instar 1.3.1144 → 1.3.1146

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1144",
+  "packageVersion": "1.3.1146",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "a01cf44f29d7c2c5e2bc284dbcd18e27b5c4d6035f3fee7b8e8254e8a993cf2d",
+  "sha256": "675498ac7f3b9a5fd07a57a530eba5cc8645d84aede82b6f03348f7f502edb8a",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1144"
+  "packageVersion": "1.3.1146"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1144"
+  "packageVersion": "1.3.1146"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1144",
+  "version": "1.3.1146",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-journal-actuation-ban.js

@@ -12,8 +12,37 @@
  * separate module from the writer so this ban has a precise import target —
  * actuators MAY hold the writer (they emit), they may never read.
  *
- * Guardrail, not proof (a consumer could re-read the JSONL by hand); the
- * declared §3.9 duty is the authority, this catches the direct pattern.
+ * ── 2026-08-14: the header used to declare TWO limitations. One is now closed,
+ * one is NOT, and pretending otherwise would be the worse outcome.
+ *
+ * CLOSED — "this catches the direct pattern". The match required the `from`
+ * keyword, so `await import(...)` and `require(...)` walked straight past it.
+ * Reproduced against the shipped lint on a REAL listed actuator: it reported
+ * "clean". Now every module-loading form is matched, comments are stripped
+ * first (so a §3.9 reference in prose can never be a violation), and a
+ * runtime-erased `import type` is correctly NOT a violation.
+ *
+ * NOT CLOSED — "grow this list when a new actuator class lands". The population
+ * is still curated by hand. Automatic discovery was BUILT, MEASURED AGAINST THIS
+ * TREE, AND REJECTED on the evidence: inferring "is this an actuator?" from
+ * declared names flagged nine sites in three files, and every one was a
+ * granularity or part-of-speech error rather than a §3.9 breach —
+ *   · `src/server/routes.ts` matched on `readReaperPeerText`, `isReaperSnapshot`,
+ *     `reaperPoolHealth`: "reaper" as a NOUN in code that REPORTS ON the reaper,
+ *     which is exactly the correct-code case (a reporting surface may read).
+ *   · `src/commands/server.ts` is the 22k-line composition root — every module's
+ *     authority is wired through it, so any file-level verdict on it is wrong in
+ *     one direction or the other.
+ *   · `src/core/WorkingSetPull.ts` matched a runtime-erased `import type`.
+ * A guard that blocks commits must not rest on a heuristic with that error rate;
+ * over-blocking correct code is the more expensive failure here. What IS closed
+ * mechanically is the STALENESS half: a curated entry that no longer exists on
+ * disk means an actuator was renamed or moved and silently fell off the ban —
+ * that is now a hard failure instead of a skipped line.
+ *
+ * Still a guardrail, not a proof: a determined consumer can re-read the JSONL by
+ * hand or reach the reader through a re-export. The declared §3.9 duty is the
+ * authority; this catches the mechanical patterns.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -27,7 +56,8 @@ const ROOT = process.argv.includes('--root')
 /**
  * Actuator modules: anything holding kill/spawn/place/transfer/reap authority.
  * Grow this list when a new actuator class lands — adding here is cheap;
- * debugging a journal-driven double-kill is not.
+ * debugging a journal-driven double-kill is not. See the header for why this
+ * stays curated rather than inferred.
  */
 const ACTUATOR_FILES = [
   'src/core/SessionManager.ts',
@@ -40,17 +70,93 @@ const ACTUATOR_FILES = [
   'src/lifeline/ServerSupervisor.ts',
 ];
 
-const READER_IMPORT = /from\s+['"][^'"]*CoherenceJournalReader(\.js)?['"]/;
+/**
+ * Every way a module can LOAD the reader at runtime. The old pattern required
+ * `from`, which is precisely the token a dynamic import does not have.
+ */
+const LOADS_READER =
+  /(?:\bfrom\s+|\bimport\s*\(\s*|\brequire\s*\(\s*)['"][^'"]*CoherenceJournalReader(?:\.js)?['"]/;
+
+/**
+ * `import type { X } from '…Reader.js'` is erased at compile time — it creates
+ * no runtime coupling and therefore cannot act on stale data. Borrowing a TYPE
+ * from the reader is legal; holding the reader is not. A MIXED import such as
+ * `import { type A, CoherenceJournalReader }` does not match this and is still
+ * caught, which is correct — it pulls in the runtime binding.
+ */
+const TYPE_ONLY_IMPORT = /^\s*import\s+type\s/;
+
+/**
+ * Blank out comments, preserving length and line count so reported line numbers
+ * stay true. Quote-aware, so a `//` inside a string literal is not mistaken for
+ * a comment. This is what keeps "the reader named in a comment" legal no matter
+ * how wide the load-matching gets.
+ */
+function stripComments(src) {
+  const out = src.split('');
+  let i = 0;
+  let state = 'code'; // code | line | block | single | double | tick
+  while (i < src.length) {
+    const c = src[i];
+    const d = src[i + 1];
+    if (state === 'code') {
+      if (c === '/' && d === '/') { state = 'line'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c === '/' && d === '*') { state = 'block'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c === "'") state = 'single';
+      else if (c === '"') state = 'double';
+      else if (c === '`') state = 'tick';
+      i++; continue;
+    }
+    if (state === 'line') {
+      if (c === '\n') { state = 'code'; i++; continue; }
+      out[i] = ' '; i++; continue;
+    }
+    if (state === 'block') {
+      if (c === '*' && d === '/') { state = 'code'; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; }
+      if (c !== '\n') out[i] = ' ';
+      i++; continue;
+    }
+    // inside a string literal: honour escapes, then look for the closing quote
+    if (c === '\\') { i += 2; continue; }
+    if ((state === 'single' && c === "'") || (state === 'double' && c === '"') || (state === 'tick' && c === '`')) {
+      state = 'code';
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+/**
+ * A lint that reports "clean" because it scanned NOTHING is worse than no lint:
+ * absence is the cheapest result to obtain, and it is indistinguishable from a
+ * genuinely clean tree. Refuse to render a verdict on a root with no src/.
+ */
+if (!fs.existsSync(path.join(ROOT, 'src'))) {
+  console.error(`lint-journal-actuation-ban: no src/ under ${ROOT} — scanned nothing, so no verdict.`);
+  process.exit(2);
+}
 
 const violations = [];
+
 for (const rel of ACTUATOR_FILES) {
   const file = path.join(ROOT, rel);
-  if (!fs.existsSync(file)) continue;
-  const lines = fs.readFileSync(file, 'utf-8').split('\n');
+
+  // The staleness half of the declared-population gap: a curated actuator that
+  // is no longer here was renamed or moved, and silently left the ban behind.
+  if (!fs.existsSync(file)) {
+    violations.push(
+      `${rel}: listed actuator is missing from the tree — renamed or moved? It has silently left the §3.9 ban. Update ACTUATOR_FILES.`,
+    );
+    continue;
+  }
+
+  const lines = stripComments(fs.readFileSync(file, 'utf-8')).split('\n');
   for (let i = 0; i < lines.length; i++) {
-    if (READER_IMPORT.test(lines[i])) {
-      violations.push(`${rel}:${i + 1}: actuator imports the journal READER (forbidden by §3.9 — the journal answers questions, live systems decide)`);
-    }
+    if (!LOADS_READER.test(lines[i])) continue;
+    if (TYPE_ONLY_IMPORT.test(lines[i])) continue;
+    violations.push(
+      `${rel}:${i + 1}: actuator loads the journal READER (forbidden by §3.9 — the journal answers questions, live systems decide)`,
+    );
   }
 }
 
@@ -60,4 +166,4 @@ if (violations.length > 0) {
   console.error('\nReplicated journal data is stale by construction. Read the live store instead.');
   process.exit(1);
 }
-console.log(`lint-journal-actuation-ban: clean (${ACTUATOR_FILES.length} actuator modules, none import the reader)`);
+console.log(`lint-journal-actuation-ban: clean (${ACTUATOR_FILES.length} actuator modules, none load the reader)`);

package/scripts/lint-no-direct-llm-http.js

@@ -98,6 +98,162 @@ const FORBIDDEN_PATTERNS = [
 
 const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
 
+function lineForOffset(text, offset) {
+  let line = 1;
+  for (let i = 0; i < offset; i++) {
+    if (text[i] === '\n') line++;
+  }
+  return line;
+}
+
+function stripCommentsPreserveLayout(text) {
+  let out = '';
+  let i = 0;
+  let quote = null;
+  let escaped = false;
+
+  while (i < text.length) {
+    const ch = text[i];
+    const next = text[i + 1];
+
+    if (quote) {
+      out += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === '\\') {
+        escaped = true;
+      } else if (ch === quote) {
+        quote = null;
+      }
+      i++;
+      continue;
+    }
+
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch;
+      out += ch;
+      i++;
+      continue;
+    }
+
+    if (ch === '/' && next === '/') {
+      out += '  ';
+      i += 2;
+      while (i < text.length && text[i] !== '\n') {
+        out += ' ';
+        i++;
+      }
+      continue;
+    }
+
+    if (ch === '/' && next === '*') {
+      out += '  ';
+      i += 2;
+      while (i < text.length) {
+        if (text[i] === '*' && text[i + 1] === '/') {
+          out += '  ';
+          i += 2;
+          break;
+        }
+        out += text[i] === '\n' ? '\n' : ' ';
+        i++;
+      }
+      continue;
+    }
+
+    out += ch;
+    i++;
+  }
+
+  return out;
+}
+
+function skipWhitespace(text, index) {
+  while (index < text.length && /\s/.test(text[index])) index++;
+  return index;
+}
+
+function readStringLiteral(text, start) {
+  const quote = text[start];
+  if (quote !== '"' && quote !== "'" && quote !== '`') return null;
+
+  let value = '';
+  let i = start + 1;
+  let escaped = false;
+  while (i < text.length) {
+    const ch = text[i];
+    if (escaped) {
+      value += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === '\\') {
+      escaped = true;
+      i++;
+      continue;
+    }
+    if (quote === '`' && ch === '$' && text[i + 1] === '{') {
+      return null;
+    }
+    if (ch === quote) {
+      return { value, end: i + 1 };
+    }
+    value += ch;
+    i++;
+  }
+
+  return null;
+}
+
+function findFoldedStringViolations(text, rel) {
+  const stripped = stripCommentsPreserveLayout(text);
+  const violations = [];
+
+  for (let i = 0; i < stripped.length; i++) {
+    const first = readStringLiteral(stripped, i);
+    if (!first) continue;
+
+    let cursor = skipWhitespace(stripped, first.end);
+    if (stripped[cursor] !== '+') {
+      i = first.end - 1;
+      continue;
+    }
+
+    const parts = [first.value];
+    let end = first.end;
+    let literalCount = 1;
+    while (stripped[cursor] === '+') {
+      const nextStart = skipWhitespace(stripped, cursor + 1);
+      const nextString = readStringLiteral(stripped, nextStart);
+      if (!nextString) break;
+      parts.push(nextString.value);
+      literalCount++;
+      end = nextString.end;
+      cursor = skipWhitespace(stripped, nextString.end);
+    }
+
+    if (literalCount > 1) {
+      const folded = parts.join('');
+      const line = lineForOffset(stripped, i);
+      for (const pat of FORBIDDEN_PATTERNS) {
+        if (folded.includes(pat)) {
+          violations.push({
+            file: rel,
+            line,
+            pattern: pat,
+            text: folded.slice(0, 200),
+            folded: true,
+          });
+        }
+      }
+      i = end - 1;
+    }
+  }
+
+  return violations;
+}
+
 function readGitignoreDirs() {
   // Skip node_modules, dist, .instar/worktrees, etc.
   return new Set(['node_modules', 'dist', 'build', '.instar', '.git', '.next', 'coverage']);
@@ -168,6 +324,7 @@ function checkFile(file) {
       }
     }
   }
+  violations.push(...findFoldedStringViolations(text, rel));
   return violations;
 }
 
@@ -184,7 +341,8 @@ function main() {
   console.error('src/core/ClaudeCliIntelligenceProvider.ts so the burn-detection system can');
   console.error('attribute it. See docs/specs/token-burn-detection-and-self-heal.md Phase 1.\n');
   for (const v of all) {
-    console.error(`  ${v.file}:${v.line} — contains "${v.pattern}"`);
+    const reason = v.folded ? `folds to "${v.pattern}"` : `contains "${v.pattern}"`;
+    console.error(`  ${v.file}:${v.line} — ${reason}`);
     console.error(`    ${v.text}`);
   }
   process.exit(1);

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T21:37:12.442Z",
-  "instarVersion": "1.3.1144",
+  "generatedAt": "2026-08-14T22:54:06.076Z",
+  "instarVersion": "1.3.1146",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1144",
+  "packageVersion": "1.3.1146",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "a01cf44f29d7c2c5e2bc284dbcd18e27b5c4d6035f3fee7b8e8254e8a993cf2d",
+  "sha256": "675498ac7f3b9a5fd07a57a530eba5cc8645d84aede82b6f03348f7f502edb8a",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1144"
+  "packageVersion": "1.3.1146"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1144"
+  "packageVersion": "1.3.1146"
 }

package/upgrades/1.3.1145.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`scripts/lint-journal-actuation-ban.js` enforces COHERENCE-JOURNAL-SPEC §3.9: no actuator (kill / spawn / place /
+transfer / reap) may import the journal READER, because replicated journal data is stale by construction and an
+actuator trusting it can kill live work or double-place a conversation.
+
+The check matched `/from\s+['"]…CoherenceJournalReader…['"]/`, which requires the `from` keyword. `await
+import(…)` and `require(…)` do not have it, so both loaded the reader straight past the ban. Reproduced against
+the shipped lint on a real listed actuator (`src/core/SessionManager.ts`): it printed `clean`. instar-codey
+reproduced the same evasion independently and ranked this lint first of ~20 by consequence-of-defeat.
+
+- All three load forms now match.
+- Comments are stripped (quote-aware, line-preserving) before matching, so prose describing the ban can never
+  itself be a violation.
+- `import type` is now exempt — it is erased at compile time, so it cannot act on stale data. The old pattern
+  flagged it, and a live file in the tree has that shape legitimately.
+- A curated actuator that has vanished from the tree is now a violation instead of a silently skipped line: a
+  renamed module used to leave the ban without a word.
+- A root with no `src/` exits 2 instead of printing `clean` over zero files.
+
+Deliberately NOT changed: the curated actuator list. Automatic discovery by declared-name shape was built and
+measured against this tree — nine flags across three files, every one a part-of-speech or granularity error
+("reaper" as a noun in reporting code; the 22k-line composition root; an `import type`). This lint blocks
+commits, so over-blocking correct code is the more expensive failure, and the enumerated list is the original
+converged design decision. The limit is now stated plainly in the header and pinned by a test that fails if
+anyone closes it properly.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `tests/unit/journal-actuation-ban-lint.test.ts` — 13/13 green.
+- Negative control: with the shipped lint restored, exactly 5 of 13 fail (dynamic import, `require`,
+  `import type`, vanished-curated-file, rootless-tree) and all 8 controls still pass — controls should pass both
+  ways, which is what makes them controls.
+- Real-tree verdict: `node scripts/lint-journal-actuation-ban.js` → `clean (8 actuator modules, none load the
+  reader)`, exit 0. All eight curated actuators verified present, none referencing the reader.
+- Full `npm run lint` chain green; `tests/unit/lint-chain-completeness.test.ts` 3/3.
+- Side-effects review: `upgrades/side-effects/journal-actuation-ban-load-forms.md`.
+- ELI16: `docs/specs/journal-actuation-ban-load-forms.eli16.md`.
+
+**Raised separately, not actioned here:** `src/commands/server.ts:20853` wires `OwnershipApplier`, which
+materializes durable topic ownership from the REPLICATED placement journal (it does validate `transferTo`
+against the live known-machine set first, and is specified in
+`docs/specs/ownership-applier-meshself-ordering-fix.md`). Whether §3.9 permits a validated read like that is a
+spec question, not a lint decision; it is on the operator's attention queue. The shipped lint does not flag it.

package/upgrades/1.3.1146.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`scripts/lint-no-direct-llm-http.js` now folds adjacent constant string and no-expression template literals before checking for direct LLM provider hosts. A raw provider URL split as `'https://api.' + 'anthropic.com/v1/messages'` now fails the same build lint as the unsplit host.
+
+The scope is deliberately narrow: literal-plus-literal URL construction only. Dynamic URL construction is not guessed at, and the existing file-level distinction for OAuth/profile/usage metadata endpoints remains unchanged.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+Negative control against the shipped lint: the focused unit file failed 2 tests, both new split-host rejection cases. After the fix, `tests/unit/burn-detection-phase-1.test.ts` passes 20/20, and `node scripts/lint-no-direct-llm-http.js` exits clean against the real tree.

package/upgrades/side-effects/journal-actuation-ban-load-forms.md

@@ -0,0 +1,127 @@
+# Side-Effects Review — journal-actuation-ban: every load form, and the staleness half of the population
+
+**Version / slug:** `journal-actuation-ban-load-forms`
+**Date:** `2026-08-14`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — Tier 1 (classifyTier: suggestedTier 1, riskFloor 1, no reasons). No spec change: COHERENCE-JOURNAL-SPEC §3.9 is unmodified; this makes the existing ban see load forms it already forbade.`
+
+## Summary of the change
+
+`scripts/lint-journal-actuation-ban.js` enforced §3.9 with `/from\s+['"]…CoherenceJournalReader…['"]/`. That
+requires the `from` keyword, which `await import(…)` and `require(…)` do not have, so both walked past the ban.
+Reproduced against the shipped lint on a REAL listed actuator (`src/core/SessionManager.ts`): it reported
+`clean`. Independently reproduced by instar-codey, who ranked this lint #1 of ~20 by consequence-of-defeat.
+
+Now: all three load forms are matched; comments are stripped (quote-aware, length- and line-preserving) before
+matching, so prose describing the ban is never a violation; a runtime-erased `import type` is correctly NOT a
+violation; a curated actuator that has vanished from the tree is a violation instead of a skipped line; and a
+root with no `src/` exits 2 rather than printing `clean`.
+
+The declared-population gap ("grow this list when a new actuator class lands") is **left open deliberately** —
+see §2.
+
+## Decision-point inventory
+
+- `LOADS_READER` — WIDEN — now matches `from` / `import(` / `require(`. CI-time only; never runtime.
+- `TYPE_ONLY_IMPORT` — ADD — narrows: `import type` is exempt (erased at compile time).
+- comment stripping — ADD — narrows: commented text cannot be a violation.
+- missing curated file — CHANGE — was `continue` (silent), now a violation.
+- root without `src/` — ADD — exit 2, no verdict.
+- No runtime block/allow decisions added or modified. This script runs in `npm run lint` and CI only.
+
+## 1. Over-block
+
+The widened matcher can only fire on the eight curated actuator files, so the blast radius is those eight.
+Verified against the real tree: none of the eight so much as mentions `CoherenceJournalReader`, and the lint
+exits 0. Two narrowings actively REDUCE over-block versus the shipped version: `import type` (which the old
+regex flagged — `src/core/WorkingSetPull.ts` is a live example of that shape) and comment stripping.
+
+The one new way to fail a build that is not a §3.9 breach: renaming a curated actuator without updating
+`ACTUATOR_FILES`. That is intended — a renamed actuator silently leaving the ban is the failure this closes —
+and the message names the file and the fix.
+
+## 2. Under-block
+
+**Automatic discovery of actuators was built, measured against this tree, and REJECTED.** Inferring "is this an
+actuator?" from declared names (functions, classes, filename) flagged nine sites across three files, and every
+one was a part-of-speech or granularity error rather than a §3.9 breach:
+
+- `src/server/routes.ts` — matched `readReaperPeerText`, `isReaperSnapshot`, `reaperPoolHealth`: "reaper" as a
+  NOUN in code that REPORTS ON the reaper. A reporting surface reading the journal is correct code.
+- `src/commands/server.ts` — the 22k-line composition root. Every module's authority is wired through it, so any
+  file-level verdict on it is wrong in one direction or the other.
+- `src/core/WorkingSetPull.ts` — a runtime-erased `import type`.
+
+This lint blocks commits, so over-blocking correct code is the more expensive failure. The enumerated-list shape
+is also the ORIGINAL converged design decision, stated in `upgrades/side-effects/coherence-journal-p1-2.md`:
+"The enumerated-list shape is deliberate: growable, reviewable." Closing it needs an authoritative actuator
+population, not a heuristic; `src/testing/selfActionRegistry.ts` (`modelsPath`, kept complete by
+`lint-no-unregistered-self-action.js`) is the closest candidate but is a superset in KIND — spend-alert
+emitters and sweeps are self-actions, not §3.9 session actuators. Left open, named in the header, and pinned by
+a test that will fail if someone closes it.
+
+Still evadable, unchanged from before: a hand-rolled JSONL read, or reaching the reader through a re-export.
+The §3.9 duty remains the authority.
+
+## 3. Level-of-abstraction fit
+
+Line-level regex over comment-stripped source, on an enumerated file list. Same layer as the shipped check —
+no AST, no type information, no new dependency. The comment stripper is the only added machinery, and it exists
+so the matcher can widen without making §3.9 prose illegal.
+
+## 4. Signal vs authority compliance
+
+Unchanged and reinforced. The lint is a CI guard, not a runtime authority; it forbids actuators from HOLDING the
+reader, which is what keeps replicated journal data signal rather than authority. Nothing here reads the journal
+at runtime.
+
+## 5. Interactions
+
+- `npm run lint` chain (`package.json:31`) — position unchanged; `tests/unit/lint-chain-completeness.test.ts`
+  passes (3/3).
+- Husky pre-commit / CI run the same chain. Exit 2 on a rootless tree is new; the repo root always has `src/`,
+  and the only caller passing `--root` is this test.
+- No source module, route, config key, or state file is touched.
+
+## 6. External surfaces
+
+None. No HTTP route, no config key, no user-visible message, no CLAUDE.md template change (the lint is
+developer-facing tooling, not an agent capability). Agent Awareness Standard does not apply.
+
+## 7. Rollback cost
+
+`git revert` of one script plus one test file. No migration, no state, no deployed artifact. The lint is
+stateless and runs from source.
+
+## Conclusion
+
+Ship. One real evasion closed with a negative control proving each assertion fails without the fix; two
+narrowings that reduce false positives below the shipped baseline; one silent-failure mode of my own making
+(clean verdict over zero files) caught and closed before it shipped.
+
+## Second-pass review (if required)
+
+Not required at Tier 1. Independent corroboration of DEFECT 1 exists regardless: instar-codey reproduced the
+dynamic-import evasion separately and ranked this lint first of ~20 by consequence-of-defeat, and recommended
+exactly the scope taken here — "low FP risk if limited to actuator files and comment-stripped `import()`,
+`require()`… Do not ban writer imports."
+
+## Evidence pointers
+
+- `tests/unit/journal-actuation-ban-lint.test.ts` — 13/13 green with the fix.
+- Negative control: with the shipped lint restored, exactly 5 of the 13 fail (dynamic import, `require`,
+  `import type`, vanished-curated-file, rootless-tree) and all 8 controls still pass — controls should pass
+  both ways, which is what makes them controls.
+- Real-tree verdict: `node scripts/lint-journal-actuation-ban.js` → `clean (8 actuator modules, none load the
+  reader)`, exit 0.
+- `upgrades/side-effects/coherence-journal-p1-2.md` — the original converged decision to enumerate.
+
+## Finding raised separately (NOT fixed here)
+
+Discovery, before it was rejected, surfaced five `await import('../core/CoherenceJournalReader.js')` sites in
+`src/commands/server.ts`. One (`:20853`) wires `OwnershipApplier`, which materializes durable topic ownership
+FROM the replicated placement journal — replicated data feeding an ownership decision that placement and
+session routing then act on. It is deliberate and specified (`docs/specs/ownership-applier-meshself-ordering-fix.md`)
+and validates `transferTo` against the live known-machine set before materializing. Whether §3.9 permits it is a
+spec question with real consequence, and it is not mine to settle inside a lint change. Raised to the operator;
+deliberately NOT actioned here, and the lint does not flag it.

package/upgrades/side-effects/llm-http-constant-folding.md

@@ -0,0 +1,82 @@
+# Side-Effects Review — LLM HTTP lint constant folding
+
+**Version / slug:** `llm-http-constant-folding`
+**Date:** `2026-08-14`
+**Author:** `Instar-codey`
+**Tier:** 1 (one lint script plus focused unit coverage; no runtime code, route, config, migration, or persistence change)
+**Second-pass reviewer:** `not required — CI/pre-commit lint hardening only; no runtime outbound message or session lifecycle decision`
+
+## Summary of the change
+
+`scripts/lint-no-direct-llm-http.js` now folds adjacent constant string and no-expression template literals joined by `+` before checking for known LLM provider hosts. This closes the reproduced split-host bypass (`'api.' + 'anthropic.com/v1/messages'`) while keeping scope at literal URL construction only. `tests/unit/burn-detection-phase-1.test.ts` adds red/green coverage for split Anthropic, OpenAI, and Google host literals plus a non-folded dynamic construction control.
+
+Build location re-grounding: work was built in fresh worktree `/Users/justin_instar_1/.instar/agents/instar-codey/.worktrees/agent-llm-http-constant-folding` from current `JKHeadley/main` (`4731ec6a90356ed319454a996b4eb72edcf38ab2`), created through `npx -y instar@1.3.1144 worktree create ... --base origin/main` after the local wrapper lacked an installed package. Remote verified as `origin https://github.com/JKHeadley/instar.git`; package version verified as `1.3.1144`.
+
+## Decision-point inventory
+
+- `scripts/lint-no-direct-llm-http.js` — modify — build-time block/allow decision for direct provider HTTP references outside the provider chokepoint and named metadata exceptions.
+
+## 1. Over-block
+
+The new over-block risk is a benign constant string in production source that names a provider host across literal pieces without making a call. That is the same policy as the existing unsplit-host lint: production source outside the allowlist should not carry raw provider host literals because they become copyable direct-call paths. The real-tree scan after the fix was clean.
+
+OAuth/profile/usage metadata readers keep their existing allowlist/grandfather treatment; this change did not add endpoint-level bans that would collapse metadata reads into inference calls.
+
+## 2. Under-block
+
+The lint still misses dynamic construction, such as `'https://api.' + providerHost + '/v1/messages'`, computed arrays joined into a host, decoded strings, or runtime config that points at a provider endpoint. That is intentional for this PR: automatic discovery/dataflow was the high-false-positive direction. The closure here is constant URL literals, not semantic HTTP-call proof.
+
+## 3. Level-of-abstraction fit
+
+Correct layer: this is a deterministic CI lint in the existing `lint-no-*` family. The protected invariant is "new production raw LLM provider host literals outside the chokepoint require review." The lower-level primitive is a string-literal scanner, not an authority over runtime user intent.
+
+## 4. Signal vs authority compliance
+
+Reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md).
+
+This change holds blocking authority with brittle logic, but it is a build-time hard invariant/safety guard, not a conversational judgment point. The lint blocks source code containing direct provider endpoint literals outside reviewed locations, analogous to a safety guard on data egress and spend attribution. It does not decide whether a user message is appropriate or whether an agent action should proceed at runtime.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The input is source text and an enumerated provider-host list; there are no live competing signals such as urgency, recency, ownership, or liveness.
+
+## 5. Interactions
+
+- **Shadowing:** It runs inside the existing `npm run lint` chain. It may fail before later lints, as before; no downstream lint depends on side effects from this script.
+- **Double-fire:** `lint-llm-attribution.js` and other provider-path checks may catch related defects, but this one reports direct HTTP host literals specifically. Duplicate CI failures are acceptable because they point at the same source change.
+- **Races:** No shared state. It reads files and exits.
+- **Feedback loops:** None.
+
+## 6. External surfaces
+
+No runtime external surface changes. Other agents and users only see this as a stricter build/pre-commit/CI failure when source contains a newly-recognized split provider URL. No Telegram, Slack, GitHub API, dashboard, database, ledger, or generated URL behavior changes. No operator-facing action is added.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: this is a repository lint run independently in each checkout/CI runner. It emits no user-facing notices, holds no durable state, and generates no URLs. Multi-machine consistency comes from the shared git commit containing the lint and tests.
+
+## 8. Rollback cost
+
+Pure code/test/docs change. Rollback is a hot-fix revert of the lint folding helper and tests. No data migration, no agent state repair, and no user-visible runtime regression while rollback propagates.
+
+## Conclusion
+
+The real-tree scan stayed clean and the negative control failed for the intended old-lint cases, so the scoped constant-folding fix is clear to ship. No broader automatic actuator discovery or dynamic URL dataflow was added.
+
+## Second-pass review
+
+Not required.
+
+## Evidence pointers
+
+- Old-lint focused run: `npx vitest run tests/unit/burn-detection-phase-1.test.ts` failed 2 of 20 tests, specifically the two new split-host rejection tests.
+- Fixed targeted run: `npx vitest run tests/unit/burn-detection-phase-1.test.ts` passed 20/20.
+- Fixed real-tree scan: `node scripts/lint-no-direct-llm-http.js` exited 0.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable.