instar 1.3.1143 → 1.3.1144

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143",
+  "packageVersion": "1.3.1144",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
+  "sha256": "a01cf44f29d7c2c5e2bc284dbcd18e27b5c4d6035f3fee7b8e8254e8a993cf2d",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1144"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1144"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1143",
+  "version": "1.3.1144",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unfunneled-headless-launch.js

@@ -14,23 +14,80 @@
  *
  * Rule: outside the allowlist below, no source file may reference
  * `buildHeadlessLaunch` (import OR call — an import is the bypass's first
- * commit, flag it at the door).
+ * commit, flag it at the door), NOR any name an allowlisted module hands out
+ * that resolves to it.
+ *
+ * ── Evasion resistance (2026-08-14) ──────────────────────────────────────
+ * A peer audit classed this check DEFEATABLE and SAFETY-FLOOR, with this
+ * bypass stated verbatim: "Export a wrapper or alias from an allowlisted
+ * module, then call makeHeadlessLaunch(...) elsewhere; the non-funnel launch
+ * path is real, but the name is gone."
+ *
+ * Both halves were reproduced against the shipped check before this change,
+ * with a positive control caught in the same run:
+ *
+ *   // in src/core/frameworkSessionLaunch.ts — ALLOWLISTED, so free
+ *   export const makeHeadlessLaunch = buildHeadlessLaunch;
+ *   // anywhere else — shipped lint said "clean", exit 0
+ *   import { makeHeadlessLaunch } from './frameworkSessionLaunch.js';
+ *   makeHeadlessLaunch(fw, opts);
+ *
+ *   import * as m from './frameworkSessionLaunch.js';   // computed + split literal
+ *   const fn = m['buildHeadless' + 'Launch'];
+ *   fn(fw, opts);
+ *
+ * The first was reproduced end-to-end in the real tree: a live non-funnel
+ * launch path existed while this script printed `clean`.
+ *
+ * The close has two parts. Locally, bindings resolve to a fixpoint (aliased
+ * import, `{ X: Alias }` destructure, `const C = X` re-binding, namespace
+ * member, computed access over a collapsed concatenation). Across modules,
+ * the CLOSED allowlist is parsed for names it hands out that resolve to the
+ * builder, and those names are guarded at any non-allowlisted importer.
+ *
+ * ── What this deliberately does NOT classify as an alias ─────────────────
+ * Only a DIRECT re-binding (`export const X = buildHeadlessLaunch`,
+ * `export { buildHeadlessLaunch as X }`) or a PASS-THROUGH wrapper (a single
+ * `return buildHeadlessLaunch(...)`) counts. An exported function that does
+ * real work around the builder is NOT an alias — that is precisely the shape
+ * of the funnel itself, so treating it as one would flag every caller of
+ * `SessionManager.spawnSession()`. This check blocks commits; a widening that
+ * flags correct code is worse than the hole, because a noisy check gets
+ * switched off. The boundary is drawn there on purpose.
+ *
+ * ── Residuals, named rather than left to be discovered ───────────────────
+ *   - A NON-pass-through wrapper in an allowlisted module (two statements
+ *     instead of one) is not an alias. This is the price of the rule above.
+ *   - A computed member resolved at RUNTIME (`m[process.env.K]`) cannot be
+ *     read statically.
+ *   - Re-assignment after declaration (`let mk; mk = buildHeadlessLaunch;`)
+ *     is caught at the ASSIGNMENT, not at the later call.
+ *   - A consumer importing an alias through a BARREL is not itself checked —
+ *     but the barrel is not allowlisted, so re-exporting the alias through it
+ *     fails here first; the chain cannot be built without tripping this.
+ * All four are pinned by tests asserting exactly this, so the boundary is
+ * documented rather than assumed.
  *
  * Exit codes: 0 — clean; 1 — at least one violation.
  *
  * Usage:
  *   node scripts/lint-no-unfunneled-headless-launch.js            # full repo
  *   node scripts/lint-no-unfunneled-headless-launch.js --staged   # staged files
+ *   node scripts/lint-no-unfunneled-headless-launch.js <file…>    # explicit files (tests)
  */
 
 import fs from 'node:fs';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
 
 const __filename = fileURLToPath(import.meta.url);
 const ROOT = path.resolve(path.dirname(__filename), '..');
 
+/** The one name the funnel is built on. Every other guarded name derives from it. */
+export const CANONICAL = 'buildHeadlessLaunch';
+
 // ── Allowlist (closed). Adding an entry requires review of WHY the callsite
 //    cannot route through SessionManager.spawnSession() (where the
 //    subscription-path reroute lives), and how its post-June-15 billing is
@@ -51,11 +108,233 @@ const ALLOWLIST = new Set([
 const SCAN_DIRS = ['src', 'scripts', 'templates'];
 const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs', '.sh']);
 
-const PATTERNS = [
-  // Any reference — import, re-export, or call. An import IS the violation:
-  // there is no legitimate non-funnel consumer of the headless builder.
-  /\bbuildHeadlessLaunch\b/,
-];
+const VIOLATION_MSG =
+  `direct ${CANONICAL} reference outside the subscription-path funnel. ` +
+  `Spawn through SessionManager.spawnSession() (which carries the June-15 reroute), ` +
+  `or add an allowlist entry here with a billing-accountability justification.`;
+
+const aliasMsg = (name, from) =>
+  `'${name}' resolves to ${CANONICAL} (handed out by ${from}) — reaching the headless ` +
+  `builder under another name is the same bypass of the subscription-path funnel. ` +
+  `Spawn through SessionManager.spawnSession(), or add an allowlist entry here with a ` +
+  `billing-accountability justification.`;
+
+/** Comment lines are documentation, not a bypass — code cannot call through one. */
+export function isCommentLine(line) {
+  const t = line.trimStart();
+  return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('#');
+}
+
+/**
+ * Collapse simple adjacent string concatenation so `'A' + 'B'` reads as `AB`.
+ * Applied PER LINE so reported line numbers stay exact.
+ */
+export function collapseConcatenation(text) {
+  let out = text;
+  for (let i = 0; i < 5; i++) {
+    const next = out.replace(/(['"`])\s*\+\s*(['"`])/g, '');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+const basenameKey = (p) => path.basename(p).replace(/\.(ts|tsx|js|mjs|cjs)$/, '');
+
+// ── Cross-module: what names does the closed allowlist hand out? ──────────
+
+/** Is this expression the guarded builder itself (identifier or namespace member)? */
+function denotesGuarded(node, known) {
+  if (!node) return false;
+  if (ts.isIdentifier(node)) return known.has(node.text);
+  if (ts.isPropertyAccessExpression(node)) return known.has(node.name.text);
+  if (ts.isElementAccessExpression(node)) {
+    const a = node.argumentExpression;
+    return !!a && ts.isStringLiteralLike(a) && known.has(a.text);
+  }
+  if (ts.isParenthesizedExpression(node)) return denotesGuarded(node.expression, known);
+  if (ts.isAsExpression(node) || ts.isTypeAssertionExpression?.(node)) {
+    return denotesGuarded(node.expression, known);
+  }
+  return false;
+}
+
+/** A body that is nothing but `return <guarded>(...)` — a pass-through wrapper. */
+function isPassThroughBody(body, known) {
+  if (!body) return false;
+  if (ts.isCallExpression(body)) return denotesGuarded(body.expression, known); // arrow shorthand
+  if (!ts.isBlock(body) || body.statements.length !== 1) return false;
+  const only = body.statements[0];
+  if (!ts.isReturnStatement(only) || !only.expression) return false;
+  return ts.isCallExpression(only.expression) && denotesGuarded(only.expression.expression, known);
+}
+
+const isExported = (node) =>
+  !!node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+
+/**
+ * Names each allowlisted module hands out that resolve to the builder.
+ *
+ * `sources` is [{ path, content }]. Returns Map<aliasName, sourcePath>, run to
+ * a fixpoint across files so an allowlisted module re-exporting ANOTHER
+ * allowlisted module's alias closes too.
+ */
+export function collectFunnelAliasExports(sources) {
+  const aliases = new Map();
+  for (let pass = 0; pass < 10; pass++) {
+    const before = aliases.size;
+    for (const { path: p, content } of sources) {
+      let sf;
+      try {
+        sf = ts.createSourceFile(p, content, ts.ScriptTarget.Latest, true);
+      } catch {
+        continue;
+      }
+      // Names bound to the builder INSIDE this module, to a fixpoint.
+      const known = new Set([CANONICAL, ...aliases.keys()]);
+      for (let inner = 0; inner < 10; inner++) {
+        const size = known.size;
+        const seed = (n) => {
+          if (ts.isImportSpecifier(n) && known.has((n.propertyName ?? n.name).text)) {
+            known.add(n.name.text);
+          }
+          if (ts.isVariableDeclaration(n) && ts.isIdentifier(n.name) && denotesGuarded(n.initializer, known)) {
+            known.add(n.name.text);
+          }
+          ts.forEachChild(n, seed);
+        };
+        ts.forEachChild(sf, seed);
+        if (known.size === size) break;
+      }
+
+      const record = (name) => {
+        if (name && name !== CANONICAL && !aliases.has(name)) aliases.set(name, p);
+      };
+      const visit = (n) => {
+        // export const X = <guarded>;   /  export const X = (...) => <guarded>(...)
+        if (ts.isVariableStatement(n) && isExported(n)) {
+          for (const d of n.declarationList.declarations) {
+            if (!ts.isIdentifier(d.name) || !d.initializer) continue;
+            if (denotesGuarded(d.initializer, known)) record(d.name.text);
+            else if (
+              (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer)) &&
+              isPassThroughBody(d.initializer.body, known)
+            ) record(d.name.text);
+          }
+        }
+        // export function X(...) { return <guarded>(...); }
+        if (ts.isFunctionDeclaration(n) && isExported(n) && n.name && isPassThroughBody(n.body, known)) {
+          record(n.name.text);
+        }
+        // export { A as B };  /  export { A as B } from '...';
+        if (ts.isExportDeclaration(n) && n.exportClause && ts.isNamedExports(n.exportClause)) {
+          for (const el of n.exportClause.elements) {
+            if (known.has((el.propertyName ?? el.name).text)) record(el.name.text);
+          }
+        }
+        ts.forEachChild(n, visit);
+      };
+      ts.forEachChild(sf, visit);
+    }
+    if (aliases.size === before) break;
+  }
+  return aliases;
+}
+
+// ── Per-file: local bindings, resolved to a fixpoint ─────────────────────
+
+/** Named specifiers imported (or re-exported) in `content`, with their offsets. */
+function importSpecifiers(content) {
+  const out = [];
+  const re = /(?:import|export)\s*(?:type\s+)?(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+  for (const m of content.matchAll(re)) {
+    const body = m[1];
+    const bodyStart = m.index + m[0].indexOf('{') + 1;
+    for (const spec of body.split(',')) {
+      const t = spec.trim();
+      if (!t) continue;
+      const parts = t.replace(/^type\s+/, '').split(/\s+as\s+/);
+      const imported = parts[0].trim();
+      const local = (parts[1] ?? parts[0]).trim();
+      if (!/^[A-Za-z_$][\w$]*$/.test(imported)) continue;
+      out.push({ imported, local, from: m[2], offset: bodyStart + body.indexOf(t) });
+    }
+  }
+  return out;
+}
+
+const lineOf = (content, offset) => content.slice(0, offset).split('\n').length;
+
+/**
+ * Local names in `content` bound to something guarded, to a fixpoint.
+ *
+ * Seeds are the canonical name plus any allowlist-exported alias that is
+ * actually IMPORTED here from the module that hands it out — a locally
+ * DEFINED function of the same name is not absorbed, which is what keeps this
+ * from flagging unrelated code.
+ */
+export function collectLocalBindings(content, aliasExports = new Map()) {
+  const names = new Set([CANONICAL]);
+  const seededAliases = [];
+  for (const spec of importSpecifiers(content)) {
+    const owner = aliasExports.get(spec.imported);
+    if (owner && basenameKey(spec.from) === basenameKey(owner)) {
+      names.add(spec.local);
+      seededAliases.push({ ...spec, owner });
+    }
+  }
+  // Local re-binding chains, incl. destructures, namespace members and
+  // computed access over a collapsed concatenation.
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const esc = known.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      const forms = [
+        // import { known as alias }  /  const { known: alias } = …
+        new RegExp(`\\b${esc}\\s*(?:as|:)\\s*([A-Za-z_$][\\w$]*)`, 'g'),
+        // const alias = known;  /  const alias = ns.known;  /  const alias = ns['known'];
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*(?:[\\w$.]*\\.)?${esc}\\s*[;,\\n)]`, 'g'),
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*[\\w$.]*\\[\\s*['"\`]${esc}['"\`]\\s*\\]`, 'g'),
+      ];
+      for (const re of forms) {
+        for (const m of collapseConcatenation(content).matchAll(re)) names.add(m[1]);
+      }
+    }
+    if (names.size === before) break;
+  }
+  return { names, seededAliases };
+}
+
+/**
+ * Violations in `content`, as { line, msg }. Exported so the rules can be
+ * driven with fixtures rather than only end-to-end over the tree.
+ */
+export function findHeadlessLaunchViolations(content, aliasExports = new Map()) {
+  const hits = [];
+  const { names, seededAliases } = collectLocalBindings(content, aliasExports);
+  // A guarded alias arriving by import is a violation AT THE DOOR, reported
+  // against the import even though the name itself is unremarkable.
+  const importLines = new Set();
+  for (const spec of seededAliases) {
+    const line = lineOf(content, spec.offset);
+    importLines.add(line);
+    hits.push({ line, msg: aliasMsg(spec.imported, path.basename(spec.owner)) });
+  }
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    if (isCommentLine(lines[i])) continue;
+    if (importLines.has(i + 1)) continue;
+    const line = collapseConcatenation(lines[i]);
+    for (const name of names) {
+      const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      if (new RegExp(`\\b${esc}\\b`).test(line) || new RegExp(`['"\`]${esc}['"\`]`).test(line)) {
+        hits.push({ line: i + 1, msg: name === CANONICAL ? VIOLATION_MSG : aliasMsg(name, 'the funnel') });
+        break;
+      }
+    }
+  }
+  return hits.sort((a, b) => a.line - b.line);
+}
 
 function listFiles() {
   const staged = process.argv.includes('--staged');
@@ -87,42 +366,54 @@ function listFiles() {
   return files;
 }
 
-let violations = 0;
-for (const rel of listFiles()) {
-  const normalized = rel.split(path.sep).join('/');
-  if (ALLOWLIST.has(normalized)) continue;
-  if (!EXTENSIONS.has(path.extname(normalized))) continue;
-  // Explicit args may be absolute (e.g. the lint's own self-test sandbox);
-  // repo-walk entries are always ROOT-relative.
-  const full = path.isAbsolute(normalized) ? normalized : path.join(ROOT, normalized);
-  let content;
-  try {
-    content = fs.readFileSync(full, 'utf-8');
-  } catch {
-    continue;
-  }
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    // Comment-only mentions are documentation, not a bypass — code can't
-    // call through a comment. (`//`, `*`, `/*` line starts and `#` for .sh.)
-    const trimmed = lines[i].trimStart();
-    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
-    for (const pattern of PATTERNS) {
-      if (pattern.test(lines[i])) {
-        console.error(
-          `${normalized}:${i + 1} — direct buildHeadlessLaunch reference outside the subscription-path funnel. ` +
-          `Spawn through SessionManager.spawnSession() (which carries the June-15 reroute), ` +
-          `or add an allowlist entry here with a billing-accountability justification.`,
-        );
-        violations++;
-      }
+/** Read the allowlisted SOURCE modules — the only places an alias can be minted. */
+export function readAllowlistSources(root = ROOT) {
+  const sources = [];
+  for (const rel of ALLOWLIST) {
+    if (!rel.startsWith('src/')) continue; // the lint script itself is not an alias source
+    try {
+      sources.push({ path: rel, content: fs.readFileSync(path.join(root, rel), 'utf-8') });
+    } catch {
+      /* a missing allowlist entry is the allowlist test's problem, not this scan's */
     }
   }
+  return sources;
 }
 
-if (violations > 0) {
-  console.error(`\nlint-no-unfunneled-headless-launch: ${violations} violation(s). ` +
-    `See docs/specs/june15-headless-spawn-reroute.md (finding F5).`);
-  process.exit(1);
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detectors can be imported by tests WITHOUT running
+// the scan: this module calls process.exit(1) on a violation, so an unguarded
+// import would kill any test run the moment the repo had one. Same pattern as
+// lint-no-unfunneled-credential-write.js and lint-telegram-egress-boundary.mjs.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
+  const aliasExports = collectFunnelAliasExports(readAllowlistSources());
+  let violations = 0;
+  for (const rel of listFiles()) {
+    const normalized = rel.split(path.sep).join('/');
+    if (ALLOWLIST.has(normalized)) continue;
+    if (!EXTENSIONS.has(path.extname(normalized))) continue;
+    // Explicit args may be absolute (e.g. the lint's own self-test sandbox);
+    // repo-walk entries are always ROOT-relative.
+    const full = path.isAbsolute(normalized) ? normalized : path.join(ROOT, normalized);
+    let content;
+    try {
+      content = fs.readFileSync(full, 'utf-8');
+    } catch {
+      continue;
+    }
+    for (const hit of findHeadlessLaunchViolations(content, aliasExports)) {
+      console.error(`${normalized}:${hit.line} — ${hit.msg}`);
+      violations++;
+    }
+  }
+
+  if (violations > 0) {
+    console.error(`\nlint-no-unfunneled-headless-launch: ${violations} violation(s). ` +
+      `See docs/specs/june15-headless-spawn-reroute.md (finding F5).`);
+    process.exit(1);
+  }
+  console.log('lint-no-unfunneled-headless-launch: clean');
 }
-console.log('lint-no-unfunneled-headless-launch: clean');

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T20:31:20.547Z",
-  "instarVersion": "1.3.1143",
+  "generatedAt": "2026-08-14T21:37:12.442Z",
+  "instarVersion": "1.3.1144",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143",
+  "packageVersion": "1.3.1144",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
+  "sha256": "a01cf44f29d7c2c5e2bc284dbcd18e27b5c4d6035f3fee7b8e8254e8a993cf2d",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1144"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1144"
 }

package/upgrades/1.3.1144.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The check that keeps every headless subprocess going through a single funnel identified that funnel by its name alone, so putting a second nameplate on it walked straight past.
+
+- **A listed file could hand the builder out under another name**, and any file could then call that name — no forbidden text anywhere, and a real non-funnel spawn path. Reproduced in the real codebase before the fix: one appended line plus one new consumer left a working bypass while the check printed **clean**.
+- **The check now follows the function, not just its name.** Inside a file, a name passed along — relabelled on import, pulled out of a bundle, copied to a variable, reached through a bracket with the text split in half — is followed until nothing new turns up. Across files, the short closed list is read for any name it hands out that leads back to the builder, and those names are guarded wherever they are imported.
+- **The widening is deliberately narrow, and that was the harder half.** Only a plain re-labelling or a one-line pass-through counts as handing the builder out. A listed file that does real work around it does not — because that is exactly what the funnel itself looks like, and counting it would have flagged every ordinary spawn in the codebase.
+- **Four remaining gaps are named in the check's own header** and pinned by tests asserting they are still open, so they read as decisions rather than oversights.
+- **Nothing new is forbidden**, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Every background process this agent starts is supposed to go through one door, because that door is where the limits are decided. A check enforced it — but only by looking for the door's name, so anyone who gave the door a second name got past without it noticing. That was real, not hypothetical: it was demonstrated on the live codebase while the check reported everything fine.
+
+It now follows the door itself rather than the label on it. The care went into not over-correcting: a check that blocks work has to stay quiet about correct work, or someone turns it off, and then it guards nothing at all.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule.
+
+## Evidence
+
+Proven in both directions. Three deliberate mutations produce three precise failures: removing the cross-file resolution fails exactly the cross-file tests, widening the handout rule fails exactly the control that guards against flagging correct code, and removing the text-splitting defence fails exactly the three forms that depend on it.
+
+That third one is worth recording, because it failed to fail the first time. The original test used a shape a different rule already caught, so it proved nothing about the line it was written for and would have shipped as false coverage. It was rewritten to three shapes with nothing else to catch them. A test that passes for the wrong reason is indistinguishable from real coverage until something depends on it.
+
+Ten opposite-direction controls hold the other side, including two that would have caught the over-correction: a real-work function in a listed file is not treated as a handout, and the live list is asserted to hand out nothing today, so a future refactor that accidentally creates one becomes visible. The source was restored byte-identical after every mutation, the real codebase lints clean before and after, and the module is now safe to import — it previously had an unguarded exit path that would have stopped a test run the moment the codebase had a violation.