chore(gates): give freerange a reference-free tsconfig view of the root program

Repo Guards -> 'Check numeric ranges' OOMed (exit 134, ~4 GB) on both
pushed heads. Cause (#3289 CI diagnosis): freerange's loader walks the
resolved tsconfig's projectReferences recursively and keeps every
project's ts.Program alive simultaneously. On main the root config had
no references, so fr loaded one program (~87s, green). With the #3279
references graph it loads 26 programs / 13,461 file slots and ~2.8 GB
heap BEFORE analysis begins; Node's default 4 GB heap dies. Removing
only the root references array makes the gate pass (112s); upstream
0.0.5 bundles the same loader, so this is not a version to pin away.

Fix at the config, not the heap: scripts/freerange/tsconfig.json extends
the root tsconfig — and 'extends' does not inherit references (planted
with --showConfig) — so 'fr' gets exactly the single root program it
analyzed on main (verified: byte-identical findings and coverage,
971/13495 fully analyzed). tsc -b keeps using the real graph.
check:freerange now runs fr from that directory; the reference-free and
extends-to-root properties are pinned by a guard test with the OOM as
its mutation.

Author: thymikee

package.json

@@ -170,7 +170,7 @@
     "check:packaged-runner-swift": "node --experimental-strip-types scripts/check-packaged-runner-swift.ts",
     "check:tmpdir-leaks": "node --experimental-strip-types scripts/check-tmpdir-leaks.ts",
     "check:tmpdir-leaks:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test --test-concurrency=1 scripts/check-tmpdir-leaks-model.test.ts scripts/vitest-tmpdir-global-setup.test.ts scripts/node-test-tmpdir.test.ts scripts/swift-toolchain-tmpdir.test.ts",
-    "check:freerange": "fr",
+    "check:freerange": "cd scripts/freerange && fr",
     "check:quick": "pnpm lint && pnpm typecheck",
     "sync:mcp-metadata": "node scripts/sync-mcp-metadata.mjs",
     "check:mcp-metadata": "node scripts/sync-mcp-metadata.mjs --check",

scripts/freerange/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  // Freerange's own view of the root program (#3289 CI OOM). `fr` resolves a tsconfig from the
+  // process cwd and then loads EVERY `references` project as a full simultaneous ts.Program —
+  // 26 programs / ~13.5k file slots / >2.8 GB heap before its analysis even starts — so running
+  // it from the repo root against the reference-bearing tsconfig.json exhausts Node's default
+  // 4 GB heap (exit 134). `extends` does not inherit `references`, so this file hands fr the
+  // single root program (includes and options resolve through the base config below, and
+  // package sources still reach the program transitively through the exports-map `.ts` targets
+  // exactly as they did before project references existed) while `tsc -b` keeps using the real
+  // graph. Keep this config reference-free: adding `references` here reintroduces the OOM.
+  "extends": "../../tsconfig.json"
+}

scripts/layering/project-references.test.ts

@@ -66,6 +66,21 @@ test('the root manifest declares every workspace package as a workspace dependen
   );
 });
 
+test('the freerange config stays a reference-free view of the root program', () => {
+  // `fr` loads every `references` project as a full simultaneous ts.Program (~26 programs,
+  // >2.8 GB heap before analysis) and OOMs Node's default 4 GB on this workspace (#3289 CI).
+  // The wrapper at scripts/freerange/tsconfig.json exists only because `extends` does not
+  // inherit references (planted with --showConfig); if someone adds references to it, the
+  // gate reintroduces the OOM, so the absence is pinned here rather than trusted to the comment.
+  const config = readTsconfig('scripts/freerange/tsconfig.json');
+  assert.equal(config.references, undefined, 'references on the freerange config OOM gate');
+  assert.equal(
+    config.extends,
+    '../../tsconfig.json',
+    'the freerange view must stay the root program itself (no include/exclude drift)',
+  );
+});
+
 test('every package tsconfig references exactly its manifest workspace dependencies', () => {
   // The per-package half of the same single-source-of-truth claim (#3279 requirement 1):
   // references are DERIVED from the manifest DAG, so an import a manifest gains must add the