instar 1.3.947 → 1.3.949

package/dist/messaging/detectors/assertUserVisible.d.ts

@@ -1,4 +1,5 @@
 /** Deterministic UX assertions for Tier-3 user-surface tests. */
+import type { Clock } from './clock.js';
 /** Reject internal identifiers, paths, config keys, and known implementation jargon. */
 export declare function assertPlainEnglish(text: unknown): asserts text is string;
 /** Every failure must explain what happened and give the user a next action. */
@@ -8,4 +9,6 @@ export declare function assertHonestFailure(state: unknown): asserts state is {
 };
 /** A queue must not contain an expired/stale entry that can be redelivered. */
 export declare function assertNoZombie(queue: unknown): asserts queue is Array<Record<string, unknown>>;
+/** Assert that a visible event landed within its declared bound. */
+export declare function assertTimely(events: unknown, boundMs: number, clock: Clock): void;
 //# sourceMappingURL=assertUserVisible.d.ts.map

package/dist/messaging/detectors/assertUserVisible.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertUserVisible.d.ts","sourceRoot":"","sources":["../../../src/messaging/detectors/assertUserVisible.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAWjE,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAKxE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAO7G;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAa9F"}
+{"version":3,"file":"assertUserVisible.d.ts","sourceRoot":"","sources":["../../../src/messaging/detectors/assertUserVisible.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAWxC,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAKxE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAO7G;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAa9F;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAWjF"}

package/dist/messaging/detectors/assertUserVisible.js

@@ -1,4 +1,3 @@
-/** Deterministic UX assertions for Tier-3 user-surface tests. */
 const INTERNAL_ID = /\b(?:CMT|ACT|PR)[-_#]?\d+\b/i;
 const FILE_PATH = /(?:^|\s)(?:\/|\.\.\/|src\/|tests\/)[^\s]+/;
 const CONFIG_KEY = /\b[a-z][a-z0-9]*(?:\.[a-z][a-z0-9]*){2,}\b/;
@@ -44,4 +43,21 @@ export function assertNoZombie(queue) {
         }
     }
 }
+/** Assert that a visible event landed within its declared bound. */
+export function assertTimely(events, boundMs, clock) {
+    if (!Array.isArray(events) || events.length === 0)
+        throw new Error('timely response event is missing');
+    if (!Number.isFinite(boundMs) || boundMs < 0)
+        throw new Error('timely bound must be non-negative');
+    if (!clock || typeof clock.now !== 'function')
+        throw new Error('timely assertion requires an injected clock');
+    const now = clock.now();
+    const visible = events.find((event) => event && typeof event === 'object' && event.userVisible !== false);
+    if (!visible || typeof visible.startedAt !== 'number' || typeof visible.at !== 'number') {
+        throw new Error('timely response event is malformed');
+    }
+    const event = visible;
+    if (event.at > now || event.at - event.startedAt > boundMs)
+        throw new Error('user-visible response exceeded its time bound');
+}
 //# sourceMappingURL=assertUserVisible.js.map

package/dist/messaging/detectors/assertUserVisible.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertUserVisible.js","sourceRoot":"","sources":["../../../src/messaging/detectors/assertUserVisible.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAEjE,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAChE,MAAM,cAAc,GAAG,CAAC,wEAAwE,CAAC,CAAC;AAElG,SAAS,WAAW,CAAC,IAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;AACxH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,KAAkE,CAAC;IACrF,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5F,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC3G,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,IAA+F,CAAC;QAC5G,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,SAAS;QACjH,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"assertUserVisible.js","sourceRoot":"","sources":["../../../src/messaging/detectors/assertUserVisible.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAChE,MAAM,cAAc,GAAG,CAAC,wEAAwE,CAAC,CAAC;AAElG,SAAS,WAAW,CAAC,IAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;AACxH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,KAAkE,CAAC;IACrF,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5F,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC3G,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,IAA+F,CAAC;QAC5G,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,SAAS;QACjH,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,OAAe,EAAE,KAAY;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACvG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAmC,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IACzI,IAAI,CAAC,OAAO,IAAI,OAAQ,OAAmC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAQ,OAA4B,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3I,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,OAA4C,CAAC;IAC3D,IAAI,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AAC/H,CAAC"}

package/dist/messaging/detectors/clock.d.ts

@@ -0,0 +1,14 @@
+/** Small clock seam for deterministic user-visible timing assertions. */
+export interface Clock {
+    now(): number;
+}
+export declare class RealClock implements Clock {
+    now(): number;
+}
+export declare class TestClock implements Clock {
+    private current;
+    constructor(startAt?: number);
+    now(): number;
+    advance(ms: number): void;
+}
+//# sourceMappingURL=clock.d.ts.map

package/dist/messaging/detectors/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../../src/messaging/detectors/clock.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,WAAW,KAAK;IAAG,GAAG,IAAI,MAAM,CAAC;CAAE;AAEzC,qBAAa,SAAU,YAAW,KAAK;IACrC,GAAG,IAAI,MAAM;CACd;AAED,qBAAa,SAAU,YAAW,KAAK;IACrC,OAAO,CAAC,OAAO,CAAS;gBACZ,OAAO,SAAI;IACvB,GAAG,IAAI,MAAM;IACb,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAI1B"}

package/dist/messaging/detectors/clock.js

@@ -0,0 +1,14 @@
+export class RealClock {
+    now() { return Date.now(); }
+}
+export class TestClock {
+    current;
+    constructor(startAt = 0) { this.current = startAt; }
+    now() { return this.current; }
+    advance(ms) {
+        if (!Number.isFinite(ms) || ms < 0)
+            throw new Error('clock advance must be non-negative');
+        this.current += ms;
+    }
+}
+//# sourceMappingURL=clock.js.map

package/dist/messaging/detectors/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../../src/messaging/detectors/clock.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,SAAS;IACpB,GAAG,KAAa,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CACrC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IACxB,YAAY,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IACpD,GAAG,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,EAAU;QAChB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACrB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.947",
+  "version": "1.3.949",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/eli16-overview-check.mjs

@@ -29,7 +29,11 @@ export const MIN_ELI16_CHARS = 800;
 export function resolveEli16Path(specPath, specFm) {
   const specDir = path.dirname(specPath);
   const specBase = path.basename(specPath, '.md');
-  const siblingPath = path.join(specDir, `${specBase}.eli16.md`);
+  // Specs already named *.eli16.md use a readable overview sibling; never
+  // manufacture the historical *.eli16.eli16.md suffix.
+  const siblingPath = specBase.endsWith('.eli16')
+    ? path.join(specDir, `${specBase.slice(0, -'.eli16'.length)}.overview.md`)
+    : path.join(specDir, `${specBase}.eli16.md`);
   const fmMatch = specFm.match(/^\s*eli16-overview\s*:\s*["']?([^"'\n]+)/m);
   if (fmMatch) {
     const declared = fmMatch[1].trim().replace(/["']/g, '');

package/scripts/ux-impact-lint.mjs

@@ -2,31 +2,49 @@
 // safe-git-allow: read-only base-ref diff inspection for pull-request lint
 /** L1 UX-impact declaration lint. Exit 0=pass/out-of-scope, 1=violation, 2=internal error. */
 import { execFileSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
 
 function arg(name) { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : ''; }
 const base = arg('--base');
 const head = arg('--head') || 'HEAD';
 const body = arg('--body') || '';
+const scope = (arg('--scope') || '').split(',').map((v) => v.trim().toLowerCase()).filter(Boolean);
+const pusher = (arg('--pusher') || '').trim().toLowerCase();
+const reportPath = arg('--report');
 if (process.env.INSTAR_UX_LINT === 'off') { console.log('UX lint disabled by literal kill switch'); process.exit(0); }
 if (!base) { console.error('::error::UX lint requires a base ref'); process.exit(2); }
 try {
   const names = execFileSync('git', ['diff', '--name-only', `${base}...${head}`], { encoding: 'utf8' }).trim().split('\n').filter(Boolean);
+  const commits = execFileSync('git', ['log', '--format=%an <%ae>%n%cn <%ce>', `${base}..${head}`], { encoding: 'utf8' }).toLowerCase();
+  const authorInScope = scope.length === 0
+    || (Boolean(pusher) && scope.includes(pusher))
+    || scope.some((token) => commits.includes(token));
+  const report = { version: 1, base, head, authorInScope, scope, allowlistedPaths: [], exempt: false, internalError: false };
+  const writeReport = () => { if (reportPath) writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`); };
+  if (!authorInScope) { report.outOfScopeAuthor = true; await writeReport(); console.log('UX lint: out-of-scope author'); process.exit(0); }
   const allowlisted = names.filter((p) => p === 'src/server/routes.ts' || p === 'src/commands/server.ts' || p.startsWith('src/messaging/') || p.startsWith('src/dashboard/') || p.startsWith('src/templates/'));
-  if (allowlisted.length === 0) { console.log('UX lint: out of scope'); process.exit(0); }
+  report.allowlistedPaths = allowlisted;
+  if (allowlisted.length === 0) { await writeReport(); console.log('UX lint: out of scope'); process.exit(0); }
+  const diff = execFileSync('git', ['diff', '--unified=0', `${base}...${head}`, '--', ...allowlisted], { encoding: 'utf8' });
+  const added = diff.split('\n').filter((line) => line.startsWith('+') && !line.startsWith('+++')).join('\n');
+  const refactorOnly = !allowlisted.some((p) => p.startsWith('src/templates/') || p === 'src/server/routes.ts' || p === 'src/commands/server.ts')
+    && !/(?:^|\s)[`'\"](?:[^`'\"]+)[`'\"]/.test(added);
   const section = body.match(/^## UX Impact\s*\n([\s\S]*?)(?=^##\s|(?![\s\S]))/im)?.[1]?.trim() || '';
+  if (/UX-Impact:\s*refactor-only/i.test(section) && refactorOnly) { report.exempt = true; report.exemption = 'refactor-only'; await writeReport(); console.log('UX lint PASS: deterministic refactor-only exemption'); process.exit(0); }
   if (!section) { console.error('::error::UX Impact section is required for user-facing paths'); process.exit(1); }
   if (/UX-Impact:\s*none/i.test(section)) { console.error('::error::UX-Impact: none is not allowed for allowlisted paths'); process.exit(1); }
   if (!/who\s+sees|what\s+(?:the\s+)?user|first[- ]contact|user[- ]visible/i.test(section)) {
     console.error('::error::UX Impact must describe audience, visible behavior, and first contact'); process.exit(1);
   }
-  const diff = execFileSync('git', ['diff', '--unified=0', `${base}...${head}`, '--', ...allowlisted], { encoding: 'utf8' });
   const quoted = [...section.matchAll(/[`'"“]([^`'"”]+)[`'"”]/g)].map((m) => m[1]);
   if (!quoted.some((q) => q.length > 2 && diff.includes(q))) {
     console.error('::error::UX Impact must quote a concrete string from the diff'); process.exit(1);
   }
+  await writeReport();
   console.log(`UX lint PASS: ${allowlisted.length} allowlisted path(s)`);
   process.exit(0);
 } catch (error) {
+  if (reportPath) writeFileSync(reportPath, `${JSON.stringify({ version: 1, internalError: true, message: error instanceof Error ? error.message : String(error) })}\n`);
   console.error(`::error::UX lint internal error: ${error instanceof Error ? error.message : String(error)}`);
   process.exit(2);
 }

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-25T00:39:47.923Z",
-  "instarVersion": "1.3.947",
+  "generatedAt": "2026-07-25T01:35:29.077Z",
+  "instarVersion": "1.3.949",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.948.md

@@ -0,0 +1,18 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The UX PR gate now scopes enforcement to commit authors/committers and the branch pusher, verifies refactor-only exemptions deterministically, publishes an exemption-rate artifact, and blocks merge safety on internal lint errors. ELI16 companion generation no longer creates `.eli16.eli16.md` duplicates.
+
+## What to Tell Your User
+
+Pull requests now show whether a UX lint decision was in scope, whether a refactor exemption was proven, and whether the result was safe to auto-merge. Internal uncertainty stops auto-merge instead of being silently accepted.
+
+## Summary of New Capabilities
+
+- Author-scope union and deterministic refactor-only verification for UX lint.
+- Per-run exemption-rate artifact for the weekly retro.
+- Internal-error merge-safety gate and corrected ELI16 companion naming.

package/upgrades/1.3.949.md

@@ -0,0 +1,18 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The UX assertion tier now includes deterministic timing checks using an injected clock. The real messaging E2E covers both a response inside its declared bound and one that exceeds it.
+
+## What to Tell Your User
+
+Tests now verify not only what a user sees and whether failures are honest, but also whether the visible response arrives within its promised time.
+
+## Summary of New Capabilities
+
+- Reusable `Clock`, `RealClock`, and manually advanced `TestClock`.
+- `assertTimely(events, boundMs, clock)` with no external dependencies.
+- CI-visible within-bound and exceeded-bound messaging cases.

package/upgrades/side-effects/ux-first-enforcement-inc2.md

@@ -0,0 +1,7 @@
+# Side-effects review: UX-first enforcement increment 2
+
+- Extends the deterministic PR lint with author/committer plus pusher scope, a verified refactor-only exemption, and a per-run exemption-rate artifact.
+- Internal lint errors remain distinct and now make the merge-safety job fail, so native auto-merge cannot arm on an uncertain verdict.
+- Fixes ELI16 companion resolution so an existing `.eli16.md` spec is never given a double suffix; historical duplicate companions are removed.
+- No runtime user-facing behavior changes; proof is the real GitHub PR workflow and its uploaded artifact.
+- The configured author scope is literal and reviewed alongside the kill switch; a pusher outside it is out of scope.

package/upgrades/side-effects/ux-first-enforcement-inc3.md

@@ -0,0 +1,5 @@
+# Side-effects review: UX-first enforcement increment 3
+
+- Adds a pure injected clock seam and the fourth deterministic UX assertion, `assertTimely`.
+- Exercises both within-bound and exceeded-bound responses in the real messaging E2E; CI remains the proof surface.
+- No network, subprocess, or LLM dependency is introduced.