizedLabel(normalized: string | undefined): boolean {
+  if (!normalized) return false;
+  if (normalized === 'PR-BODY') return true;
+  if (normalized.split('/').some((part) => part === '..' || part === '')) return false;
+  if (!['.md', '.mdx', '.txt', '.html', '.htm'].includes(extname(normalized).toLowerCase())) return false;
+  return ['docs/', 'release/public/docs/', 'blog/', 'posts/', 'content/blog/', 'content/posts/']
+    .some((root) => normalized.startsWith(root));
+}
+
+/** Brand rule messages intentionally omit matched text; patent matches are private too. */
+export function scanPublicCopy(inputs: readonly PublicCopyInput[], matchPrivateCandidate: PatentLineMatcher, rulesPath?: string): PublicCopyScan {
+  const findings: PublicCopyFinding[] = [];
+  const excludedSources: PublicCopyScan['excludedSources'] = [];
+  let brandRulesAvailable = true;
+  let patentLedgerAvailable = true;
+  for (const input of inputs) {
+    const label = normalizedLabel(input.label);
+    if (!allowedNormalizedLabel(label)) throw new Error(`공개 문면 입력 경로가 허용 목록 밖입니다: ${input.label}`);
+    // Goal specs are internal execution artifacts, not customer-facing copy.
+    // Counting their acceptance criteria as marketing measurements created a
+    // high false-positive rate in the 30-PR audit.
+    if (label?.startsWith('docs/goals/')) {
+      excludedSources.push({ source: input.label, reason: 'internal-goal-document' });
+      continue;
+    }
+    try {
+      const brandFindings = checkBrandText(input.text, input.label, 'public-docs', rulesPath);
+      // Publication-specific promise/measurement rules apply to this explicit
+      // shadow scan without changing the existing generic brand-check scopes.
+      const publicationFindings = checkBrandText(input.text, input.label, 'release-notes', rulesPath)
+        .filter((hit) => hit.id === 'BRAND-SOON' || hit.id === 'B4-NUMBER-SOURCE');
+      for (const hit of [...brandFindings, ...publicationFindings]) {
+        findings.push({ source: input.label, line: hit.line, rule: hit.id });
+      }
+    } catch { brandRulesAvailable = false; }
+    try { for (const line of matchPrivateCandidate(input.text)) findings.push({ source: input.label, line, rule: 'PRIVATE-PATENT-CANDIDATE' }); }
+    catch { patentLedgerAvailable = false; }
+  }
+  if (inputs.length === 0 || excludedSources.length === inputs.length) {
+    // No scanner ran, so availability must not claim a successful measurement.
+    brandRulesAvailable = false;
+    patentLedgerAvailable = false;
+  }
+  return {
+    findings: findings.sort((a, b) => a.source.localeCompare(b.source) || a.line - b.line || a.rule.localeCompare(b.rule)),
+    excludedSources,
+    brandRulesAvailable, patentLedgerAvailable,
+  };
+}
+
+export function lintPublicCopy(inputs: readonly PublicCopyInput[], matchPrivateCandidate: PatentLineMatcher): PublicCopyFinding[] {
+  return scanPublicCopy(inputs, matchPrivateCandidate).findings;
+}
+
+export function run(argv: readonly string[], root = process.cwd(), ledger = new PatentLedger()): number {
+  const files: string[] = [];
+  let bodyFile: string | undefined;
+  let bodyLabel = 'PR-BODY';
+  let json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!;
+    if (arg === '--json') json = true;
+    else if (arg === '--files') {
+      while (argv[i + 1] && !argv[i + 1]!.startsWith('--')) files.push(argv[++i]!);
+      if (!files.length) throw new Error('--files 에 문면 경로가 필요합니다');
+    } else if (arg === '--pr-body-file') {
+      bodyFile = argv[++i];
+      if (!bodyFile || bodyFile.startsWith('--')) throw new Error('--pr-body-file 에 본문 파일이 필요합니다');
+    } else if (arg === '--pr-body-label') {
+      bodyLabel = argv[++i] ?? '';
+      if (!bodyLabel || bodyLabel.startsWith('--')) throw new Error('--pr-body-label 에 라벨이 필요합니다');
+    } else throw new Error(`알 수 없는 옵션: ${arg}`);
+  }
+  if (!files.length && !bodyFile) throw new Error('usage: bun scripts/public-copy-lint.ts [--files <docs...>] [--pr-body-file <file> [--pr-body-label <repo-relative-label>]] [--json]');
+  const inputs: PublicCopyInput[] = files.map((file) => ({
+    label: relative(root, resolve(root, file)).split(sep).join('/'), text: readFileSync(resolve(root, file), 'utf8'),
+  }));
+  if (bodyFile) inputs.push({ label: bodyLabel, text: readFileSync(resolve(root, bodyFile), 'utf8') });
+  const matchPrivateCandidate: PatentLineMatcher = (text) => {
+    return ledger.unapprovedCandidateLineNumbers(text);
+  };
+  const scan = scanPublicCopy(inputs, matchPrivateCandidate);
+  if (json) console.log(JSON.stringify({ mode: 'warning-only', ...scan }));
+  else {
+    for (const finding of scan.findings) console.log(`${finding.source}:${finding.line}:WARN:${finding.rule}`);
+    for (const excluded of scan.excludedSources) console.log(`${excluded.source}:SKIP:${excluded.reason}`);
+    if (!scan.brandRulesAvailable) console.log('WARN:BRAND-RULES-UNMEASURED');
+    if (!scan.patentLedgerAvailable) console.log('WARN:PRIVATE-PATENT-LEDGER-UNMEASURED');
+    console.log(`public-copy-lint warning-only documents=${inputs.length - scan.excludedSources.length} excluded=${scan.excludedSources.length} findings=${scan.findings.length} brand-rules=${scan.brandRulesAvailable ? 'measured' : 'unmeasured'} patent-ledger=${scan.patentLedgerAvailable ? 'measured' : 'unmeasured'}`);
+  }
+  return 0;
+}
+
+if (import.meta.main) {
+  try { process.exitCode = run(process.argv.slice(2)); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 2; }
+}

package/scripts/public-export.ts

@@ -101,14 +101,82 @@ function redactionPattern(from: string): RegExp {
   const post = /[A-Za-z0-9]$/.test(from) ? '(?![A-Za-z0-9])' : '';
   return new RegExp(`${pre}${escapeRegExp(from)}${post}`, 'gu');
 }
+const CODE_FILE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu;
+type RedactionProblem = { marker: 'private-redaction-identifier' | 'private-redaction-syntax' | 'private-source-syntax'; file: string; line: number; text: string };
+class PrivateRedactionError extends Error {
+  constructor(message: string, readonly hits: readonly RedactionProblem[]) { super(message); }
+}
+
+function codeIdentifierRanges(file: string, text: string): Array<{ start: number; end: number; name: string }> {
+  if (!CODE_FILE.test(file)) return [];
+  // A raw scanner cannot track template-expression braces without rescanning. It can
+  // report words in later strings/comments as identifiers after a template literal.
+  // The parsed token tree has already resolved those boundaries.
+  const kind = /\.(?:tsx|jsx)$/iu.test(file) ? ts.ScriptKind.TSX
+    : /\.(?:js|mjs|cjs)$/iu.test(file) ? ts.ScriptKind.JS : ts.ScriptKind.TS;
+  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false, kind);
+  const ranges: Array<{ start: number; end: number; name: string }> = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isJSDoc(node)) return;
+    if (node.kind === ts.SyntaxKind.Identifier || node.kind === ts.SyntaxKind.PrivateIdentifier
+      || node.kind >= ts.SyntaxKind.FirstKeyword && node.kind <= ts.SyntaxKind.LastKeyword) {
+      ranges.push({ start: node.getStart(source), end: node.getEnd(), name: node.getText(source) });
+      return;
+    }
+    for (const child of node.getChildren(source)) visit(child);
+  };
+  visit(source);
+  return ranges;
+}
+
+function assertRedactionsAvoidIdentifiers(file: string, text: string, redactions: readonly PrivateRedaction[]): void {
+  if (!CODE_FILE.test(file) || !redactions.some((redaction) => text.includes(redaction.from))) return;
+  const identifiers = codeIdentifierRanges(file, text);
+  if (!identifiers.length) return;
+  const hits: RedactionProblem[] = [];
+  for (const redaction of redactions) {
+    for (const match of text.matchAll(redactionPattern(redaction.from))) {
+      const start = match.index;
+      const token = identifiers.find((entry) => start < entry.end && start + match[0].length > entry.start);
+      if (!token) continue;
+      const line = text.slice(0, token.start).split('\n').length;
+      hits.push({ marker: 'private-redaction-identifier', file, line, text: token.name });
+    }
+  }
+  const unique = [...new Map(hits.map((hit) => [`${hit.file}:${hit.line}:${hit.text}`, hit])).values()];
+  if (unique.length) throw new PrivateRedactionError(`private redaction would change code identifiers: ${unique.slice(0, 12).map((hit) => `${hit.file}:${hit.line} ${hit.text}`).join(', ')}${unique.length > 12 ? ` (+${unique.length - 12} more)` : ''}`, unique);
+}
+
+function firstCodeParseError(file: string, text: string): { line: number; message: string } | null {
+  if (!CODE_FILE.test(file)) return null;
+  const kind = /\.(?:tsx|jsx)$/iu.test(file) ? ts.ScriptKind.TSX
+    : /\.(?:js|mjs|cjs)$/iu.test(file) ? ts.ScriptKind.JS : ts.ScriptKind.TS;
+  const parsed = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false, kind) as ts.SourceFile & { parseDiagnostics: readonly ts.Diagnostic[] };
+  const first = parsed.parseDiagnostics[0];
+  return first ? { line: parsed.getLineAndCharacterOfPosition(first.start ?? 0).line + 1,
+    message: ts.flattenDiagnosticMessageText(first.messageText, ' ') } : null;
+}
+
+function assertRedactedCodeParses(file: string, before: string, after: string): void {
+  const failure = firstCodeParseError(file, after);
+  if (!failure) return;
+  const baseline = firstCodeParseError(file, before);
+  const issue = baseline ?? failure;
+  const marker = baseline ? 'private-source-syntax' : 'private-redaction-syntax';
+  const label = baseline ? 'source code was already invalid before redaction' : 'private redaction produced invalid code';
+  throw new PrivateRedactionError(`${label} at ${file}:${issue.line}: ${issue.message}`,
+    [{ marker, file, line: issue.line, text: issue.message }]);
+}
+
 export function applyPrivateRedactions(contents: ReadonlyMap<string, string>, redactions: readonly PrivateRedaction[]): { contents: Map<string, string>; files: number; places: number } {
   const result = new Map(contents);
   let files = 0; let places = 0;
   for (const [file, text] of result) {
     if (text.includes('\u0000')) continue;
+    assertRedactionsAvoidIdentifiers(file, text, redactions);
     let out = text; let changed = 0;
     for (const r of redactions) out = out.replace(redactionPattern(r.from), () => { changed++; return r.to; });
-    if (changed) { result.set(file, out); files++; places += changed; }
+    if (changed) { assertRedactedCodeParses(file, text, out); result.set(file, out); files++; places += changed; }
   }
   return { contents: result, files, places };
 }
@@ -461,7 +529,14 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
     // ⭐ 개인 치환표(저장소 밖) — 규칙 변환 «뒤»에 건다. 없으면 «못 봤다»로 막는다.
     const redactions = loadPrivateRedactions();
     const noPrivateList = argv.includes('--no-private-list');
-    const redacted = redactions ? applyPrivateRedactions(transformedByRules.contents, redactions) : { contents: transformedByRules.contents, files: 0, places: 0 };
+    let redacted: ReturnType<typeof applyPrivateRedactions>;
+    try { redacted = redactions ? applyPrivateRedactions(transformedByRules.contents, redactions) : { contents: transformedByRules.contents, files: 0, places: 0 }; }
+    catch (error) {
+      console.error(`⛔ ${error instanceof Error ? error.message : String(error)}`);
+      if (json && error instanceof PrivateRedactionError) console.log(JSON.stringify({ files: scanned.length,
+        leaks: error.hits.length, hits: error.hits }));
+      return 1;
+    }
     const transformed = { contents: redacted.contents, counts: transformedByRules.counts };
     const privateRedactions = { table: privateRedactionsPath(), loaded: redactions !== null, entries: redactions?.length ?? 0, files: redacted.files, places: redacted.places };
     if (redactions) console.error(`private redactions: ${redacted.files} files · ${redacted.places} places (${redactions.length} entries · ${privateRedactionsPath()})`);

package/scripts/ratchets/next-tui-entry-budget.ts

@@ -0,0 +1,124 @@
+import ts from 'typescript';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+
+export const ENTRY_LINE_LIMIT = 4_000;
+export const ENTRY_MODULE_LIMIT = 1_188;
+export const INDEX_MODULE_LIMIT = 1_264;
+const DASHBOARD_BASELINE = 'src/dashboard/loop-scheduler.ts';
+
+export interface AuditResult { errors: string[]; notes: string[]; entryModules: number; indexModules: number; oversized: Array<{ file: string; lines: number }> }
+
+function walkTs(root: string): string[] {
+  return readdirSync(root).flatMap((name) => {
+    const path = join(root, name);
+    return statSync(path).isDirectory() ? walkTs(path) : /\.(?:[cm]?ts|tsx)$/.test(path) ? [path] : [];
+  });
+}
+
+function isInside(root: string, path: string): boolean {
+  const rel = relative(root, path);
+  return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !resolve(path).startsWith(`${resolve(root, 'node_modules')}${sep}`));
+}
+
+function staticClosure(repo: string, entry: string): Set<string> {
+  const configPath = join(repo, 'tsconfig.json');
+  const config = ts.readConfigFile(configPath, ts.sys.readFile);
+  if (config.error) throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, '\n'));
+  const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, repo);
+  if (parsed.errors.length) throw new Error(parsed.errors.map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n')).join('; '));
+  const options = parsed.options;
+  const seen = new Set<string>();
+  const visit = (file: string): void => {
+    const abs = resolve(file);
+    if (seen.has(abs)) return;
+    seen.add(abs);
+    const source = ts.createSourceFile(abs, readFileSync(abs, 'utf8'), ts.ScriptTarget.Latest, true);
+    for (const node of source.statements) {
+      if (ts.isImportDeclaration(node)) {
+        if (node.importClause?.isTypeOnly || !ts.isStringLiteral(node.moduleSpecifier)) continue;
+        const specifier = node.moduleSpecifier.text;
+        const result = ts.resolveModuleName(specifier, abs, options, ts.sys).resolvedModule;
+        if (!result) {
+          if (specifier.startsWith('.') || specifier.startsWith('/')) throw new Error(`unresolved static import ${relative(repo, abs)} -> ${specifier}`);
+          continue;
+        }
+        if (isInside(repo, result.resolvedFileName)) visit(result.resolvedFileName);
+      } else if (ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        if (node.isTypeOnly) continue;
+        const specifier = node.moduleSpecifier.text;
+        const result = ts.resolveModuleName(specifier, abs, options, ts.sys).resolvedModule;
+        if (!result) {
+          if (specifier.startsWith('.') || specifier.startsWith('/')) throw new Error(`unresolved static re-export ${relative(repo, abs)} -> ${specifier}`);
+          continue;
+        }
+        if (isInside(repo, result.resolvedFileName)) visit(result.resolvedFileName);
+      }
+    }
+  };
+  visit(entry);
+  return seen;
+}
+
+export function entryBudgetAffected(changedFiles: readonly string[]): boolean {
+  if (changedFiles.some((file) => file === 'bin/elanous.mjs' || file === 'tsconfig.json' || file === 'scripts/ratchets/next-tui-entry-budget.ts')) return true;
+  // Any source edit can add/remove an importer or delete a module from a base
+  // closure. The changed tree alone cannot prove non-membership in the base graph.
+  return changedFiles.some((file) => /^src\/.+\.[cm]?[jt]sx?$/.test(file));
+}
+
+export function audit(repo: string): AuditResult {
+  const errors: string[] = [];
+  const notes: string[] = [];
+  const tuiFiles = [join(repo, 'src/tui.ts'), ...walkTs(join(repo, 'src/tui'))];
+  const oversized = tuiFiles.map((file) => {
+    const contents = readFileSync(file, 'utf8');
+    const lines = contents.length === 0 ? 0 : contents.split(/\r?\n/).length - (contents.endsWith('\n') ? 1 : 0);
+    return { file: relative(repo, file), lines };
+  })
+    .filter(({ lines }) => lines > ENTRY_LINE_LIMIT);
+  for (const item of oversized) errors.push(`${item.file}: ${item.lines} lines exceeds ${ENTRY_LINE_LIMIT}`);
+
+  const entryClosure = staticClosure(repo, join(repo, 'src/tui/entry.ts'));
+  const entryPaths = [...entryClosure].map((file) => relative(repo, file).replaceAll('\\', '/'));
+  if (entryClosure.size > ENTRY_MODULE_LIMIT) errors.push(`Next entry static module count ${entryClosure.size} exceeds ${ENTRY_MODULE_LIMIT}`);
+  else if (entryClosure.size < ENTRY_MODULE_LIMIT) notes.push(`tighten entry module cap ${ENTRY_MODULE_LIMIT} -> ${entryClosure.size}`);
+  const forbiddenIndex = entryPaths.filter((p) => p === 'src/index.ts');
+  if (forbiddenIndex.length) errors.push('Next entry statically imports forbidden src/index.ts');
+  const dashboard = entryPaths.filter((p) => p.startsWith('src/dashboard/'));
+  const unexpectedDashboard = dashboard.filter((p) => p !== DASHBOARD_BASELINE);
+  if (unexpectedDashboard.length) errors.push(`forbidden dashboard static imports: ${unexpectedDashboard.join(', ')}`);
+  if (dashboard.includes(DASHBOARD_BASELINE)) notes.push(`${DASHBOARD_BASELINE} is temporary baseline; remove at NEXT-TUI-EXTRACT-FROM-INDEX`);
+
+  const binPath = join(repo, 'bin/elanous.mjs');
+  const bin = readFileSync(binPath, 'utf8');
+  // The deployment entry sends every unrecognized route to src/index.ts. The current
+  // light router does not claim --tui next, so measure that fallback's static closure.
+  const binSource = ts.createSourceFile(binPath, bin, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+  let importsIndex = false;
+  const visitBin = (node: ts.Node): void => {
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword
+      && node.arguments[0] && ts.isStringLiteral(node.arguments[0])
+      && /(?:^|\/)src\/index\.ts$/.test(node.arguments[0].text.replaceAll('\\', '/'))) importsIndex = true;
+    ts.forEachChild(node, visitBin);
+  };
+  visitBin(binSource);
+  const indexClosure = importsIndex ? staticClosure(repo, join(repo, 'src/index.ts')) : new Set<string>();
+  if (importsIndex && indexClosure.size > INDEX_MODULE_LIMIT) errors.push(`bin --tui next index static module count ${indexClosure.size} exceeds ${INDEX_MODULE_LIMIT}`);
+  else if (importsIndex && indexClosure.size < INDEX_MODULE_LIMIT) notes.push(`tighten index module cap ${INDEX_MODULE_LIMIT} -> ${indexClosure.size} after entry extraction`);
+  else if (!importsIndex) notes.push('bin has no dynamic import of src/index.ts; index fallback budget no longer applies');
+  return { errors, notes, entryModules: entryClosure.size, indexModules: indexClosure.size, oversized };
+}
+
+if (import.meta.main) {
+  try {
+    const result = audit(resolve(dirname(new URL(import.meta.url).pathname), '../..'));
+    console.log(`NEXT_TUI_ENTRY_BUDGET entryModules=${result.entryModules} indexModules=${result.indexModules} oversized=${result.oversized.length}`);
+    for (const note of result.notes) console.log(`NOTE ${note}`);
+    for (const error of result.errors) console.error(`FAIL ${error}`);
+    process.exitCode = result.errors.length ? 1 : 0;
+  } catch (error) {
+    console.error(`UNMEASURED ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 2;
+  }
+}

package/scripts/ratchets/train-side-invariants.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Train-side sentinel for the eight real HARD 0.2.32 regressions. Run on the
+# Train-side sentinel for the HARD regressions and release-critical invariants. Run on the
 # merged side tree before the changed-file gate; never interpret a missing test
 # or an incomplete run as a pass.
 set -u
 
 files=(
   scripts/ratchets/test-interference-patterns.test.ts
+  scripts/ratchets/next-tui-entry-budget.test.ts
   src/domains/finance-cli.test.ts
   src/instance/state-dir-provenance-ratchet.test.ts
   src/self-implement/graph-yaml.test.ts
@@ -13,6 +14,11 @@ files=(
   test/identity-env.test.ts
   test/no-absolute-path-imports.test.ts
   test/scenarios/integration.test.ts
+  test/rules-contract.test.ts
+  test/hook-order-sweep.test.ts
+  src/cli/g6a-commands.test.ts
+  test/spawn-sync-max-buffer.test.ts
+  test/telegram-coding-model-terra.test.ts
 )
 
 if [[ ${1:-} == --list ]]; then

package/scripts/release-loop/cut-branch.ts

@@ -6,7 +6,18 @@ import { join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { isReleaseVersion } from './release-version.js';
 
-export interface CutBranchOptions { version: string; base: string; pick: string[]; append?: boolean; dryRun?: boolean; repoRoot?: string; log?: (line: string) => void }
+export interface CutBranchOptions {
+  version: string;
+  /** Optional only on the --append path (RELEASE-APPEND-BASE-AUTO); required without --append. */
+  base?: string;
+  pick: string[];
+  append?: boolean;
+  dryRun?: boolean;
+  repoRoot?: string;
+  log?: (line: string) => void;
+  /** Run ledger's version-release record ({ commit, branch, base? }) — consulted when --append omits --base. */
+  ledger?: () => { commit?: unknown; base?: unknown; branch?: unknown } | undefined;
+}
 
 // git-spawn-allow: release branch operations happen only in an isolated temporary worktree; main is never checked out or changed.
 function git(repo: string, args: string[]): string {
@@ -21,24 +32,35 @@ function ancestor(repo: string, sha: string, ref: string): boolean {
   return result.status === 0;
 }
 
+/** RELEASE-APPEND-BASE-AUTO: the first parent of a release-branch tip — the commit main was cut from when the branch carries only release-side commits. */
+function firstParent(repo: string, sha: string): string | undefined {
+  const parts = git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(/\s+/);
+  const parent = parts[1];
+  return parent !== undefined && /^[0-9a-f]{40}$/i.test(parent) ? parent : undefined;
+}
+
+/** RELEASE-APPEND-BASE-AUTO: the main cut recorded by the run ledger's version-release node — its base field when present, else the first parent of its commit. Unresolvable records degrade to undefined so the caller keeps its refusal. */
+function ledgerCut(repo: string, recorded: { commit?: unknown; base?: unknown; branch?: unknown } | undefined): string | undefined {
+  if (!recorded) return undefined;
+  try {
+    if (typeof recorded.base === 'string' && /^[0-9a-f]{7,40}$/i.test(recorded.base)) return git(repo, ['rev-parse', '--verify', `${recorded.base}^{commit}`]);
+    if (typeof recorded.commit === 'string' && /^[0-9a-f]{7,40}$/i.test(recorded.commit)) return firstParent(repo, git(repo, ['rev-parse', '--verify', `${recorded.commit}^{commit}`]));
+  } catch { return undefined; }
+  return undefined;
+}
+
 export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; commit: string | null; dryRun: boolean } {
   const repo = resolve(opts.repoRoot ?? process.cwd());
   const branch = `release/${opts.version}`;
   const log = opts.log ?? console.log;
-  const report = (event: 'created' | 'refused' | 'conflict' | 'appended', reason?: string, commit?: string, extra?: Record<string, string | string[]>) =>
+  const report = (event: 'created' | 'refused' | 'conflict' | 'appended' | 'base-resolved' | 'base-corrected', reason?: string, commit?: string, extra?: Record<string, string | string[]>) =>
     debug.log('release-loop.cut-branch', event, { version: opts.version, branch, ...(commit ? { commit } : {}), ...(reason ? { reason } : {}), ...extra });
   try {
     if (!isReleaseVersion(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
     if (!opts.pick.length) throw new Error('at least one --pick commit is required');
-    for (const sha of [opts.base, ...opts.pick]) if (!/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
+    if (opts.base === undefined && !opts.append) throw new Error('--base is required without --append');
+    for (const sha of [opts.base, ...opts.pick]) if (sha !== undefined && !/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
     git(repo, ['fetch', 'origin', 'main']);
-    const base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
-    if (!ancestor(repo, base, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
-    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
-    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
-    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
-    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
-    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
     const remoteLine = git(repo, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]);
     if (remoteLine && !opts.append) throw new Error(`${branch} already exists on origin — use --append to fast-forward more picks onto it`);
     if (!remoteLine && opts.append) throw new Error(`${branch} does not exist on origin — omit --append to create it`);
@@ -50,13 +72,40 @@ export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; comm
       git(repo, ['fetch', 'origin', `refs/heads/${branch}:refs/remotes/origin/${branch}`]);
       remoteTip = git(repo, ['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
       if (advertised !== remoteTip) throw new Error(`${branch} remote tip moved — fast-forward refused (no force push)`);
-      for (const sha of picks) if (ancestor(repo, sha, remoteTip)) throw new Error(`pick ${sha} is already in ${branch}`);
     }
+    // RELEASE-APPEND-BASE-AUTO (OP 0.2.38): a cut commit lives only on the release branch, so the main cut is resolved
+    // before the ancestor refusal — from the run ledger's version-release record, else the release tip's first parent.
+    let base: string;
+    if (opts.base !== undefined) {
+      base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
+    } else {
+      const fromLedger = ledgerCut(repo, opts.ledger?.());
+      const ledgerCandidate = fromLedger !== undefined && ancestor(repo, fromLedger, 'origin/main') ? fromLedger : undefined;
+      const candidate = ledgerCandidate ?? (remoteTip !== undefined ? firstParent(repo, remoteTip) : undefined);
+      if (candidate === undefined || !ancestor(repo, candidate, 'origin/main'))
+        throw new Error(`base ${candidate ?? remoteTip ?? branch} is not an ancestor of origin/main`);
+      base = candidate;
+      report('base-resolved', undefined, base, { source: ledgerCandidate !== undefined ? 'ledger' : 'first-parent' });
+    }
+    if (!ancestor(repo, base, 'origin/main')) {
+      if (!opts.append) throw new Error(`base ${base} is not an ancestor of origin/main`);
+      const parent = firstParent(repo, base);
+      if (parent === undefined || !ancestor(repo, parent, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
+      log(`base ${base} 는 origin/main 에 없다 — 그 부모 ${parent} 를 쓰라 (auto-corrected)`);
+      report('base-corrected', `그 부모 ${parent} 를 쓰라 — ${base} 는 origin/main 에 없다`, base, { parent });
+      base = parent;
+    }
+    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
+    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
+    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
+    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
+    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
+    if (opts.append) for (const sha of picks) if (ancestor(repo, sha, remoteTip!)) throw new Error(`pick ${sha} is already in ${branch}`);
     const versionAt = remoteTip ?? base;
     const pkg = JSON.parse(git(repo, ['show', `${versionAt}:package.json`])) as { version?: unknown };
     if (pkg.version !== opts.version) throw new Error(`${opts.append ? 'release branch' : 'base'} package.json version ${pkg.version} is not ${opts.version}`);
     const start = remoteTip ?? base;
-    log(`${branch}: ${start} + ${picks.join(' + ')}${opts.append ? ' (append)' : ''}${opts.dryRun ? ' (dry-run)' : ''}`);
+    log(`${branch}: ${start} + ${picks.join(' + ')}${opts.append ? ' (append)' : ''}${opts.dryRun ? ' (dry-run)' : ''}${base !== start ? ` · base ${base}` : ''}`);
     if (opts.dryRun) return { branch, commit: null, dryRun: true };
     const temp = mkdtempSync(join(tmpdir(), 'release-cut-branch-'));
     const tree = join(temp, 'tree');

package/scripts/release-loop/export-check-node.ts

@@ -46,9 +46,27 @@ export function runExportCheck(run: CommandRunner = runCommand, repoRoot = proce
             step = 'build';
             const publicDir = join(out, 'export');
             symlinkSync(join(modulesRoot, 'node_modules'), join(publicDir, 'node_modules'), 'dir');
-            const pwaModules = join(modulesRoot, 'apps', 'pwa', 'node_modules');
-            if (!existsSync(pwaModules)) result = failed('build', 'PWA dependencies missing; run bun install --cwd apps/pwa in the release-loop repository');
-            else {
+            let pwaModules = join(root, 'apps', 'pwa', 'node_modules');
+            let pwaReady = existsSync(pwaModules);
+            if (!pwaReady) {
+              const installed = run('bun', ['install', '--cwd', join(root, 'apps', 'pwa'), '--frozen-lockfile'], root);
+              if (installed.status !== 0) {
+                // This path was absent before install. Remove partial output so a later retry cannot mistake it for a complete install.
+                let cleanupFailed = false;
+                try { rmSync(pwaModules, { recursive: true, force: true }); }
+                catch (error) {
+                  cleanupFailed = true;
+                  result = failed('build', `PWA dependency install partial-output cleanup: ${error instanceof Error ? error.message : String(error)}`, installed);
+                }
+                if (!cleanupFailed) result = failed('build', 'PWA dependency install', installed);
+              }
+              else {
+                pwaReady = existsSync(pwaModules);
+                if (!pwaReady) result = failed('build', 'PWA dependency install did not create apps/pwa/node_modules', installed);
+              }
+            }
+            if (pwaReady) {
+              pwaModules = realpathSync(pwaModules);
               if (existsSync(join(publicDir, 'apps', 'pwa'))) symlinkSync(pwaModules, join(publicDir, 'apps', 'pwa', 'node_modules'), 'dir');
               const built = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], publicDir);
               result = built.status === 0 && existsSync(join(publicDir, 'apps', 'pwa', 'out', 'index.html'))