instar 1.3.1143 → 1.3.1145

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143",
+  "packageVersion": "1.3.1145",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
+  "sha256": "4a5b88caa62ae256f4868735dc66735c52ae30604a8272c977ca1f4564086e43",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1145"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1145"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1143",
+  "version": "1.3.1145",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-journal-actuation-ban.js

@@ -12,8 +12,37 @@
  * separate module from the writer so this ban has a precise import target —
  * actuators MAY hold the writer (they emit), they may never read.
  *
- * Guardrail, not proof (a consumer could re-read the JSONL by hand); the
- * declared §3.9 duty is the authority, this catches the direct pattern.
+ * ── 2026-08-14: the header used to declare TWO limitations. One is now closed,
+ * one is NOT, and pretending otherwise would be the worse outcome.
+ *
+ * CLOSED — "this catches the direct pattern". The match required the `from`
+ * keyword, so `await import(...)` and `require(...)` walked straight past it.
+ * Reproduced against the shipped lint on a REAL listed actuator: it reported
+ * "clean". Now every module-loading form is matched, comments are stripped
+ * first (so a §3.9 reference in prose can never be a violation), and a
+ * runtime-erased `import type` is correctly NOT a violation.
+ *
+ * NOT CLOSED — "grow this list when a new actuator class lands". The population
+ * is still curated by hand. Automatic discovery was BUILT, MEASURED AGAINST THIS
+ * TREE, AND REJECTED on the evidence: inferring "is this an actuator?" from
+ * declared names flagged nine sites in three files, and every one was a
+ * granularity or part-of-speech error rather than a §3.9 breach —
+ *   · `src/server/routes.ts` matched on `readReaperPeerText`, `isReaperSnapshot`,
+ *     `reaperPoolHealth`: "reaper" as a NOUN in code that REPORTS ON the reaper,
+ *     which is exactly the correct-code case (a reporting surface may read).
+ *   · `src/commands/server.ts` is the 22k-line composition root — every module's
+ *     authority is wired through it, so any file-level verdict on it is wrong in
+ *     one direction or the other.
+ *   · `src/core/WorkingSetPull.ts` matched a runtime-erased `import type`.
+ * A guard that blocks commits must not rest on a heuristic with that error rate;
+ * over-blocking correct code is the more expensive failure here. What IS closed
+ * mechanically is the STALENESS half: a curated entry that no longer exists on
+ * disk means an actuator was renamed or moved and silently fell off the ban —
+ * that is now a hard failure instead of a skipped line.
+ *
+ * Still a guardrail, not a proof: a determined consumer can re-read the JSONL by
+ * hand or reach the reader through a re-export. The declared §3.9 duty is the
+ * authority; this catches the mechanical patterns.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -27,7 +56,8 @@ const ROOT = process.argv.includes('--root')
 /**
  * Actuator modules: anything holding kill/spawn/place/transfer/reap authority.
  * Grow this list when a new actuator class lands — adding here is cheap;
- * debugging a journal-driven double-kill is not.
+ * debugging a journal-driven double-kill is not. See the header for why this
+ * stays curated rather than inferred.
  */
 const ACTUATOR_FILES = [
   'src/core/SessionManager.ts',
@@ -40,17 +70,93 @@ const ACTUATOR_FILES = [
   'src/lifeline/ServerSupervisor.ts',
 ];
 
-const READER_IMPORT = /from\s+['"][^'"]*CoherenceJournalReader(\.js)?['"]/;
+/**
+ * Every way a module can LOAD the reader at runtime. The old pattern required
+ * `from`, which is precisely the token a dynamic import does not have.
+ */
+const LOADS_READER =
+  /(?:\bfrom\s+|\bimport\s*\(\s*|\brequire\s*\(\s*)['"][^'"]*CoherenceJournalReader(?:\.js)?['"]/;
+
+/**
+ * `import type { X } from '…Reader.js'` is erased at compile time — it creates
+ * no runtime coupling and therefore cannot act on stale data. Borrowing a TYPE
+ * from the reader is legal; holding the reader is not. A MIXED import such as
+ * `import { type A, CoherenceJournalReader }` does not match this and is still
+ * caught, which is correct — it pulls in the runtime binding.
+ */
+const TYPE_ONLY_IMPORT = /^\s*import\s+type\s/;
+
+/**
+ * Blank out comments, preserving length and line count so reported line numbers
+ * stay true. Quote-aware, so a `//` inside a string literal is not mistaken for
+ * a comment. This is what keeps "the reader named in a comment" legal no matter
+ * how wide the load-matching gets.
+ */
+function stripComments(src) {
+  const out = src.split('');
+  let i = 0;
+  let state = 'code'; // code | line | block | single | double | tick
+  while (i < src.length) {
+    const c = src[i];
+    const d = src[i + 1];
+    if (state === 'code') {
+      if (c === '/' && d === '/') { state = 'line'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c === '/' && d === '*') { state = 'block'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c === "'") state = 'single';
+      else if (c === '"') state = 'double';
+      else if (c === '`') state = 'tick';
+      i++; continue;
+    }
+    if (state === 'line') {
+      if (c === '\n') { state = 'code'; i++; continue; }
+      out[i] = ' '; i++; continue;
+    }
+    if (state === 'block') {
+      if (c === '*' && d === '/') { state = 'code'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c !== '\n') out[i] = ' ';
+      i++; continue;
+    }
+    // inside a string literal: honour escapes, then look for the closing quote
+    if (c === '\\') { i += 2; continue; }
+    if ((state === 'single' && c === "'") || (state === 'double' && c === '"') || (state === 'tick' && c === '`')) {
+      state = 'code';
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+/**
+ * A lint that reports "clean" because it scanned NOTHING is worse than no lint:
+ * absence is the cheapest result to obtain, and it is indistinguishable from a
+ * genuinely clean tree. Refuse to render a verdict on a root with no src/.
+ */
+if (!fs.existsSync(path.join(ROOT, 'src'))) {
+  console.error(`lint-journal-actuation-ban: no src/ under ${ROOT} — scanned nothing, so no verdict.`);
+  process.exit(2);
+}
 
 const violations = [];
+
 for (const rel of ACTUATOR_FILES) {
   const file = path.join(ROOT, rel);
-  if (!fs.existsSync(file)) continue;
-  const lines = fs.readFileSync(file, 'utf-8').split('\n');
+
+  // The staleness half of the declared-population gap: a curated actuator that
+  // is no longer here was renamed or moved, and silently left the ban behind.
+  if (!fs.existsSync(file)) {
+    violations.push(
+      `${rel}: listed actuator is missing from the tree — renamed or moved? It has silently left the §3.9 ban. Update ACTUATOR_FILES.`,
+    );
+    continue;
+  }
+
+  const lines = stripComments(fs.readFileSync(file, 'utf-8')).split('\n');
   for (let i = 0; i < lines.length; i++) {
-    if (READER_IMPORT.test(lines[i])) {
-      violations.push(`${rel}:${i + 1}: actuator imports the journal READER (forbidden by §3.9 — the journal answers questions, live systems decide)`);
-    }
+    if (!LOADS_READER.test(lines[i])) continue;
+    if (TYPE_ONLY_IMPORT.test(lines[i])) continue;
+    violations.push(
+      `${rel}:${i + 1}: actuator loads the journal READER (forbidden by §3.9 — the journal answers questions, live systems decide)`,
+    );
   }
 }
 
@@ -60,4 +166,4 @@ if (violations.length > 0) {
   console.error('\nReplicated journal data is stale by construction. Read the live store instead.');
   process.exit(1);
 }
-console.log(`lint-journal-actuation-ban: clean (${ACTUATOR_FILES.length} actuator modules, none import the reader)`);
+console.log(`lint-journal-actuation-ban: clean (${ACTUATOR_FILES.length} actuator modules, none load the reader)`);

package/scripts/lint-no-unfunneled-headless-launch.js

@@ -14,23 +14,80 @@
  *
  * Rule: outside the allowlist below, no source file may reference
  * `buildHeadlessLaunch` (import OR call — an import is the bypass's first
- * commit, flag it at the door).
+ * commit, flag it at the door), NOR any name an allowlisted module hands out
+ * that resolves to it.
+ *
+ * ── Evasion resistance (2026-08-14) ──────────────────────────────────────
+ * A peer audit classed this check DEFEATABLE and SAFETY-FLOOR, with this
+ * bypass stated verbatim: "Export a wrapper or alias from an allowlisted
+ * module, then call makeHeadlessLaunch(...) elsewhere; the non-funnel launch
+ * path is real, but the name is gone."
+ *
+ * Both halves were reproduced against the shipped check before this change,
+ * with a positive control caught in the same run:
+ *
+ *   // in src/core/frameworkSessionLaunch.ts — ALLOWLISTED, so free
+ *   export const makeHeadlessLaunch = buildHeadlessLaunch;
+ *   // anywhere else — shipped lint said "clean", exit 0
+ *   import { makeHeadlessLaunch } from './frameworkSessionLaunch.js';
+ *   makeHeadlessLaunch(fw, opts);
+ *
+ *   import * as m from './frameworkSessionLaunch.js';   // computed + split literal
+ *   const fn = m['buildHeadless' + 'Launch'];
+ *   fn(fw, opts);
+ *
+ * The first was reproduced end-to-end in the real tree: a live non-funnel
+ * launch path existed while this script printed `clean`.
+ *
+ * The close has two parts. Locally, bindings resolve to a fixpoint (aliased
+ * import, `{ X: Alias }` destructure, `const C = X` re-binding, namespace
+ * member, computed access over a collapsed concatenation). Across modules,
+ * the CLOSED allowlist is parsed for names it hands out that resolve to the
+ * builder, and those names are guarded at any non-allowlisted importer.
+ *
+ * ── What this deliberately does NOT classify as an alias ─────────────────
+ * Only a DIRECT re-binding (`export const X = buildHeadlessLaunch`,
+ * `export { buildHeadlessLaunch as X }`) or a PASS-THROUGH wrapper (a single
+ * `return buildHeadlessLaunch(...)`) counts. An exported function that does
+ * real work around the builder is NOT an alias — that is precisely the shape
+ * of the funnel itself, so treating it as one would flag every caller of
+ * `SessionManager.spawnSession()`. This check blocks commits; a widening that
+ * flags correct code is worse than the hole, because a noisy check gets
+ * switched off. The boundary is drawn there on purpose.
+ *
+ * ── Residuals, named rather than left to be discovered ───────────────────
+ *   - A NON-pass-through wrapper in an allowlisted module (two statements
+ *     instead of one) is not an alias. This is the price of the rule above.
+ *   - A computed member resolved at RUNTIME (`m[process.env.K]`) cannot be
+ *     read statically.
+ *   - Re-assignment after declaration (`let mk; mk = buildHeadlessLaunch;`)
+ *     is caught at the ASSIGNMENT, not at the later call.
+ *   - A consumer importing an alias through a BARREL is not itself checked —
+ *     but the barrel is not allowlisted, so re-exporting the alias through it
+ *     fails here first; the chain cannot be built without tripping this.
+ * All four are pinned by tests asserting exactly this, so the boundary is
+ * documented rather than assumed.
  *
  * Exit codes: 0 — clean; 1 — at least one violation.
  *
  * Usage:
  *   node scripts/lint-no-unfunneled-headless-launch.js            # full repo
  *   node scripts/lint-no-unfunneled-headless-launch.js --staged   # staged files
+ *   node scripts/lint-no-unfunneled-headless-launch.js <file…>    # explicit files (tests)
  */
 
 import fs from 'node:fs';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
 
 const __filename = fileURLToPath(import.meta.url);
 const ROOT = path.resolve(path.dirname(__filename), '..');
 
+/** The one name the funnel is built on. Every other guarded name derives from it. */
+export const CANONICAL = 'buildHeadlessLaunch';
+
 // ── Allowlist (closed). Adding an entry requires review of WHY the callsite
 //    cannot route through SessionManager.spawnSession() (where the
 //    subscription-path reroute lives), and how its post-June-15 billing is
@@ -51,11 +108,233 @@ const ALLOWLIST = new Set([
 const SCAN_DIRS = ['src', 'scripts', 'templates'];
 const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs', '.sh']);
 
-const PATTERNS = [
-  // Any reference — import, re-export, or call. An import IS the violation:
-  // there is no legitimate non-funnel consumer of the headless builder.
-  /\bbuildHeadlessLaunch\b/,
-];
+const VIOLATION_MSG =
+  `direct ${CANONICAL} reference outside the subscription-path funnel. ` +
+  `Spawn through SessionManager.spawnSession() (which carries the June-15 reroute), ` +
+  `or add an allowlist entry here with a billing-accountability justification.`;
+
+const aliasMsg = (name, from) =>
+  `'${name}' resolves to ${CANONICAL} (handed out by ${from}) — reaching the headless ` +
+  `builder under another name is the same bypass of the subscription-path funnel. ` +
+  `Spawn through SessionManager.spawnSession(), or add an allowlist entry here with a ` +
+  `billing-accountability justification.`;
+
+/** Comment lines are documentation, not a bypass — code cannot call through one. */
+export function isCommentLine(line) {
+  const t = line.trimStart();
+  return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('#');
+}
+
+/**
+ * Collapse simple adjacent string concatenation so `'A' + 'B'` reads as `AB`.
+ * Applied PER LINE so reported line numbers stay exact.
+ */
+export function collapseConcatenation(text) {
+  let out = text;
+  for (let i = 0; i < 5; i++) {
+    const next = out.replace(/(['"`])\s*\+\s*(['"`])/g, '');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+const basenameKey = (p) => path.basename(p).replace(/\.(ts|tsx|js|mjs|cjs)$/, '');
+
+// ── Cross-module: what names does the closed allowlist hand out? ──────────
+
+/** Is this expression the guarded builder itself (identifier or namespace member)? */
+function denotesGuarded(node, known) {
+  if (!node) return false;
+  if (ts.isIdentifier(node)) return known.has(node.text);
+  if (ts.isPropertyAccessExpression(node)) return known.has(node.name.text);
+  if (ts.isElementAccessExpression(node)) {
+    const a = node.argumentExpression;
+    return !!a && ts.isStringLiteralLike(a) && known.has(a.text);
+  }
+  if (ts.isParenthesizedExpression(node)) return denotesGuarded(node.expression, known);
+  if (ts.isAsExpression(node) || ts.isTypeAssertionExpression?.(node)) {
+    return denotesGuarded(node.expression, known);
+  }
+  return false;
+}
+
+/** A body that is nothing but `return <guarded>(...)` — a pass-through wrapper. */
+function isPassThroughBody(body, known) {
+  if (!body) return false;
+  if (ts.isCallExpression(body)) return denotesGuarded(body.expression, known); // arrow shorthand
+  if (!ts.isBlock(body) || body.statements.length !== 1) return false;
+  const only = body.statements[0];
+  if (!ts.isReturnStatement(only) || !only.expression) return false;
+  return ts.isCallExpression(only.expression) && denotesGuarded(only.expression.expression, known);
+}
+
+const isExported = (node) =>
+  !!node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+
+/**
+ * Names each allowlisted module hands out that resolve to the builder.
+ *
+ * `sources` is [{ path, content }]. Returns Map<aliasName, sourcePath>, run to
+ * a fixpoint across files so an allowlisted module re-exporting ANOTHER
+ * allowlisted module's alias closes too.
+ */
+export function collectFunnelAliasExports(sources) {
+  const aliases = new Map();
+  for (let pass = 0; pass < 10; pass++) {
+    const before = aliases.size;
+    for (const { path: p, content } of sources) {
+      let sf;
+      try {
+        sf = ts.createSourceFile(p, content, ts.ScriptTarget.Latest, true);
+      } catch {
+        continue;
+      }
+      // Names bound to the builder INSIDE this module, to a fixpoint.
+      const known = new Set([CANONICAL, ...aliases.keys()]);
+      for (let inner = 0; inner < 10; inner++) {
+        const size = known.size;
+        const seed = (n) => {
+          if (ts.isImportSpecifier(n) && known.has((n.propertyName ?? n.name).text)) {
+            known.add(n.name.text);
+          }
+          if (ts.isVariableDeclaration(n) && ts.isIdentifier(n.name) && denotesGuarded(n.initializer, known)) {
+            known.add(n.name.text);
+          }
+          ts.forEachChild(n, seed);
+        };
+        ts.forEachChild(sf, seed);
+        if (known.size === size) break;
+      }
+
+      const record = (name) => {
+        if (name && name !== CANONICAL && !aliases.has(name)) aliases.set(name, p);
+      };
+      const visit = (n) => {
+        // export const X = <guarded>;   /  export const X = (...) => <guarded>(...)
+        if (ts.isVariableStatement(n) && isExported(n)) {
+          for (const d of n.declarationList.declarations) {
+            if (!ts.isIdentifier(d.name) || !d.initializer) continue;
+            if (denotesGuarded(d.initializer, known)) record(d.name.text);
+            else if (
+              (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer)) &&
+              isPassThroughBody(d.initializer.body, known)
+            ) record(d.name.text);
+          }
+        }
+        // export function X(...) { return <guarded>(...); }
+        if (ts.isFunctionDeclaration(n) && isExported(n) && n.name && isPassThroughBody(n.body, known)) {
+          record(n.name.text);
+        }
+        // export { A as B };  /  export { A as B } from '...';
+        if (ts.isExportDeclaration(n) && n.exportClause && ts.isNamedExports(n.exportClause)) {
+          for (const el of n.exportClause.elements) {
+            if (known.has((el.propertyName ?? el.name).text)) record(el.name.text);
+          }
+        }
+        ts.forEachChild(n, visit);
+      };
+      ts.forEachChild(sf, visit);
+    }
+    if (aliases.size === before) break;
+  }
+  return aliases;
+}
+
+// ── Per-file: local bindings, resolved to a fixpoint ─────────────────────
+
+/** Named specifiers imported (or re-exported) in `content`, with their offsets. */
+function importSpecifiers(content) {
+  const out = [];
+  const re = /(?:import|export)\s*(?:type\s+)?(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+  for (const m of content.matchAll(re)) {
+    const body = m[1];
+    const bodyStart = m.index + m[0].indexOf('{') + 1;
+    for (const spec of body.split(',')) {
+      const t = spec.trim();
+      if (!t) continue;
+      const parts = t.replace(/^type\s+/, '').split(/\s+as\s+/);
+      const imported = parts[0].trim();
+      const local = (parts[1] ?? parts[0]).trim();
+      if (!/^[A-Za-z_$][\w$]*$/.test(imported)) continue;
+      out.push({ imported, local, from: m[2], offset: bodyStart + body.indexOf(t) });
+    }
+  }
+  return out;
+}
+
+const lineOf = (content, offset) => content.slice(0, offset).split('\n').length;
+
+/**
+ * Local names in `content` bound to something guarded, to a fixpoint.
+ *
+ * Seeds are the canonical name plus any allowlist-exported alias that is
+ * actually IMPORTED here from the module that hands it out — a locally
+ * DEFINED function of the same name is not absorbed, which is what keeps this
+ * from flagging unrelated code.
+ */
+export function collectLocalBindings(content, aliasExports = new Map()) {
+  const names = new Set([CANONICAL]);
+  const seededAliases = [];
+  for (const spec of importSpecifiers(content)) {
+    const owner = aliasExports.get(spec.imported);
+    if (owner && basenameKey(spec.from) === basenameKey(owner)) {
+      names.add(spec.local);
+      seededAliases.push({ ...spec, owner });
+    }
+  }
+  // Local re-binding chains, incl. destructures, namespace members and
+  // computed access over a collapsed concatenation.
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const esc = known.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      const forms = [
+        // import { known as alias }  /  const { known: alias } = …
+        new RegExp(`\\b${esc}\\s*(?:as|:)\\s*([A-Za-z_$][\\w$]*)`, 'g'),
+        // const alias = known;  /  const alias = ns.known;  /  const alias = ns['known'];
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*(?:[\\w$.]*\\.)?${esc}\\s*[;,\\n)]`, 'g'),
+        new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*[\\w$.]*\\[\\s*['"\`]${esc}['"\`]\\s*\\]`, 'g'),
+      ];
+      for (const re of forms) {
+        for (const m of collapseConcatenation(content).matchAll(re)) names.add(m[1]);
+      }
+    }
+    if (names.size === before) break;
+  }
+  return { names, seededAliases };
+}
+
+/**
+ * Violations in `content`, as { line, msg }. Exported so the rules can be
+ * driven with fixtures rather than only end-to-end over the tree.
+ */
+export function findHeadlessLaunchViolations(content, aliasExports = new Map()) {
+  const hits = [];
+  const { names, seededAliases } = collectLocalBindings(content, aliasExports);
+  // A guarded alias arriving by import is a violation AT THE DOOR, reported
+  // against the import even though the name itself is unremarkable.
+  const importLines = new Set();
+  for (const spec of seededAliases) {
+    const line = lineOf(content, spec.offset);
+    importLines.add(line);
+    hits.push({ line, msg: aliasMsg(spec.imported, path.basename(spec.owner)) });
+  }
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    if (isCommentLine(lines[i])) continue;
+    if (importLines.has(i + 1)) continue;
+    const line = collapseConcatenation(lines[i]);
+    for (const name of names) {
+      const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      if (new RegExp(`\\b${esc}\\b`).test(line) || new RegExp(`['"\`]${esc}['"\`]`).test(line)) {
+        hits.push({ line: i + 1, msg: name === CANONICAL ? VIOLATION_MSG : aliasMsg(name, 'the funnel') });
+        break;
+      }
+    }
+  }
+  return hits.sort((a, b) => a.line - b.line);
+}
 
 function listFiles() {
   const staged = process.argv.includes('--staged');
@@ -87,42 +366,54 @@ function listFiles() {
   return files;
 }
 
-let violations = 0;
-for (const rel of listFiles()) {
-  const normalized = rel.split(path.sep).join('/');
-  if (ALLOWLIST.has(normalized)) continue;
-  if (!EXTENSIONS.has(path.extname(normalized))) continue;
-  // Explicit args may be absolute (e.g. the lint's own self-test sandbox);
-  // repo-walk entries are always ROOT-relative.
-  const full = path.isAbsolute(normalized) ? normalized : path.join(ROOT, normalized);
-  let content;
-  try {
-    content = fs.readFileSync(full, 'utf-8');
-  } catch {
-    continue;
-  }
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    // Comment-only mentions are documentation, not a bypass — code can't
-    // call through a comment. (`//`, `*`, `/*` line starts and `#` for .sh.)
-    const trimmed = lines[i].trimStart();
-    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
-    for (const pattern of PATTERNS) {
-      if (pattern.test(lines[i])) {
-        console.error(
-          `${normalized}:${i + 1} — direct buildHeadlessLaunch reference outside the subscription-path funnel. ` +
-          `Spawn through SessionManager.spawnSession() (which carries the June-15 reroute), ` +
-          `or add an allowlist entry here with a billing-accountability justification.`,
-        );
-        violations++;
-      }
+/** Read the allowlisted SOURCE modules — the only places an alias can be minted. */
+export function readAllowlistSources(root = ROOT) {
+  const sources = [];
+  for (const rel of ALLOWLIST) {
+    if (!rel.startsWith('src/')) continue; // the lint script itself is not an alias source
+    try {
+      sources.push({ path: rel, content: fs.readFileSync(path.join(root, rel), 'utf-8') });
+    } catch {
+      /* a missing allowlist entry is the allowlist test's problem, not this scan's */
     }
   }
+  return sources;
 }
 
-if (violations > 0) {
-  console.error(`\nlint-no-unfunneled-headless-launch: ${violations} violation(s). ` +
-    `See docs/specs/june15-headless-spawn-reroute.md (finding F5).`);
-  process.exit(1);
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detectors can be imported by tests WITHOUT running
+// the scan: this module calls process.exit(1) on a violation, so an unguarded
+// import would kill any test run the moment the repo had one. Same pattern as
+// lint-no-unfunneled-credential-write.js and lint-telegram-egress-boundary.mjs.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
+  const aliasExports = collectFunnelAliasExports(readAllowlistSources());
+  let violations = 0;
+  for (const rel of listFiles()) {
+    const normalized = rel.split(path.sep).join('/');
+    if (ALLOWLIST.has(normalized)) continue;
+    if (!EXTENSIONS.has(path.extname(normalized))) continue;
+    // Explicit args may be absolute (e.g. the lint's own self-test sandbox);
+    // repo-walk entries are always ROOT-relative.
+    const full = path.isAbsolute(normalized) ? normalized : path.join(ROOT, normalized);
+    let content;
+    try {
+      content = fs.readFileSync(full, 'utf-8');
+    } catch {
+      continue;
+    }
+    for (const hit of findHeadlessLaunchViolations(content, aliasExports)) {
+      console.error(`${normalized}:${hit.line} — ${hit.msg}`);
+      violations++;
+    }
+  }
+
+  if (violations > 0) {
+    console.error(`\nlint-no-unfunneled-headless-launch: ${violations} violation(s). ` +
+      `See docs/specs/june15-headless-spawn-reroute.md (finding F5).`);
+    process.exit(1);
+  }
+  console.log('lint-no-unfunneled-headless-launch: clean');
 }
-console.log('lint-no-unfunneled-headless-launch: clean');

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T20:31:20.547Z",
-  "instarVersion": "1.3.1143",
+  "generatedAt": "2026-08-14T22:33:19.830Z",
+  "instarVersion": "1.3.1145",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143",
+  "packageVersion": "1.3.1145",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
+  "sha256": "4a5b88caa62ae256f4868735dc66735c52ae30604a8272c977ca1f4564086e43",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1145"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1143"
+  "packageVersion": "1.3.1145"
 }

package/upgrades/1.3.1144.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The check that keeps every headless subprocess going through a single funnel identified that funnel by its name alone, so putting a second nameplate on it walked straight past.
+
+- **A listed file could hand the builder out under another name**, and any file could then call that name — no forbidden text anywhere, and a real non-funnel spawn path. Reproduced in the real codebase before the fix: one appended line plus one new consumer left a working bypass while the check printed **clean**.
+- **The check now follows the function, not just its name.** Inside a file, a name passed along — relabelled on import, pulled out of a bundle, copied to a variable, reached through a bracket with the text split in half — is followed until nothing new turns up. Across files, the short closed list is read for any name it hands out that leads back to the builder, and those names are guarded wherever they are imported.
+- **The widening is deliberately narrow, and that was the harder half.** Only a plain re-labelling or a one-line pass-through counts as handing the builder out. A listed file that does real work around it does not — because that is exactly what the funnel itself looks like, and counting it would have flagged every ordinary spawn in the codebase.
+- **Four remaining gaps are named in the check's own header** and pinned by tests asserting they are still open, so they read as decisions rather than oversights.
+- **Nothing new is forbidden**, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Every background process this agent starts is supposed to go through one door, because that door is where the limits are decided. A check enforced it — but only by looking for the door's name, so anyone who gave the door a second name got past without it noticing. That was real, not hypothetical: it was demonstrated on the live codebase while the check reported everything fine.
+
+It now follows the door itself rather than the label on it. The care went into not over-correcting: a check that blocks work has to stay quiet about correct work, or someone turns it off, and then it guards nothing at all.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule.
+
+## Evidence
+
+Proven in both directions. Three deliberate mutations produce three precise failures: removing the cross-file resolution fails exactly the cross-file tests, widening the handout rule fails exactly the control that guards against flagging correct code, and removing the text-splitting defence fails exactly the three forms that depend on it.
+
+That third one is worth recording, because it failed to fail the first time. The original test used a shape a different rule already caught, so it proved nothing about the line it was written for and would have shipped as false coverage. It was rewritten to three shapes with nothing else to catch them. A test that passes for the wrong reason is indistinguishable from real coverage until something depends on it.
+
+Ten opposite-direction controls hold the other side, including two that would have caught the over-correction: a real-work function in a listed file is not treated as a handout, and the live list is asserted to hand out nothing today, so a future refactor that accidentally creates one becomes visible. The source was restored byte-identical after every mutation, the real codebase lints clean before and after, and the module is now safe to import — it previously had an unguarded exit path that would have stopped a test run the moment the codebase had a violation.

package/upgrades/1.3.1145.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`scripts/lint-journal-actuation-ban.js` enforces COHERENCE-JOURNAL-SPEC §3.9: no actuator (kill / spawn / place /
+transfer / reap) may import the journal READER, because replicated journal data is stale by construction and an
+actuator trusting it can kill live work or double-place a conversation.
+
+The check matched `/from\s+['"]…CoherenceJournalReader…['"]/`, which requires the `from` keyword. `await
+import(…)` and `require(…)` do not have it, so both loaded the reader straight past the ban. Reproduced against
+the shipped lint on a real listed actuator (`src/core/SessionManager.ts`): it printed `clean`. instar-codey
+reproduced the same evasion independently and ranked this lint first of ~20 by consequence-of-defeat.
+
+- All three load forms now match.
+- Comments are stripped (quote-aware, line-preserving) before matching, so prose describing the ban can never
+  itself be a violation.
+- `import type` is now exempt — it is erased at compile time, so it cannot act on stale data. The old pattern
+  flagged it, and a live file in the tree has that shape legitimately.
+- A curated actuator that has vanished from the tree is now a violation instead of a silently skipped line: a
+  renamed module used to leave the ban without a word.
+- A root with no `src/` exits 2 instead of printing `clean` over zero files.
+
+Deliberately NOT changed: the curated actuator list. Automatic discovery by declared-name shape was built and
+measured against this tree — nine flags across three files, every one a part-of-speech or granularity error
+("reaper" as a noun in reporting code; the 22k-line composition root; an `import type`). This lint blocks
+commits, so over-blocking correct code is the more expensive failure, and the enumerated list is the original
+converged design decision. The limit is now stated plainly in the header and pinned by a test that fails if
+anyone closes it properly.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `tests/unit/journal-actuation-ban-lint.test.ts` — 13/13 green.
+- Negative control: with the shipped lint restored, exactly 5 of 13 fail (dynamic import, `require`,
+  `import type`, vanished-curated-file, rootless-tree) and all 8 controls still pass — controls should pass both
+  ways, which is what makes them controls.
+- Real-tree verdict: `node scripts/lint-journal-actuation-ban.js` → `clean (8 actuator modules, none load the
+  reader)`, exit 0. All eight curated actuators verified present, none referencing the reader.
+- Full `npm run lint` chain green; `tests/unit/lint-chain-completeness.test.ts` 3/3.
+- Side-effects review: `upgrades/side-effects/journal-actuation-ban-load-forms.md`.
+- ELI16: `docs/specs/journal-actuation-ban-load-forms.eli16.md`.
+
+**Raised separately, not actioned here:** `src/commands/server.ts:20853` wires `OwnershipApplier`, which
+materializes durable topic ownership from the REPLICATED placement journal (it does validate `transferTo`
+against the live known-machine set first, and is specified in
+`docs/specs/ownership-applier-meshself-ordering-fix.md`). Whether §3.9 permits a validated read like that is a
+spec question, not a lint decision; it is on the operator's attention queue. The shipped lint does not flag it.

package/upgrades/side-effects/journal-actuation-ban-load-forms.md

@@ -0,0 +1,127 @@
+# Side-Effects Review — journal-actuation-ban: every load form, and the staleness half of the population
+
+**Version / slug:** `journal-actuation-ban-load-forms`
+**Date:** `2026-08-14`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — Tier 1 (classifyTier: suggestedTier 1, riskFloor 1, no reasons). No spec change: COHERENCE-JOURNAL-SPEC §3.9 is unmodified; this makes the existing ban see load forms it already forbade.`
+
+## Summary of the change
+
+`scripts/lint-journal-actuation-ban.js` enforced §3.9 with `/from\s+['"]…CoherenceJournalReader…['"]/`. That
+requires the `from` keyword, which `await import(…)` and `require(…)` do not have, so both walked past the ban.
+Reproduced against the shipped lint on a REAL listed actuator (`src/core/SessionManager.ts`): it reported
+`clean`. Independently reproduced by instar-codey, who ranked this lint #1 of ~20 by consequence-of-defeat.
+
+Now: all three load forms are matched; comments are stripped (quote-aware, length- and line-preserving) before
+matching, so prose describing the ban is never a violation; a runtime-erased `import type` is correctly NOT a
+violation; a curated actuator that has vanished from the tree is a violation instead of a skipped line; and a
+root with no `src/` exits 2 rather than printing `clean`.
+
+The declared-population gap ("grow this list when a new actuator class lands") is **left open deliberately** —
+see §2.
+
+## Decision-point inventory
+
+- `LOADS_READER` — WIDEN — now matches `from` / `import(` / `require(`. CI-time only; never runtime.
+- `TYPE_ONLY_IMPORT` — ADD — narrows: `import type` is exempt (erased at compile time).
+- comment stripping — ADD — narrows: commented text cannot be a violation.
+- missing curated file — CHANGE — was `continue` (silent), now a violation.
+- root without `src/` — ADD — exit 2, no verdict.
+- No runtime block/allow decisions added or modified. This script runs in `npm run lint` and CI only.
+
+## 1. Over-block
+
+The widened matcher can only fire on the eight curated actuator files, so the blast radius is those eight.
+Verified against the real tree: none of the eight so much as mentions `CoherenceJournalReader`, and the lint
+exits 0. Two narrowings actively REDUCE over-block versus the shipped version: `import type` (which the old
+regex flagged — `src/core/WorkingSetPull.ts` is a live example of that shape) and comment stripping.
+
+The one new way to fail a build that is not a §3.9 breach: renaming a curated actuator without updating
+`ACTUATOR_FILES`. That is intended — a renamed actuator silently leaving the ban is the failure this closes —
+and the message names the file and the fix.
+
+## 2. Under-block
+
+**Automatic discovery of actuators was built, measured against this tree, and REJECTED.** Inferring "is this an
+actuator?" from declared names (functions, classes, filename) flagged nine sites across three files, and every
+one was a part-of-speech or granularity error rather than a §3.9 breach:
+
+- `src/server/routes.ts` — matched `readReaperPeerText`, `isReaperSnapshot`, `reaperPoolHealth`: "reaper" as a
+  NOUN in code that REPORTS ON the reaper. A reporting surface reading the journal is correct code.
+- `src/commands/server.ts` — the 22k-line composition root. Every module's authority is wired through it, so any
+  file-level verdict on it is wrong in one direction or the other.
+- `src/core/WorkingSetPull.ts` — a runtime-erased `import type`.
+
+This lint blocks commits, so over-blocking correct code is the more expensive failure. The enumerated-list shape
+is also the ORIGINAL converged design decision, stated in `upgrades/side-effects/coherence-journal-p1-2.md`:
+"The enumerated-list shape is deliberate: growable, reviewable." Closing it needs an authoritative actuator
+population, not a heuristic; `src/testing/selfActionRegistry.ts` (`modelsPath`, kept complete by
+`lint-no-unregistered-self-action.js`) is the closest candidate but is a superset in KIND — spend-alert
+emitters and sweeps are self-actions, not §3.9 session actuators. Left open, named in the header, and pinned by
+a test that will fail if someone closes it.
+
+Still evadable, unchanged from before: a hand-rolled JSONL read, or reaching the reader through a re-export.
+The §3.9 duty remains the authority.
+
+## 3. Level-of-abstraction fit
+
+Line-level regex over comment-stripped source, on an enumerated file list. Same layer as the shipped check —
+no AST, no type information, no new dependency. The comment stripper is the only added machinery, and it exists
+so the matcher can widen without making §3.9 prose illegal.
+
+## 4. Signal vs authority compliance
+
+Unchanged and reinforced. The lint is a CI guard, not a runtime authority; it forbids actuators from HOLDING the
+reader, which is what keeps replicated journal data signal rather than authority. Nothing here reads the journal
+at runtime.
+
+## 5. Interactions
+
+- `npm run lint` chain (`package.json:31`) — position unchanged; `tests/unit/lint-chain-completeness.test.ts`
+  passes (3/3).
+- Husky pre-commit / CI run the same chain. Exit 2 on a rootless tree is new; the repo root always has `src/`,
+  and the only caller passing `--root` is this test.
+- No source module, route, config key, or state file is touched.
+
+## 6. External surfaces
+
+None. No HTTP route, no config key, no user-visible message, no CLAUDE.md template change (the lint is
+developer-facing tooling, not an agent capability). Agent Awareness Standard does not apply.
+
+## 7. Rollback cost
+
+`git revert` of one script plus one test file. No migration, no state, no deployed artifact. The lint is
+stateless and runs from source.
+
+## Conclusion
+
+Ship. One real evasion closed with a negative control proving each assertion fails without the fix; two
+narrowings that reduce false positives below the shipped baseline; one silent-failure mode of my own making
+(clean verdict over zero files) caught and closed before it shipped.
+
+## Second-pass review (if required)
+
+Not required at Tier 1. Independent corroboration of DEFECT 1 exists regardless: instar-codey reproduced the
+dynamic-import evasion separately and ranked this lint first of ~20 by consequence-of-defeat, and recommended
+exactly the scope taken here — "low FP risk if limited to actuator files and comment-stripped `import()`,
+`require()`… Do not ban writer imports."
+
+## Evidence pointers
+
+- `tests/unit/journal-actuation-ban-lint.test.ts` — 13/13 green with the fix.
+- Negative control: with the shipped lint restored, exactly 5 of the 13 fail (dynamic import, `require`,
+  `import type`, vanished-curated-file, rootless-tree) and all 8 controls still pass — controls should pass
+  both ways, which is what makes them controls.
+- Real-tree verdict: `node scripts/lint-journal-actuation-ban.js` → `clean (8 actuator modules, none load the
+  reader)`, exit 0.
+- `upgrades/side-effects/coherence-journal-p1-2.md` — the original converged decision to enumerate.
+
+## Finding raised separately (NOT fixed here)
+
+Discovery, before it was rejected, surfaced five `await import('../core/CoherenceJournalReader.js')` sites in
+`src/commands/server.ts`. One (`:20853`) wires `OwnershipApplier`, which materializes durable topic ownership
+FROM the replicated placement journal — replicated data feeding an ownership decision that placement and
+session routing then act on. It is deliberate and specified (`docs/specs/ownership-applier-meshself-ordering-fix.md`)
+and validates `transferTo` against the live known-machine set before materializing. Whether §3.9 permits it is a
+spec question with real consequence, and it is not mine to settle inside a lint change. Raised to the operator;
+deliberately NOT actioned here, and the lint does not flag it.