Own HyperTwist GitNexus runtime bootstrap and recovery

.gitignore

@@ -16,6 +16,8 @@ website/server/node_modules/
 website/server/data/
 tools/sentrux/bin/*
 !tools/sentrux/bin/.gitkeep
+tools/gitnexus/runtime/*
+!tools/gitnexus/runtime/.gitkeep
 
 # Sensitive or reference-only material.
 docs/refs/

docs/ops/HYPERTWIST_REFACTORING_TOOLCHAIN_2026-06-22.md

@@ -21,6 +21,7 @@ VectorShell.
 
 - `.sentrux/rules.toml`
 - `scripts/bootstrap-hypertwist-sentrux.sh`
+- `scripts/bootstrap-hypertwist-gitnexus.sh`
 - `scripts/run-hypertwist-sentrux-source-only.sh`
 - `scripts/run-hypertwist-sentrux-gate.sh`
 - `scripts/run-hypertwist-gitnexus-analyze.sh`
@@ -121,16 +122,32 @@ Behavior:
   status output stays clean instead of reporting an empty `HEAD`
 - deletes copied files above the default `256 KB` ceiling so giant Unreal
   generated/runtime files do not destabilize the native worker path
-- prefers the local retained working reference at
+- prefers the repo-owned runtime at
-  `mirrors/GitNexus/gitnexus/dist/cli/index.js`
+  `tools/gitnexus/runtime/gitnexus/dist/cli/index.js` when that local landing
-- if the retained local node/native payload is not runnable on the current host
+  zone has already been materialized
-  (for example a cross-platform `LadybugDB` binary mismatch), the wrapper
+- auto-bootstraps that repo-owned runtime through
-  falls back automatically to `npx -y gitnexus@latest`
+  `scripts/bootstrap-hypertwist-gitnexus.sh --if-missing` before falling back
+  to the retained working reference
+- uses the retained working reference at
+  `mirrors/GitNexus/gitnexus/dist/cli/index.js` as a fallback local seed and
+  execution path only when the repo-owned runtime is absent or still unusable
+- if neither local runtime is runnable on the current host (for example a
+  cross-platform `LadybugDB` binary mismatch), the wrapper falls back
+  automatically to `npx -y gitnexus@latest`
 - the wrapper suppresses the retained-CLI native-loader stderr spew and the
   benign empty-`HEAD` stderr noise that upstream `status` can emit on bounded
   disposable mirrors, while preserving the actual status result
-- falls back to `npx -y gitnexus@latest` only if the local retained CLI is not
+- falls back to `npx -y gitnexus@latest` only if no usable local CLI is
-  available or is not runnable
+  available after the repo-owned runtime, the auto-bootstrap attempt, and the
+  retained mirror have all been checked
+- the current `2026-06-30` wrapper hardening now also treats one exact local
+  analyze quirk as success instead of false failure:
+  - on this Linux host, the repo-owned local CLI can still exit `1` with
+    `free(): invalid pointer` after it has already written a correct bounded
+    index
+  - the analyze wrapper now follows that non-zero exit with a local `status`
+    proof and treats the run as successful when the indexed commit matches the
+    current bounded mirror commit and the local status check is green
 - always uses `--skip-agents-md` so HyperTwist authority files are not
   rewritten just to refresh analysis state
 - `scripts/run-hypertwist-gitnexus-status.sh` is now hygiene-aware by default:
@@ -291,6 +308,42 @@ Additional follow-up after the protected website hardening continuation:
   - `scripts/run-hypertwist-gitnexus-status.sh` then reported the bounded
     mirror `Status: up-to-date`
 
+Later same-family ownership follow-up on `2026-06-30`:
+
+- `scripts/bootstrap-hypertwist-gitnexus.sh --if-missing` now materializes a
+  repo-owned GitNexus runtime under `tools/gitnexus/runtime/`
+- the repo-owned runtime deliberately installs dependencies with
+  `--ignore-scripts` and then runs `npm rebuild` so host-correct native
+  payloads are refreshed without forcing a fresh retained-source TypeScript
+  rebuild of GitNexus itself
+- the retained local mirror on this host still fails the raw
+  `@ladybugdb/core` probe with:
+  `ERR_DLOPEN_FAILED ... invalid ELF header`
+- local CLI resolution now prefers the repo-owned runtime and only consults the
+  retained mirror after the owned runtime plus auto-bootstrap path
+- `scripts/run-hypertwist-gitnexus-analyze.sh` now completes locally on this
+  Linux host without dropping to `npx`:
+  - the fresh local analyze run still exits `1` after indexing because of the
+    current post-index `free(): invalid pointer` quirk
+  - the wrapper now confirms the fresh index with a follow-up local `status`
+    call and treats that exact case as success
+  - validated `2026-06-30` local run:
+    `Indexed commit: 609255d (local CLI, post-index non-zero exit).`
+- `scripts/run-hypertwist-gitnexus-status.sh` then reported:
+  - `Status: up-to-date`
+  - `Indexed commit: 609255d`
+- `scripts/run-hypertwist-sentrux-source-only.sh` stayed green at:
+  - `Quality: 6248`
+- `scripts/run-hypertwist-web-surface-validation.sh` stayed green in the same
+  follow-up with:
+  - website focused route/auth/release suite: `14` files, `84` tests passed
+  - website deployment/readiness suite: `4` files, `34` tests passed
+  - website/server suite: `10` files, `36` tests passed
+  - successful website and `Content/Browser` builds
+  - clean website and `Content/Browser` production audits
+  - the same already-documented upstream auth-server residual:
+    `supertokens-node -> nodemailer`
+
 Latest tool refresh on `2026-06-27`:
 
 - the same bounded refactor loop stayed healthy through the shared-auth

docs/v6_5_deep_manual_pack/HyperTwist/DEVELOPMENT.md

@@ -33,6 +33,7 @@ HyperTwist now has its own bounded refactor/analyzer entry points:
 
 - `scripts/run-hypertwist-sentrux-source-only.sh`
 - `scripts/run-hypertwist-sentrux-gate.sh`
+- `scripts/bootstrap-hypertwist-gitnexus.sh`
 - `scripts/run-hypertwist-gitnexus-analyze.sh`
 - `scripts/run-hypertwist-gitnexus-status.sh`
 - `scripts/run-hypertwist-web-surface-validation.sh`
@@ -47,9 +48,32 @@ Use them with this posture:
   shipped product dependency
 - HyperTwist should ignore generated `.gitnexus/` index state and the
   disposable `.gitnexus-source-only-root/` mirror in git hygiene
+- HyperTwist should also ignore the repo-owned GitNexus runtime landing zone at
+  `tools/gitnexus/runtime/`; it exists so analyzer execution can stay local to
+  HyperTwist without turning installed node payloads into tracked product state
 - the retained `mirrors/GitNexus` working reference already includes the newer
   stack-overflow prevention and cycle-hardening work recorded in its
   `CHANGELOG.md`
+- the current `2026-06-30` ownership follow-up now gives GitNexus the same
+  repo-owned recovery posture as `sentrux`:
+  - `scripts/bootstrap-hypertwist-gitnexus.sh` seeds a repo-owned runtime under
+    `tools/gitnexus/runtime/` from the retained working reference
+  - the bootstrap intentionally installs dependencies with
+    `--ignore-scripts`, then runs `npm rebuild`, because HyperTwist only needs
+    the retained shipped CLI plus host-correct native payloads and should not
+    force a fresh retained-source TypeScript rebuild during ordinary recovery
+  - local CLI resolution now prefers
+    `HYPERTWIST_GITNEXUS_RUNTIME_DIR`, then the repo-owned runtime under
+    `tools/gitnexus/runtime/gitnexus`, then an auto-bootstrap attempt through
+    `scripts/bootstrap-hypertwist-gitnexus.sh --if-missing`, then the retained
+    mirror runtime, then the truthful `npx gitnexus@latest` fallback
+  - the current Linux host still exhibits an upstream-looking fresh-analyze
+    quirk where the repo-owned local CLI can exit `1` with
+    `free(): invalid pointer` after it has already written a correct index
+  - `scripts/run-hypertwist-gitnexus-analyze.sh` now hardens exactly that case:
+    when the local CLI exits non-zero after indexing the current bounded mirror
+    and a follow-up local `status` confirms the fresh index, HyperTwist treats
+    the run as successful instead of needlessly falling back to `npx`
 - `HYPERTWIST_GITNEXUS_SKIP_LOCAL_CLI=1` can force the GitNexus wrappers to
   skip the retained local CLI and go straight to the `npx` fallback on hosts
   where the local mirror runtime is known to be unusable
@@ -188,6 +212,39 @@ Current bounded refactor-tool truth after the `2026-06-24` follow-up:
     bootstrapped HyperTwist-local analyzer binary instead of directly executing
     a sibling-repo fallback during ordinary runs
 
+Later same-family refactor-tool ownership continuation on `2026-06-30`:
+
+- `scripts/bootstrap-hypertwist-gitnexus.sh --if-missing` now materializes a
+  HyperTwist-owned GitNexus runtime under `tools/gitnexus/runtime/`
+- on this Linux host, the retained mirror still fails the raw
+  `@ladybugdb/core` probe with:
+  `ERR_DLOPEN_FAILED ... invalid ELF header`
+- local CLI resolution now returns the repo-owned runtime path first instead of
+  probing only the retained mirror
+- `scripts/run-hypertwist-gitnexus-analyze.sh` now completes locally on this
+  host without dropping to `npx`:
+  - the fresh local analyze run still exits `1` after indexing because of the
+    current post-index `free(): invalid pointer` quirk
+  - the wrapper now confirms the fresh index with a follow-up local `status`
+    call and treats that exact case as success
+  - the validated `2026-06-30` local run reported:
+    `Indexed commit: 609255d (local CLI, post-index non-zero exit).`
+- `scripts/run-hypertwist-gitnexus-status.sh` then reported:
+  - `Status: up-to-date`
+  - `Indexed commit: 609255d`
+- `scripts/run-hypertwist-sentrux-source-only.sh` stayed green at:
+  - `Quality: 6248`
+- `scripts/run-hypertwist-web-surface-validation.sh` also stayed green in the
+  same follow-up with:
+  - website focused route/auth/release suite: `14` files, `84` tests passed
+  - website deployment/readiness suite: `4` files, `34` tests passed
+  - website/server suite: `10` files, `36` tests passed
+  - successful website build
+  - successful `Content/Browser` verify/build
+  - clean website and `Content/Browser` production audits
+  - the same already-documented upstream auth-server residual:
+    `supertokens-node -> nodemailer`
+
 Latest same-day follow-up later on `2026-06-24`:
 
 - the shared product-surface authority matrix landed across the homepage,

scripts/bootstrap-hypertwist-gitnexus.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+runtime_root="$repo_root/tools/gitnexus/runtime"
+runtime_gitnexus="$runtime_root/gitnexus"
+runtime_shared="$runtime_root/gitnexus-shared"
+retained_root="${HYPERTWIST_GITNEXUS_SOURCE_ROOT:-$repo_root/mirrors/GitNexus}"
+retained_gitnexus="$retained_root/gitnexus"
+retained_shared="$retained_root/gitnexus-shared"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/bootstrap-hypertwist-gitnexus.sh [--if-missing]
+
+Materializes a HyperTwist-owned GitNexus runtime under tools/gitnexus/runtime/
+from the retained GitNexus working reference.
+
+Behavior:
+  - copies gitnexus + gitnexus-shared into the local runtime landing zone
+  - removes copied node_modules so host-correct native dependencies are rebuilt
+  - installs gitnexus-shared first, then gitnexus, while intentionally
+    skipping the retained root prepare rebuild because HyperTwist only needs
+    the shipped CLI plus host-correct dependency payloads
+  - runs npm rebuild afterward so native dependency hooks refresh for the
+    current host without forcing a fresh retained-source TypeScript compile
+  - verifies that @ladybugdb/core loads successfully before declaring success
+
+Options:
+  --if-missing  exits early only when the repo-owned runtime is already usable;
+                otherwise repairs/rebuilds it in place
+EOF
+}
+
+probe_runtime() {
+  local runtime_dir="$1"
+  local cli_path="$runtime_dir/dist/cli/index.js"
+
+  if [[ ! -f "$cli_path" ]]; then
+    return 1
+  fi
+
+  local probe_output=""
+  local probe_exit=0
+
+  set +e
+  probe_output="$(
+    cd "$runtime_dir" &&
+    node --input-type=module -e 'try { await import("@ladybugdb/core"); } catch (error) { const code = error?.code ? `${error.code}: ` : ""; const message = error?.message || String(error); console.error(`${code}${message}`); process.exit(1); }' 2>&1
+  )"
+  probe_exit=$?
+  set -e
+
+  if [[ "$probe_exit" -eq 0 ]]; then
+    return 0
+  fi
+
+  probe_output="${probe_output//$'\n'/ }"
+  echo "Repo-owned GitNexus runtime is not usable yet (${probe_output})." >&2
+  return 1
+}
+
+copy_runtime_sources() {
+  if [[ ! -d "$retained_gitnexus" || ! -d "$retained_shared" ]]; then
+    cat >&2 <<EOF
+Unable to find the retained GitNexus sources needed for bootstrap.
+
+Expected:
+  - $retained_gitnexus
+  - $retained_shared
+
+Provide HYPERTWIST_GITNEXUS_SOURCE_ROOT or restore the retained working
+reference before bootstrapping the HyperTwist-owned runtime.
+EOF
+    exit 1
+  fi
+
+  rm -rf "$runtime_gitnexus" "$runtime_shared"
+  mkdir -p "$runtime_root"
+
+  (
+    cd "$retained_root"
+    tar \
+      --exclude='gitnexus/node_modules' \
+      --exclude='gitnexus-shared/node_modules' \
+      --exclude='gitnexus/.git' \
+      --exclude='gitnexus-shared/.git' \
+      -cf - gitnexus gitnexus-shared
+  ) | (
+    cd "$runtime_root"
+    tar -xf -
+  )
+}
+
+install_runtime() {
+  if ! command -v npm >/dev/null 2>&1; then
+    echo "npm is required to bootstrap the repo-owned GitNexus runtime." >&2
+    exit 1
+  fi
+
+  echo "Bootstrapping repo-owned GitNexus runtime under $runtime_root"
+  echo "Installing gitnexus-shared dependencies..."
+  (cd "$runtime_shared" && npm install --legacy-peer-deps --no-fund --no-audit --ignore-scripts)
+  echo "Installing gitnexus dependencies..."
+  (cd "$runtime_gitnexus" && npm install --legacy-peer-deps --no-fund --no-audit --ignore-scripts)
+  echo "Rebuilding GitNexus native/runtime dependencies for this host..."
+  (cd "$runtime_gitnexus" && npm rebuild --legacy-peer-deps --no-fund --no-audit)
+}
+
+if [[ "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+if [[ "${1:-}" == "--if-missing" ]]; then
+  if probe_runtime "$runtime_gitnexus" >/dev/null 2>&1; then
+    printf 'Repo-owned GitNexus runtime already present under %s\n' "$runtime_root"
+    exit 0
+  fi
+elif [[ $# -gt 0 ]]; then
+  usage >&2
+  exit 1
+fi
+
+copy_runtime_sources
+install_runtime
+
+if ! probe_runtime "$runtime_gitnexus"; then
+  echo "Repo-owned GitNexus runtime bootstrap finished, but the runtime probe still failed." >&2
+  exit 1
+fi
+
+printf 'Repo-owned GitNexus runtime is ready under %s\n' "$runtime_root"

scripts/lib-hypertwist-gitnexus.sh

@@ -1,25 +1,34 @@
 #!/usr/bin/env bash
 
-hypertwist_gitnexus_probe_local_runtime() {
+hypertwist_gitnexus_repo_root() {
-  local repo_root="$1"
+  cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd
-  local local_gitnexus_dir="$repo_root/mirrors/GitNexus/gitnexus"
+}
-  local local_gitnexus_cli="$local_gitnexus_dir/dist/cli/index.js"
+
+hypertwist_gitnexus_repo_runtime_dir() {
+  local repo_root="${1:-$(hypertwist_gitnexus_repo_root)}"
+  printf '%s\n' "${HYPERTWIST_GITNEXUS_RUNTIME_DIR:-$repo_root/tools/gitnexus/runtime/gitnexus}"
+}
+
+hypertwist_gitnexus_retained_runtime_dir() {
+  local repo_root="${1:-$(hypertwist_gitnexus_repo_root)}"
+  printf '%s\n' "$repo_root/mirrors/GitNexus/gitnexus"
+}
+
+hypertwist_gitnexus_probe_runtime_dir() {
+  local runtime_dir="$1"
+  local runtime_label="$2"
+  local local_gitnexus_cli="$runtime_dir/dist/cli/index.js"
 
   if [[ ! -f "$local_gitnexus_cli" ]]; then
     return 1
   fi
 
-  if [[ "${HYPERTWIST_GITNEXUS_SKIP_LOCAL_CLI:-0}" == "1" ]]; then
-    echo "Skipping local retained GitNexus CLI because HYPERTWIST_GITNEXUS_SKIP_LOCAL_CLI=1." >&2
-    return 1
-  fi
-
   local probe_output=""
   local probe_exit=0
 
   set +e
   probe_output="$(
-    cd "$local_gitnexus_dir" &&
+    cd "$runtime_dir" &&
     node --input-type=module -e 'try { await import("@ladybugdb/core"); } catch (error) { const code = error?.code ? `${error.code}: ` : ""; const message = error?.message || String(error); console.error(`${code}${message}`); process.exit(1); }' 2>&1
   )"
   probe_exit=$?
@@ -30,6 +39,43 @@ hypertwist_gitnexus_probe_local_runtime() {
   fi
 
   probe_output="${probe_output//$'\n'/ }"
-  echo "Local retained GitNexus runtime is not usable on this host (${probe_output}). Falling back to npx gitnexus@latest." >&2
+  echo "${runtime_label} is not usable on this host (${probe_output})." >&2
+  return 1
+}
+
+hypertwist_gitnexus_resolve_local_cli() {
+  local repo_root="${1:-$(hypertwist_gitnexus_repo_root)}"
+  local bootstrap_script="$repo_root/scripts/bootstrap-hypertwist-gitnexus.sh"
+  local repo_runtime_dir
+  repo_runtime_dir="$(hypertwist_gitnexus_repo_runtime_dir "$repo_root")"
+  local retained_runtime_dir
+  retained_runtime_dir="$(hypertwist_gitnexus_retained_runtime_dir "$repo_root")"
+  local repo_runtime_cli="$repo_runtime_dir/dist/cli/index.js"
+  local retained_runtime_cli="$retained_runtime_dir/dist/cli/index.js"
+
+  if [[ "${HYPERTWIST_GITNEXUS_SKIP_LOCAL_CLI:-0}" == "1" ]]; then
+    echo "Skipping local GitNexus CLIs because HYPERTWIST_GITNEXUS_SKIP_LOCAL_CLI=1." >&2
+    return 1
+  fi
+
+  if hypertwist_gitnexus_probe_runtime_dir "$repo_runtime_dir" "Repo-owned GitNexus runtime"; then
+    printf '%s\n' "$repo_runtime_cli"
+    return 0
+  fi
+
+  if [[ -x "$bootstrap_script" ]]; then
+    "$bootstrap_script" --if-missing >/dev/null 2>&1 || true
+    if hypertwist_gitnexus_probe_runtime_dir "$repo_runtime_dir" "Repo-owned GitNexus runtime"; then
+      printf '%s\n' "$repo_runtime_cli"
+      return 0
+    fi
+  fi
+
+  if hypertwist_gitnexus_probe_runtime_dir "$retained_runtime_dir" "Retained GitNexus runtime"; then
+    printf '%s\n' "$retained_runtime_cli"
+    return 0
+  fi
+
+  echo "No usable local GitNexus runtime is available. Falling back to npx gitnexus@latest." >&2
   return 1
 }

scripts/run-hypertwist-gitnexus-analyze.sh

@@ -3,7 +3,6 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "$repo_root/scripts/lib-hypertwist-gitnexus.sh"
-local_gitnexus_cli="$repo_root/mirrors/GitNexus/gitnexus/dist/cli/index.js"
 analysis_root="$repo_root/.gitnexus-source-only-root"
 max_size_kb="${HYPERTWIST_GITNEXUS_MAX_FILE_SIZE_KB:-256}"
 analysis_timeout_seconds="${HYPERTWIST_GITNEXUS_ANALYZE_TIMEOUT_SECONDS:-300}"
@@ -99,6 +98,14 @@ run_analysis_attempt() {
     fi
   fi
 
+  if [[ "$cli_kind" == "local" && -n "$indexed_commit" && "$indexed_commit" == "$current_commit" ]]; then
+    if node "$local_gitnexus_cli" status >/dev/null 2>&1; then
+      echo "Local GitNexus analyze exited with code $analysis_exit_code after indexing the current bounded mirror, but follow-up status confirmed the fresh index; treating the run as successful." >&2
+      echo "Indexed commit: ${indexed_commit:0:7} (local CLI, post-index non-zero exit)." >&2
+      return 0
+    fi
+  fi
+
   if [[ -n "$indexed_commit" ]]; then
     echo "GitNexus analyze exited with code $analysis_exit_code after indexing commit ${indexed_commit:0:7}, which did not match current mirror commit ${current_commit:0:7}." >&2
   else
@@ -110,7 +117,6 @@ run_analysis_attempt() {
 
 local_cli_command=(
   node
-  "$local_gitnexus_cli"
   analyze
   .
   --skip-agents-md
@@ -129,8 +135,15 @@ local_cli_command+=("$@")
 npx_cli_command+=("$@")
 
 local_cli_available=0
-if hypertwist_gitnexus_probe_local_runtime "$repo_root"; then
+if local_gitnexus_cli="$(hypertwist_gitnexus_resolve_local_cli "$repo_root")"; then
   local_cli_available=1
+  local_cli_command=(
+    node
+    "$local_gitnexus_cli"
+    analyze
+    .
+    --skip-agents-md
+  )
 fi
 
 if [[ "$local_cli_available" -eq 1 ]]; then

scripts/run-hypertwist-gitnexus-status.sh

@@ -3,7 +3,6 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "$repo_root/scripts/lib-hypertwist-gitnexus.sh"
-local_gitnexus_cli="$repo_root/mirrors/GitNexus/gitnexus/dist/cli/index.js"
 analysis_root="$repo_root/.gitnexus-source-only-root"
 analysis_meta_path="$analysis_root/.gitnexus/meta.json"
 require_index="${HYPERTWIST_GITNEXUS_STATUS_REQUIRE_INDEX:-0}"
@@ -36,7 +35,7 @@ fi
 cd "$analysis_root"
 
 local_cli_available=0
-if hypertwist_gitnexus_probe_local_runtime "$repo_root"; then
+if local_gitnexus_cli="$(hypertwist_gitnexus_resolve_local_cli "$repo_root")"; then
   local_cli_available=1
 fi
 

tools/gitnexus/runtime/.gitkeep

@@ -0,0 +1 @@
+

website/README.md

@@ -187,9 +187,21 @@ run the bounded Playwright public-route and protected-route viewport checks.
 
 Repo-owned structural-tool posture:
 
+- `scripts/bootstrap-hypertwist-gitnexus.sh` now gives HyperTwist a repo-owned
+  GitNexus runtime landing zone under `tools/gitnexus/runtime/`
 - `scripts/run-hypertwist-sentrux-source-only.sh` still prefers
   `HYPERTWIST_SENTRUX_BINARY`, repo-local `./sentrux` or `./sentrux.exe`, then
   `tools/sentrux/bin/`, then `PATH`
+- `scripts/run-hypertwist-gitnexus-analyze.sh` and
+  `scripts/run-hypertwist-gitnexus-status.sh` now prefer the repo-owned
+  GitNexus runtime under `tools/gitnexus/runtime/gitnexus`, auto-bootstrap it
+  through `scripts/bootstrap-hypertwist-gitnexus.sh --if-missing`, then only
+  fall back to the retained mirror and finally `npx gitnexus@latest` if no
+  usable local runtime exists
+- the current Linux host still shows a fresh-local-analyze post-index quirk
+  (`free(): invalid pointer` after a correct index write), so the analyze
+  wrapper now treats that exact case as success when the follow-up local status
+  proof confirms the fresh index instead of needlessly dropping to `npx`
 - `scripts/run-hypertwist-sentrux-gate.sh` now gives the website lane the same
   bounded source-only before/after regression loop through the HyperTwist-owned
   mirror and a persisted repo baseline at
@@ -199,6 +211,25 @@ Repo-owned structural-tool posture:
   HyperTwist analyzer recovery does not silently drift back into cross-repo
   ownership
 
+Latest refactor-tool ownership follow-up on `2026-06-30`:
+
+- `scripts/run-hypertwist-gitnexus-analyze.sh` now completes locally on this
+  host through the repo-owned GitNexus runtime path and the new post-index
+  salvage check instead of defaulting back to `npx`
+- `scripts/run-hypertwist-gitnexus-status.sh` then reports the bounded mirror
+  up to date from that same repo-owned runtime path
+- `scripts/run-hypertwist-sentrux-source-only.sh` stayed green at:
+  - `Quality: 6248`
+- the full owned web-surface umbrella also stayed green again under:
+  - `scripts/run-hypertwist-web-surface-validation.sh`
+  - focused website route/auth/release suite: `14` files, `84` tests passed
+  - deployment/readiness tooling suite: `4` files, `34` tests passed
+  - website/server suite: `10` files, `36` tests passed
+  - successful website and `Content/Browser` production builds
+  - clean website and `Content/Browser` production audits
+  - the same already-documented upstream auth-server residual:
+    `supertokens-node -> nodemailer`
+
 Latest auth-shell hardening follow-up on `2026-06-24`:
 
 - the website now carries a first-party HyperTwist auth-shell backdrop module