instar 1.3.1148 → 1.3.1150

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1148",
+  "packageVersion": "1.3.1150",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c4fb233de8c00b924323e7e9b167a5832162a35740c6445ccb7200c863ee9686",
+  "sha256": "65b8fa203de000f59bf34d2f1ac5f30e0656f81da112a5f1dde281cf1be35b3c",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1148"
+  "packageVersion": "1.3.1150"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1148"
+  "packageVersion": "1.3.1150"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1148",
+  "version": "1.3.1150",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-dev-agent-dark-gate.js

@@ -72,6 +72,49 @@ const FUNNEL_ALLOWLIST = new Set([
 // in the spec's Layer-1 "misses" row.)
 const HANDROLLED_GATE =
   /\?\?\s*(?:!{1,2}\s*|Boolean\s*\(\s*)?[A-Za-z_$][\w$.?]*(?:\.developmentAgent\b|\[\s*['"]developmentAgent['"]\s*\])/;
+
+// ── 2026-08-14: the gate value does not have to be spelled at the `??`. ──
+// The matcher above requires `.developmentAgent` LITERALLY after the `??`, so
+// lifting it into a local const first walks past it while resolving the gate by
+// hand exactly as before:
+//     const da = config.developmentAgent;
+//     return enabled ?? !!da;              // exit 0 against the old matcher
+// The header's declared limit ("cannot catch arbitrary aliases/wrapper helpers")
+// was honest; this closes the LOCAL-CONST half of it, which is the shape a
+// rename-defeat audit actually reproduced.
+//
+// Deliberately NOT closed, so it stays stated rather than implied: wrapper
+// helpers (`isDevAgent(config)`), cross-module aliases, and any value that needs
+// dataflow to resolve. Guessing at those would over-match, and this lint fails
+// builds — flagging correct code is the more expensive error here.
+//
+// Scope-bounded on purpose: an alias binds only within its own file, so the map
+// is rebuilt per file and never leaks between them.
+const ALIAS_DECL =
+  /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::\s*[^=]+?)?=\s*[A-Za-z_$][\w$.?]*(?:\.developmentAgent\b|\[\s*['"]developmentAgent['"]\s*\])/;
+
+/**
+ * Local identifiers bound to `<expr>.developmentAgent` in THIS file.
+ * `config.developmentAgentName` does not qualify — the `\b` keeps the boundary
+ * through the alias exactly as it holds at the direct callsite.
+ */
+function collectDevAgentAliases(lines) {
+  const names = new Set();
+  for (const line of lines) {
+    const code = codeOnly(line);
+    if (code === null) continue;
+    const m = ALIAS_DECL.exec(code);
+    if (m) names.add(m[1]);
+  }
+  return names;
+}
+
+/** `?? [!! | Boolean(] <alias>` — the aliased spelling of the same hand-rolled gate. */
+function aliasGateMatcher(names) {
+  if (names.size === 0) return null;
+  const alts = [...names].join('|');
+  return new RegExp(`\\?\\?\\s*(?:!{1,2}\\s*|Boolean\\s*\\(\\s*)?(?:${alts})\\b`);
+}
 // A comment referencing the gate convention (for assertion B).
 const GATE_MARKER = /developmentAgent/i;
 const GATE_MARKER_QUALIFIER = /\b(dark|gate)\b/i;
@@ -171,10 +214,11 @@ for (const file of resolveTargets()) {
 
   // ── Assertion A: funnel ──
   if (!FUNNEL_ALLOWLIST.has(rel)) {
+    const aliasGate = aliasGateMatcher(collectDevAgentAliases(lines));
     lines.forEach((line, i) => {
       const code = codeOnly(line);
       if (code === null) return;
-      if (HANDROLLED_GATE.test(code)) {
+      if (HANDROLLED_GATE.test(code) || (aliasGate !== null && aliasGate.test(code))) {
         violations.push({
           file: rel, line: i + 1, kind: 'A: hand-rolled gate',
           text: line.trim(),

package/scripts/lint-no-unreachable-messaging-gate.js

@@ -42,14 +42,160 @@ export const UNREACHABLE_OFF_GATE =
 
 const SUPPRESS = /lint-allow-messaging-gate\s*:/;
 
+function stripCommentsPreserveLines(text) {
+  let out = '';
+  let inBlock = false;
+  let quote = null;
+
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    const next = text[i + 1];
+
+    if (inBlock) {
+      if (ch === '*' && next === '/') {
+        out += '  ';
+        i += 1;
+        inBlock = false;
+      } else {
+        out += ch === '\n' ? '\n' : ' ';
+      }
+      continue;
+    }
+
+    if (quote) {
+      out += ch;
+      if (ch === '\\' && i + 1 < text.length) {
+        out += text[i + 1];
+        i += 1;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+
+    if (ch === '/' && next === '/') {
+      out += '  ';
+      i += 1;
+      while (i + 1 < text.length && text[i + 1] !== '\n') {
+        out += ' ';
+        i += 1;
+      }
+      continue;
+    }
+
+    if (ch === '/' && next === '*') {
+      out += '  ';
+      i += 1;
+      inBlock = true;
+      continue;
+    }
+
+    if (ch === "'" || ch === '"' || ch === '`') quote = ch;
+    out += ch;
+  }
+
+  return out;
+}
+
+function skipWs(s, i) {
+  while (i < s.length && /\s/.test(s[i])) i += 1;
+  return i;
+}
+
+function parseStringLiteral(s, start) {
+  const quote = s[start];
+  if (quote !== "'" && quote !== '"' && quote !== '`') return null;
+
+  let value = '';
+  for (let i = start + 1; i < s.length; i += 1) {
+    const ch = s[i];
+    if (ch === '\\' && i + 1 < s.length) {
+      value += s[i + 1];
+      i += 1;
+      continue;
+    }
+    if (quote === '`' && ch === '$' && s[i + 1] === '{') return null;
+    if (ch === quote) return { value, end: i + 1 };
+    value += ch;
+  }
+  return null;
+}
+
+function parseLiteralConcat(s, start) {
+  let i = skipWs(s, start);
+  let parsed = parseStringLiteral(s, i);
+  if (!parsed) return null;
+
+  let value = parsed.value;
+  i = skipWs(s, parsed.end);
+  while (s[i] === '+') {
+    i = skipWs(s, i + 1);
+    parsed = parseStringLiteral(s, i);
+    if (!parsed) return null;
+    value += parsed.value;
+    i = skipWs(s, parsed.end);
+  }
+
+  return { value, end: i };
+}
+
+function getCallArgStartAt(s, start) {
+  if (!s.startsWith('.get', start)) return null;
+  if (/[$_\p{ID_Continue}]/u.test(s[start + 4] ?? '')) return null;
+
+  let i = skipWs(s, start + 4);
+  if (s[i] === '<') {
+    const close = s.indexOf('>', i + 1);
+    if (close === -1) return null;
+    i = skipWs(s, close + 1);
+  }
+  if (s[i] !== '(') return null;
+  return i + 1;
+}
+
+function lineHasUnreachableOffGate(line) {
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    if (quote) {
+      if (ch === '\\' && i + 1 < line.length) {
+        i += 1;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+
+    if (ch === "'" || ch === '"' || ch === '`') {
+      quote = ch;
+      continue;
+    }
+
+    const firstArgStart = getCallArgStartAt(line, i);
+    if (firstArgStart === null) continue;
+
+    const firstArg = parseLiteralConcat(line, firstArgStart);
+    if (!firstArg || !firstArg.value.startsWith('messaging.')) continue;
+
+    let j = skipWs(line, firstArg.end);
+    if (line[j] !== ',') continue;
+    j = skipWs(line, j + 1);
+    if (line.startsWith('false', j) && !/[$_\p{ID_Continue}]/u.test(line[j + 5] ?? '')) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /** Scan raw source text; return 1-indexed line numbers of un-suppressed offenders. */
 export function scanText(text) {
-  const lines = text.split('\n');
+  const lines = stripCommentsPreserveLines(text).split('\n');
+  const originalLines = text.split('\n');
   const hits = [];
   lines.forEach((line, i) => {
-    if (!UNREACHABLE_OFF_GATE.test(line)) return;
-    if (SUPPRESS.test(line)) return;
-    if (i > 0 && SUPPRESS.test(lines[i - 1])) return;
+    if (!lineHasUnreachableOffGate(line)) return;
+    if (SUPPRESS.test(originalLines[i])) return;
+    if (i > 0 && SUPPRESS.test(originalLines[i - 1])) return;
     hits.push(i + 1);
   });
   return hits;

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T23:20:47.847Z",
-  "instarVersion": "1.3.1148",
+  "generatedAt": "2026-08-15T00:12:54.107Z",
+  "instarVersion": "1.3.1150",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1148",
+  "packageVersion": "1.3.1150",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "c4fb233de8c00b924323e7e9b167a5832162a35740c6445ccb7200c863ee9686",
+  "sha256": "65b8fa203de000f59bf34d2f1ac5f30e0656f81da112a5f1dde281cf1be35b3c",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1148"
+  "packageVersion": "1.3.1150"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1148"
+  "packageVersion": "1.3.1150"
 }

package/upgrades/1.3.1149.md

@@ -0,0 +1,48 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`scripts/lint-dev-agent-dark-gate.js` assertion A bans hand-rolled dev-agent gate resolution outside
+`resolveDevAgentGate`. The matcher required `.developmentAgent` **literally after the `??`**, so lifting the
+value into a local const first walked past it while resolving the gate by hand exactly as before:
+
+```ts
+const da = config.developmentAgent;
+return enabled ?? !!da;          // exit 0 against the shipped lint
+```
+
+instar-codey reproduced this while auditing rename-defeatable checks and pre-scoped the remedy ("low FP for
+simple local alias folding around `developmentAgent` feeding `??`"). That is the scope implemented: local
+`const`/`let`/`var` aliases, collected per file, matched at `?? [!!|Boolean(] <alias>`.
+
+The lint's header already declared this limit ("cannot catch arbitrary aliases/wrapper helpers"). It is
+closed for the shape that actually occurs; the declaration was honest, not wrong.
+
+Four controls keep it from failing correct builds, each with a test: only a `developmentAgent` binding
+counts; matching is whole-word so `developmentAgentName` is untouched; an alias never used at a `??` is
+legal (reading the flag is fine — hand-rolling the fallback is what is banned); and a commented-out
+declaration binds nothing.
+
+Still not caught, stated in the source: wrapper helpers, cross-module aliases, and anything needing
+dataflow. Guessing at those would over-match a build-failing lint.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `tests/unit/lint-dev-agent-dark-gate.test.ts` — **31/31 green** (24 existing + 7 added).
+- Negative control: tests written BEFORE the fix, run against the shipped lint — **3 of 31 fail** (const
+  alias, bracket-access alias, `Boolean(alias)`). The other 28 pass both ways.
+- Reproduced by hand first with a positive control: direct form exits 1, aliased form exits 0.
+- Real-tree verdict: `node scripts/lint-dev-agent-dark-gate.js` → exit 0, no new flags.
+- Full `npm run lint` chain green.
+- Side-effects: `upgrades/side-effects/dev-agent-gate-alias.md` · ELI16: `docs/specs/dev-agent-gate-alias.eli16.md`.

package/upgrades/1.3.1150.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- Strengthened the unreachable messaging gate lint so it detects default-off `messaging.*` LiveConfig keys built from literal string concatenation.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `npx vitest run tests/unit/lint-no-unreachable-messaging-gate.test.ts`
+- `node scripts/lint-no-unreachable-messaging-gate.js`

package/upgrades/side-effects/dev-agent-gate-alias.md

@@ -0,0 +1,104 @@
+# Side-Effects Review — dev-agent gate check follows a local alias
+
+**Version / slug:** `dev-agent-gate-alias`
+**Date:** `2026-08-14`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — Tier 1 (CI-only lint script; no runtime path). The rule is unchanged; the check now recognises one more spelling of the thing it already forbids.`
+
+## Summary of the change
+
+`scripts/lint-dev-agent-dark-gate.js` assertion A bans hand-rolled dev-agent gate resolution — anything
+resolving `enabled ?? !!<x>.developmentAgent` outside `resolveDevAgentGate`. The matcher required
+`.developmentAgent` (or `['developmentAgent']`) **literally after the `??`**, so lifting the value into a
+local const first walked past it while resolving the gate by hand exactly as before:
+
+```ts
+const da = config.developmentAgent;
+return enabled ?? !!da;          // exit 0 against the shipped lint
+```
+
+instar-codey reproduced this while auditing rename-defeatable checks and scoped the remedy: *"low for
+simple local alias folding around `developmentAgent` feeding `??`."* That is the scope implemented — local
+`const`/`let`/`var` aliases only, rebuilt per file.
+
+The lint's header **already declared this limit** ("cannot catch arbitrary aliases/wrapper helpers"). Like
+the journal-actuation ban earlier today, it is closed because the declared gap is cheap to close for the
+shape that actually occurs, not because the declaration was dishonest.
+
+## Decision-point inventory
+
+- `collectDevAgentAliases(lines)` — ADD — per-file identifiers bound to `<expr>.developmentAgent`.
+- `aliasGateMatcher(names)` — ADD — `?? [!!|Boolean(] <alias>`; returns null when there are no aliases, so
+  a file without one is byte-identical to before.
+- Assertion A predicate — WIDEN — `HANDROLLED_GATE || aliasGate`.
+- Assertions B and C, the funnel allowlist, the comment-stripping (`codeOnly`), and the marker logic are
+  untouched.
+- No runtime block/allow decision added or modified. CI-time only.
+
+## 1. Over-block
+
+The failure that matters: this lint fails builds, so flagging correct code costs more than missing a case.
+Four controls, each with a test:
+
+- **An alias of something else** (`config.somethingElse`) is not flagged — only `developmentAgent` binds.
+- **A look-alike name** (`config.developmentAgentName`) is not flagged: the `\b` holds through the alias
+  exactly as it holds at the direct callsite.
+- **An alias never used at a `??`** is not flagged. *Reading* the flag is legal; resolving the GATE by hand
+  is what is banned, and that distinction is preserved.
+- **A comment describing the aliased pattern** is not flagged — `codeOnly` already strips comments and the
+  alias collector runs on the same stripped lines, so a commented-out declaration binds nothing.
+
+Scope is per-file by construction: aliases cannot leak between files.
+
+Verified against the real tree: exit 0 — the widened check introduces **no new flags on existing code**.
+
+## 2. Under-block
+
+Stated in the source rather than implied:
+
+- **Wrapper helpers** (`isDevAgent(config)`) — still invisible.
+- **Cross-module aliases** — an alias exported from another file is not followed.
+- **Anything needing dataflow** to resolve.
+
+Guessing at those would over-match. The header's original claim is narrowed, not erased: it now cannot
+catch *arbitrary* aliases, having gained the local-const case.
+
+## 3. Level-of-abstraction fit
+
+Same layer as the existing check — line-oriented regex over comment-stripped source, no AST, no type
+information, no new dependency. The alias map is the minimum needed to answer "what value is at this
+`??`?" without climbing to a parser.
+
+## 4. Signal vs authority compliance
+
+Unchanged. A CI guard, not a runtime authority. It pushes callers toward `resolveDevAgentGate`; the funnel
+allowlist still exempts the funnel itself.
+
+## 5. Interactions
+
+- `npm run lint` chain — position unchanged; full chain green.
+- Assertions B/C unaffected; their env-fixture tests pass untouched.
+- No source module, route, config key, or state file touched.
+
+## 6. External surfaces
+
+None. Developer tooling, not an agent capability; the Agent Awareness Standard does not apply.
+
+## 7. Rollback cost
+
+`git revert` of one script plus the appended tests. No migration, no state, no deployed artifact.
+
+## Conclusion
+
+Ship. One evasion closed at the scope a peer's audit recommended, four anti-over-block controls added, real
+tree verified clean.
+
+## Evidence pointers
+
+- `tests/unit/lint-dev-agent-dark-gate.test.ts` — **31/31 green** (24 existing + 7 added).
+- Negative control: tests written BEFORE the fix and run against the shipped lint — **3 of 31 fail** (const
+  alias, bracket-access alias, `Boolean(alias)`); the four new controls and all 24 existing tests pass both
+  ways, which is what makes them controls.
+- Reproduced by hand first, with a positive control: the direct form exits 1, the aliased form exits 0.
+- Real-tree verdict: `node scripts/lint-dev-agent-dark-gate.js` → exit 0.
+- Full `npm run lint` chain green.

package/upgrades/side-effects/lint-split-key-messaging-gate.md

@@ -0,0 +1,117 @@
+# Side-Effects Review - Split-Key Messaging Gate Lint
+
+**Version / slug:** `lint-split-key-messaging-gate`
+**Date:** `2026-08-14`
+**Author:** `Instar-codey`
+**Second-pass reviewer:** `Locke`
+
+## Summary of the change
+
+This change strengthens `scripts/lint-no-unreachable-messaging-gate.js` so the existing unreachable default-off `messaging.*` LiveConfig lint also recognizes first-argument string literals joined with `+`, for example `liveConfig.get('messaging.' + 'actionClaim.enabled', false)`. The focused unit test file `tests/unit/lint-no-unreachable-messaging-gate.test.ts` now covers the reproduced split-key miss and the required controls. The release fragment is `upgrades/next/lint-split-key-messaging-gate.md`. Build location was a fresh worktree at `.worktrees/codey-lint-split-key-messaging-gate` on `JKHeadley/instar`, version `1.3.1146`, branched from current `origin/main`.
+
+## Decision-point inventory
+
+- `scripts/lint-no-unreachable-messaging-gate.js` - modify - build-time decision that flags source lines where `LiveConfig.get` uses a `messaging.*` key with literal `false` default.
+- Release note internal-only classification - pass-through - this is a script/test/docs-only change with no shipped `src/` runtime surface.
+
+---
+
+## 1. Over-block
+
+The main legitimate input risk is a dynamic backtick template such as `` liveConfig.get(`messaging.${featureKey}`, false) `` being treated as a constant key. The implementation rejects template expressions during literal parsing, and the unit suite includes that negative control. Second-pass review also found that the first implementation could flag a `.get(...)` example embedded inside another string literal; the scanner now only recognizes `.get` tokens outside ordinary string literal text, and a regression test covers `const example = "liveConfig.get('messaging.' + 'actionClaim.enabled', false)"`. A literal-concat non-messaging key such as `liveConfig.get('monitoring.' + 'burnDetection.enabled', false)` is explicitly covered and remains accepted. A default-true split key remains accepted because the lint is specifically about default-off gates staying unreachable.
+
+---
+
+## 2. Under-block
+
+The lint still misses non-literal construction such as `liveConfig.get('messaging.' + featureKey, false)` or helper-returned keys. That is intentional for this change: widening into dataflow or general expression evaluation would raise false-positive risk and would be a different guard. The known reproduced bypass is literal-plus-literal construction, and that class is now covered.
+
+---
+
+## 3. Level-of-abstraction fit
+
+This is the right layer for the fix. The problem is a static source spelling that hides an unreachable configuration key. A build lint can catch the enumerable literal shape cheaply before release. A runtime gate would be later, noisier, and would still allow dead code to ship. The implementation uses a narrow scanner rather than general JavaScript evaluation, which fits the lint's existing design.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [ ] No - this change produces a signal consumed by an existing smart gate.
+- [ ] No - this change has no block/allow surface.
+- [ ] Yes - but the logic is a smart gate with full conversational context (LLM-backed with recent history or equivalent).
+- [x] Yes, but over a hard enumerable source invariant rather than a competing-signals judgment point.
+
+This lint has blocking authority in the build, but it is not deciding from brittle runtime context. It enforces a concrete invariant: a literal `messaging.*` config key with literal `false` default is unreachable through the expected top-level config surface. The new part only folds literal string pieces before applying that same invariant.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point. The domain is enumerable source text: literal string values, `+` separators, and the literal `false` default. There are no live signals such as ownership, urgency, recency, or user intent to arbitrate.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** This replaces the prior single-regex detection path inside the same lint. It does not run before another checker or suppress another result.
+- **Double-fire:** One line produces one hit through `scanText`; the scanner returns line numbers as before.
+- **Races:** No shared runtime state. The script reads the source tree and exits.
+- **Feedback loops:** No feedback loop. The output feeds developer/build action only.
+
+---
+
+## 6. External surfaces
+
+No user-facing runtime surface changes. Other agents and users only see the effect when developing Instar: split-literal unreachable messaging gates fail the lint. No external service calls, no persistent state changes, no generated URLs, no timing dependency, and no operator-facing action surface.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface - not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local by design: this is a source-tree lint that runs in the checkout performing the build. It holds no durable agent state, emits no user-facing notices, and generates no URLs. Multi-machine coherence is handled by committing the script/tests/release notes to git so every machine receives the same lint behavior after update.
+
+---
+
+## 8. Rollback cost
+
+Pure code/test/docs change. Rollback is a hot-fix revert of the lint parser and its tests plus the release fragment. No data migration, no agent state repair, and no user-visible runtime regression during rollback.
+
+---
+
+## Conclusion
+
+The review narrowed the implementation to literal-only first-argument folding, added a negative test for template expressions, and resolved second-pass's string-example false-positive concern by scanning for `.get` only outside string literal text. The change is clear to ship with the known caveat that dynamic key construction remains out of scope for this lint.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** `Locke`
+**Independent read of the artifact:** `concern, resolved`
+
+Initial concern: the first implementation scanned for `.get` across preserved string contents, so a non-executed example string such as `const example = "liveConfig.get('messaging.' + 'actionClaim.enabled', false)"` could be reported. Resolution: `lineHasUnreachableOffGate` now locates `.get` only while outside string literal text, and `tests/unit/lint-no-unreachable-messaging-gate.test.ts` includes the example-string negative control. Dynamic concatenation and template expressions remained out of scope as intended.
+
+---
+
+## Evidence pointers
+
+- Shipped-lint reproduction before the fix: split key returned `hits: []`, counted as `failureCount: 1`.
+- After fix direct probe: split key returns `hits: [1]`.
+- Focused suite: `npx vitest run tests/unit/lint-no-unreachable-messaging-gate.test.ts` passed `15/15` after the second-pass fix.
+- Real tree: `node scripts/lint-no-unreachable-messaging-gate.js` exited clean with no existing flags.
+- Full lint: `npm run lint` exited clean.
+- Full push suite: `npm run test:push` ran 44,154 tests; 44,121 passed, 27 skipped, 3 todo, and 3 failed. Two failures were live Gemini e2e tests requiring absent `GEMINI_API_KEY`; the third feedback-drain ordering failure reran green in isolation.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect - not applicable. This fixes a source-code lint detection gap and adds direct regression tests for the reproduced shape.