fix(engine): enforce static engine-live import boundaries (#3596)

* docs: design engine dynamic-import reconciliation Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): reconcile dynamic import hardening Co-Authored-By: Claude <noreply@anthropic.com> * test(engine): guard dynamic import policy * docs: plan engine dynamic-import reconciliation Record the approved TDD sequence for selective engine-path hardening, repository guard wiring, documentation, and local verification. Preserve the no-version-bump and no-publication boundaries for the remaining work. Co-Authored-By: Claude <noreply@anthropic.com> * docs(engine): record static import invariant * fix(engine): parse block comments in import guard Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): parse dynamic imports with TypeScript Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): close import guard bypasses Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): close parser guard edge cases Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): aggregate parser diagnostics Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): bound dynamic import marker directive Require the line-level opt-out marker to be standalone inside real comment trivia so negated or incidental longer tokens cannot authorize an import. Preserve the existing general marked-line contract and pin it with focused regression coverage. Co-Authored-By: Claude <noreply@anthropic.com> * fix(engine): close Unicode marker boundary bypasses Treat Unicode identifier continuations as marker-token characters and inspect adjacent text by code point so supplementary-plane characters cannot turn longer comment tokens into approvals.\n\nCo-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-07-30 11:22:34 +00:00 · 2026-07-29 16:08:08 -07:00
parent a175dd0047
commit 945fed6105
13 changed files with 1369 additions and 24 deletions
@@ -67,6 +67,19 @@ Per-file detail is in `docs/architecture/KEY_FILES.md`.
  text, the cast parses it). Guarded by `scripts/check-jsonb-pattern.sh` (template grep) +
  `scripts/check-jsonb-params.mjs` (positional AST scanner); the real backstop is the DATABASE_URL-gated
  e2e parity tests, since PGLite can't surface the bug. Full rule in `docs/ENGINES.md`.
+- **Engine-live paths avoid runtime dynamic `import()` for helper dependencies.** In
+  `src/core/pglite-engine.ts`, `src/core/postgres-engine.ts`, and
+  `src/core/migrate.ts`, dependencies previously reached through runtime dynamic
+  imports use static top-level imports. The only current dynamic-`import()` exceptions
+  are the four `ai/gateway.ts` lookups in both engines'
+  `initSchema()` and `_upsertChunksOnce()` methods; each remains lazy inside a
+  local `try/catch` because the gateway has a large provider/config closure and,
+  more importantly, eager evaluation would occur before the catch and could
+  turn a recoverable default/config-row fallback into a module-load failure.
+  Every exception carries `engine-dynamic-import-ok` on the import line.
+  `scripts/check-engine-dynamic-import.sh` enforces the rule. For history, use
+  `git log -G'await[[:space:]]+import\\('`, not `git log -S`: a dynamic-to-static
+  rewrite can preserve the searched token while changing its context.
 - **Engine parity.** `src/core/postgres-engine.ts` and `src/core/pglite-engine.ts` move in
  lockstep — a new method/SQL shape lands in BOTH, pinned by `test/e2e/engine-parity.test.ts`.
  Forward-referenced columns/indexes go in the bootstrap probe set (guarded by
@@ -0,0 +1,690 @@
+# Engine Dynamic-Import Reconciliation Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Reconstruct the missing engine-path static-import hardening, preserve the four load-bearing lazy gateway fallbacks, and prevent unreviewed dynamic imports from returning.
+
+**Architecture:** Make the 13 safe engine/migration import statements static and leave only four line-marked `ai/gateway.ts` imports inside their existing soft-failure `try/catch` boundaries. Enforce that current state with a repository-anchored Bash wrapper delegating to a fail-closed TypeScript AST scanner, a hermetic Bun regression test, package/verify wiring, and current-state architecture documentation.
+
+**Tech Stack:** TypeScript compiler API, Bun test runner, Bash, Git, generated llms documentation bundles.
+
+## Global Constraints
+
+- Reconstruct directly on branch `claude/kind-meitner-330c90`, based on investigated `origin/master` commit `6136e139972a5449630b4f47f5ed7b4cbe5b811b` plus design commit `d7f52d8c`.
+- Do not merge or cherry-pick `48ada48f`, `248bfe55`, `ef4cf7a8`, or either historical branch wholesale.
+- Do not modify `VERSION`, `CHANGELOG.md`, `TODOS.md`, or release metadata; this is a no-version-bump reconciliation.
+- Keep all four `await import('./ai/gateway.ts')` calls lazy: PGLite and Postgres `initSchema`, plus both `_upsertChunksOnce` methods.
+- Every allowed lazy gateway line must carry `engine-dynamic-import-ok`; there is no file-level exemption.
+- Preserve the stronger gateway rationale: the static closure is large, and eager module evaluation would occur outside the local `try/catch`, potentially converting a recoverable configuration/import failure into a module-load-time hard failure.
+- Describe the hoists as engine-path hardening. Do not claim every dynamic import deterministically causes a Windows crash; system-wide commit exhaustion confounded prior measurements.
+- Keep shared PGLite/Postgres behavior in parity.
+- Invoke repository shell scripts through `bash` in `package.json`.
+- Capture complete test/check output to workspace-local `.context/*.txt` files before inspecting it; never pipe a test command directly through `head` or `tail`.
+- Use `git log -G`, not `git log -S`, for any additional dynamic-to-static import history work.
+- Keep every implementation and verification commit local. Do not push, create a PR, comment upstream, or otherwise publish without explicit user approval after local completion.
+- Before editing any affected function, run GBrain `code_blast` and `code_callers` for that symbol and inspect any disambiguation candidates.
+
+---
+
+## File Map
+
+- Create `scripts/check-engine-dynamic-import.sh` — repository-anchored Bash wrapper for default and explicit input routing.
+- Create `scripts/check-engine-dynamic-import.ts` — TypeScript AST policy scanner for runtime `import()` expressions, parse/read failures, and exact-line comment-trivia opt-outs.
+- Create `test/scripts/check-engine-dynamic-import.test.ts` — 22 hermetic adversarial, CRLF, fail-closed, real-tree, and wiring tests.
+- Modify `src/core/pglite-engine.ts` — hoist three safe import statements and mark two deliberate gateway imports.
+- Modify `src/core/postgres-engine.ts` — hoist eight safe import statements and mark two deliberate gateway imports.
+- Modify `src/core/migrate.ts` — hoist two safe migration helper import statements.
+- Modify `package.json` — expose `check:engine-dynamic-import` and append it to `check:all` through `bash`.
+- Modify `scripts/run-verify-parallel.sh` — add the package check to the authoritative verify dispatcher.
+- Modify `CLAUDE.md` — add the cross-cutting current-state invariant.
+- Modify `docs/architecture/KEY_FILES.md` — update current-state entries for the three engine-path files.
+- Regenerate `llms.txt` and `llms-full.txt` — required derived bundles after CLAUDE/reference documentation changes.
+
+---
+
+### Task 1: Establish and enforce the source invariant
+
+**Files:**
+- Create: `scripts/check-engine-dynamic-import.sh`
+- Create: `scripts/check-engine-dynamic-import.ts`
+- Create: `test/scripts/check-engine-dynamic-import.test.ts`
+- Modify: `src/core/pglite-engine.ts`
+- Modify: `src/core/postgres-engine.ts`
+- Modify: `src/core/migrate.ts`
+
+**Interfaces:**
+- Consumes: shell positional arguments `FILE...`; without arguments, the guard scans the three repository files.
+- Produces: `scripts/check-engine-dynamic-import.sh [FILE...]`, exit `0` when every runtime dynamic import is allowed and exit `1` after reporting every `file:line:text` violation plus every read/parse error on stderr.
+- Produces: one line-level opt-out token, `engine-dynamic-import-ok`, accepted only in real comment trivia on the same physical line as the deliberately lazy import.
+- Fails closed on missing/unreadable inputs, TypeScript parse diagnostics, and scanner/process failures; comments, strings, templates, regex literals, and type-position `import(...)` syntax are not runtime imports.
+
+- [ ] **Step 1: Record call-graph blast radius before touching functions**
+
+First call `sources_list` and select the source whose registered path is this gbrain checkout. Then run `code_blast` and `code_callers` for these qualified symbols with that exact `source_id`, following `did_you_mean`/`candidates` when a method name is ambiguous:
+
+```text
+src/core/pglite-engine.ts::PGLiteEngine.initSchema
+src/core/pglite-engine.ts::PGLiteEngine.batchRetry
+src/core/pglite-engine.ts::PGLiteEngine._upsertChunksOnce
+src/core/pglite-engine.ts::PGLiteEngine.mergeOntologyFact
+src/core/pglite-engine.ts::PGLiteEngine.getRecentSalience
+src/core/postgres-engine.ts::PostgresEngine.disconnect
+src/core/postgres-engine.ts::PostgresEngine.initSchema
+src/core/postgres-engine.ts::PostgresEngine.batchRetry
+src/core/postgres-engine.ts::PostgresEngine._upsertChunksOnce
+src/core/postgres-engine.ts::PostgresEngine.mergeOntologyFact
+src/core/postgres-engine.ts::PostgresEngine.reconnect
+src/core/postgres-engine.ts::PostgresEngine.getRecentSalience
+src/core/migrate.ts::runMigrationSQLWithRetry
+src/core/migrate.ts::runMigrations
+```
+
+Use `depth: 5`, `max_nodes: 200`, and `limit: 100`. Expected: no caller requires a signature or behavior change; the patch only changes module binding time and retains all local fallback/error handling.
+
+- [ ] **Step 2: Write the failing guard regression test**
+
+Create `test/scripts/check-engine-dynamic-import.test.ts` as a hermetic subprocess suite. The completed 22-test surface covers:
+
+- unmarked runtime `import()` rejection, including bare and trivia-separated forms;
+- same-line markers in real line or multiline block-comment trivia;
+- rejection of markers on prior lines or inside strings, templates, and module paths;
+- comments and comment-like delimiters inside strings, templates, and regex literals;
+- live code after same-line or multiline block comments close;
+- CRLF input and complete multi-file violation aggregation;
+- missing/readable mixed inputs and TypeScript parse diagnostics;
+- default repository anchoring when invoked from a foreign Git repository;
+- the reconciled three-file source scan plus package/parallel-verifier wiring.
+
+Use the TypeScript parser rather than a partial lexical reimplementation. On Windows, set the test default to 30 seconds because each case launches Git Bash and Bun, whose startup can exceed Bun's 5-second per-test default.
+
+- [ ] **Step 3: Run the test to prove the pre-implementation red state**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-red.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit 0
+```
+
+Expected: non-zero Bun result captured inside the log. At minimum, the `exists` assertion fails because `scripts/check-engine-dynamic-import.sh` does not exist. Read `.context/engine-dynamic-import-red.txt`; do not infer the result from a truncated pipeline.
+
+- [ ] **Step 4: Add the CRLF-safe, fail-closed guard**
+
+Create `scripts/check-engine-dynamic-import.sh` as a thin LF-terminated wrapper. Resolve its own directory first; when no explicit files are passed, anchor the repository with `git -C "$SCRIPT_DIR/.."` and scan the two engines plus `migrate.ts`. Delegate with `exec bun "$SCRIPT_DIR/check-engine-dynamic-import.ts" "${FILES[@]}"` so scanner failures propagate.
+
+Create `scripts/check-engine-dynamic-import.ts` using the TypeScript compiler API:
+
+- read every requested file and aggregate read failures;
+- parse as TypeScript and aggregate parse diagnostics;
+- walk the AST for `CallExpression`s whose expression is `ImportKeyword`;
+- locate all marker occurrences in the full source and use `ts.getTokenAtPosition` to admit only occurrences outside AST tokens (real comment trivia), recording their physical source lines;
+- require each runtime import's line to have an admitted marker or report its original `file:line:text`;
+- print every read/parse error and every violation before exiting nonzero.
+
+This preserves CRLF line accounting, ignores comment/literal/type-only false positives, catches every legal runtime `import()` shape the TypeScript parser recognizes, rejects marker spoofing, and fails closed.
+
+- [ ] **Step 5: Run the guard test to prove the source-tree midpoint is still red**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-midpoint.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit 0
+```
+
+Expected: the synthetic violation, marker, comments, and CRLF cases pass. The default repository scan fails and reports all 17 current imports: 13 unmarked safe candidates plus the four not-yet-marked gateway calls.
+
+- [ ] **Step 6: Hoist the three safe PGLite import statements**
+
+Replace the existing `retry.ts` import and add the ontology/recency imports near the top of `src/core/pglite-engine.ts`:
+
+```ts
+// Engine-path imports stay static unless a call site carries an explicit
+// engine-dynamic-import-ok justification. The gateway is the only current
+// exception because its local try/catch preserves a soft fallback.
+import {
+  withRetry,
+  BULK_RETRY_OPTS,
+  resolveBulkRetryOpts,
+  computeNextDelay,
+  isRetryableConnError,
+  type BatchAuditSite,
+} from './retry.ts';
+import {
+  valueHash,
+  normalizeDimension,
+  isNovelDimension,
+} from './chronicle/ontology.ts';
+import {
+  resolveRecencyDecayMap,
+  DEFAULT_FALLBACK,
+} from './search/recency-decay.ts';
+```
+
+Delete only these three in-method destructuring imports, leaving their uses unchanged:
+
+```ts
+const { isRetryableConnError } = await import('./retry.ts');
+const { valueHash, normalizeDimension, isNovelDimension } = await import('./chronicle/ontology.ts');
+const { resolveRecencyDecayMap, DEFAULT_FALLBACK } = await import('./search/recency-decay.ts');
+```
+
+- [ ] **Step 7: Mark both PGLite gateway soft-failure boundaries**
+
+In `PGLiteEngine.initSchema`, preserve the `try/catch` and accessors, changing only the rationale and import line:
+
+```ts
+try {
+  // Keep the gateway lazy: its static closure is large, and evaluation inside
+  // this try/catch preserves the unconfigured-gateway default fallback.
+  const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
+  // Both accessors THROW when the gateway is unconfigured (they never
+  // return falsy), so the catch below is the only fallback path (#3461).
+  dims = gw.getEmbeddingDimensions();
+  model = gw.getEmbeddingModel();
+} catch { /* gateway not configured — use defaults */ }
+```
+
+In `PGLiteEngine._upsertChunksOnce`, preserve the config-row and compile-time fallback chain:
+
+```ts
+try {
+  // Keep the gateway lazy so module-load failure remains inside this soft
+  // fallback boundary; eager evaluation would bypass the config-row fallback.
+  const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
+  resolvedModel = gw.getEmbeddingModel();
+} catch {
+```
+
+- [ ] **Step 8: Hoist the eight safe Postgres import statements**
+
+Replace the existing `retry.ts` import and add these imports near the top of `src/core/postgres-engine.ts`:
+
+```ts
+// Engine-path imports stay static unless a call site carries an explicit
+// engine-dynamic-import-ok justification. The gateway is the only current
+// exception because its local try/catch preserves a soft fallback.
+import {
+  withRetry,
+  BULK_RETRY_OPTS,
+  resolveBulkRetryOpts,
+  computeNextDelay,
+  isRetryableConnError,
+  type BatchAuditSite,
+} from './retry.ts';
+import { isConnectionEndedError } from './retry-matcher.ts';
+import {
+  valueHash,
+  normalizeDimension,
+  isNovelDimension,
+} from './chronicle/ontology.ts';
+import {
+  resolveRecencyDecayMap,
+  DEFAULT_FALLBACK,
+} from './search/recency-decay.ts';
+import { logDbDisconnect } from './audit/db-disconnect-audit.ts';
+import { logPoolRecovery } from './audit/pool-recovery-audit.ts';
+```
+
+Delete the eight safe dynamic-import statements while keeping their surrounding `try/catch` blocks and calls unchanged:
+
+```ts
+const { logDbDisconnect } = await import('./audit/db-disconnect-audit.ts');
+const { isRetryableConnError } = await import('./retry.ts');
+const { valueHash, normalizeDimension, isNovelDimension } = await import('./chronicle/ontology.ts');
+const { isConnectionEndedError } = await import('./retry-matcher.ts');
+const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
+const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
+const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
+const { resolveRecencyDecayMap, DEFAULT_FALLBACK } = await import('./search/recency-decay.ts');
+```
+
+Update the stale `batchRetry` comment from “Lazy-import to avoid a circular dep concern” to current truth:
+
+```ts
+// retry.ts is already in this module's static graph through withRetry, so
+// classifying the exhausted error does not need a second runtime import.
+```
+
+- [ ] **Step 9: Mark both Postgres gateway soft-failure boundaries**
+
+In `PostgresEngine.initSchema`, mirror the PGLite rationale and preserve behavior:
+
+```ts
+try {
+  // Keep the gateway lazy: its static closure is large, and evaluation inside
+  // this try/catch preserves the unconfigured-gateway default fallback.
+  const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
+  // Both accessors THROW when the gateway is unconfigured (they never
+  // return falsy), so the catch below is the only fallback path (#3461).
+  dims = gw.getEmbeddingDimensions();
+  model = gw.getEmbeddingModel();
+} catch { /* gateway not yet configured — use defaults */ }
+```
+
+In `PostgresEngine._upsertChunksOnce`, preserve the DB-config fallback:
+
+```ts
+try {
+  // Keep the gateway lazy so module-load failure remains inside this soft
+  // fallback boundary; eager evaluation would bypass the config-row fallback.
+  const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
+  resolvedModel = gw.getEmbeddingModel();
+} catch {
+```
+
+- [ ] **Step 10: Hoist the two migration helper import statements**
+
+Add these static imports at the top of `src/core/migrate.ts`:
+
+```ts
+// runMigrations executes while an initialized engine is live. Keep its helper
+// modules in the static graph rather than importing them from async handlers.
+import {
+  isStatementTimeoutError,
+  isRetryableConnError,
+} from './retry-matcher.ts';
+import { repairTimelineDedupIndex } from './timeline-dedup-repair.ts';
+```
+
+Delete only these two local destructuring imports:
+
+```ts
+const { isStatementTimeoutError, isRetryableConnError } = await import('./retry-matcher.ts');
+const { repairTimelineDedupIndex } = await import('./timeline-dedup-repair.ts');
+```
+
+- [ ] **Step 11: Run the complete guard test and direct guard**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-green.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; the full guard regression suite passes.
+
+```bash
+bash scripts/check-engine-dynamic-import.sh > .context/engine-dynamic-import-guard.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; output contains `check-engine-dynamic-import: ok (3 file(s) scanned)`.
+
+- [ ] **Step 12: Prove the guard leaves exactly four marked dynamic imports**
+
+```bash
+git grep -n -F "import('./ai/gateway.ts'); // engine-dynamic-import-ok" -- src/core/pglite-engine.ts src/core/postgres-engine.ts src/core/migrate.ts > .context/engine-dynamic-import-sites.txt; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exactly four lines, all importing `./ai/gateway.ts` and all carrying `engine-dynamic-import-ok`; no match in `src/core/migrate.ts`.
+
+- [ ] **Step 13: Run focused behavior tests**
+
+```bash
+bun test test/chronicle-ontology.test.ts test/chronicle-ontology-ops.test.ts test/recency-decay.test.ts test/core/retry.test.ts test/retry-matcher.test.ts test/audit/pool-recovery-audit.test.ts test/migrate-retry.test.ts test/timeline-dedup-repair.test.ts > .context/engine-dynamic-import-focused.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`. If Windows resource pressure aborts the process, record the exact exit code and rerun the failing file alone; do not relabel an infrastructure abort as a source pass.
+
+- [ ] **Step 14: Commit the source invariant locally**
+
+```bash
+git add scripts/check-engine-dynamic-import.sh scripts/check-engine-dynamic-import.ts test/scripts/check-engine-dynamic-import.test.ts src/core/pglite-engine.ts src/core/postgres-engine.ts src/core/migrate.ts
+```
+
+```bash
+git commit -m "fix(engine): reconcile dynamic import hardening"
+```
+
+Expected: one local commit; no version or release files staged.
+
+---
+
+### Task 2: Wire the guard into repository checks
+
+**Files:**
+- Modify: `test/scripts/check-engine-dynamic-import.test.ts`
+- Modify: `package.json`
+- Modify: `scripts/run-verify-parallel.sh`
+
+**Interfaces:**
+- Consumes: `scripts/check-engine-dynamic-import.sh` from Task 1.
+- Produces: package script `check:engine-dynamic-import` and verify dry-list entry of the same name.
+
+- [ ] **Step 1: Add failing wiring assertions**
+
+Add these imports/constants to `test/scripts/check-engine-dynamic-import.test.ts`:
+
+```ts
+const PACKAGE_JSON = resolve(REPO_ROOT, 'package.json');
+```
+
+Append this test block:
+
+```ts
+describe('engine dynamic-import guard wiring', () => {
+  it('is invoked through bash by check:all', () => {
+    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')) as {
+      scripts: Record<string, string>;
+    };
+    expect(pkg.scripts['check:engine-dynamic-import']).toBe(
+      'bash scripts/check-engine-dynamic-import.sh',
+    );
+    expect(pkg.scripts['check:all']).toContain(
+      'bash scripts/check-engine-dynamic-import.sh',
+    );
+  });
+
+  it('is listed by the authoritative verify dispatcher', () => {
+    const result = spawnSync(BASH, [VERIFY_DISPATCHER, '--dry-list'], {
+      cwd: REPO_ROOT,
+      encoding: 'utf8',
+      timeout: 30_000,
+    });
+    expect(result.status).toBe(0);
+    expect(new Set((result.stdout ?? '').trim().split('\n'))).toContain(
+      'check:engine-dynamic-import',
+    );
+  });
+});
+```
+
+- [ ] **Step 2: Run the test and verify both wiring assertions fail**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-wiring-red.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit 0
+```
+
+Expected: non-zero Bun result. The source guard tests remain green; package-script and verify-list assertions fail because the wiring is absent.
+
+- [ ] **Step 3: Add the package scripts**
+
+In `package.json`, add this script alongside the other `check:*` entries:
+
+```json
+"check:engine-dynamic-import": "bash scripts/check-engine-dynamic-import.sh"
+```
+
+Append the guard to the existing `check:all` chain, preserving every existing check:
+
+```text
+&& bash scripts/check-engine-dynamic-import.sh
+```
+
+Do not rewrite any existing shell entry without its `bash` prefix.
+
+- [ ] **Step 4: Add the authoritative verify entry**
+
+In `scripts/run-verify-parallel.sh`, add this stable `CHECKS` entry near the other source-shape guards:
+
+```bash
+  "check:engine-dynamic-import"
+```
+
+- [ ] **Step 5: Run the regression test and package check**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-wiring-green.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; the full guard regression suite passes.
+
+```bash
+bun run check:engine-dynamic-import > .context/engine-dynamic-import-package-check.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0` and three files scanned.
+
+- [ ] **Step 6: Commit the wiring locally**
+
+```bash
+git add package.json scripts/run-verify-parallel.sh test/scripts/check-engine-dynamic-import.test.ts
+```
+
+```bash
+git commit -m "test(engine): guard dynamic import policy"
+```
+
+Expected: one local commit with the guard wiring and its regression assertions.
+
+---
+
+### Task 3: Document the current-state invariant
+
+**Files:**
+- Modify: `CLAUDE.md`
+- Modify: `docs/architecture/KEY_FILES.md`
+- Regenerate: `llms.txt`
+- Regenerate: `llms-full.txt`
+
+**Interfaces:**
+- Consumes: the four-marked-import source state and the `check:engine-dynamic-import` package surface.
+- Produces: current-state contributor guidance and fresh generated documentation bundles.
+
+- [ ] **Step 1: Add the cross-cutting invariant to `CLAUDE.md`**
+
+Add this bullet under “Cross-cutting invariants” near the other language/filesystem guards:
+
+```md
+- **Engine-live paths use static imports by default.** In
+  `src/core/pglite-engine.ts`, `src/core/postgres-engine.ts`, and
+  `src/core/migrate.ts`, helper modules are top-level imports. The only current
+  exceptions are the four `ai/gateway.ts` lookups in both engines'
+  `initSchema()` and `_upsertChunksOnce()` methods; each remains lazy inside a
+  local `try/catch` because the gateway has a large provider/config closure and,
+  more importantly, eager evaluation would occur before the catch and could
+  turn a recoverable default/config-row fallback into a module-load failure.
+  Every exception carries `engine-dynamic-import-ok` on the import line.
+  `scripts/check-engine-dynamic-import.sh` enforces the rule. For history, use
+  `git log -G'await[[:space:]]+import\\('`, not `git log -S`: a dynamic-to-static
+  rewrite can preserve the searched token while changing its context.
+```
+
+Do not add release tags, Windows-crash certainty, or historical branch names.
+
+- [ ] **Step 2: Update the PGLite current-state entry in `KEY_FILES.md`**
+
+Append this current-state sentence to the existing `src/core/pglite-engine.ts` entry, preserving the entry as one bullet:
+
+```md
+Engine-path helper dependencies (`retry`, ontology, recency decay) bind statically; the only lazy imports are `ai/gateway.ts` in `initSchema` and `_upsertChunksOnce`, line-marked because their local catches preserve compiled-default and stored-config fallbacks that eager module evaluation would bypass.
+```
+
+- [ ] **Step 3: Update the Postgres current-state entry in `KEY_FILES.md`**
+
+Append this sentence to the existing `src/core/postgres-engine.ts` entry:
+
+```md
+Retry classifiers, ontology/recency helpers, and disconnect/pool-recovery audit writers bind statically; only the two `ai/gateway.ts` fallback lookups stay lazy and line-marked, in parity with PGLite.
+```
+
+- [ ] **Step 4: Update the migration current-state entry in `KEY_FILES.md`**
+
+Append this sentence to the canonical `src/core/migrate.ts` entry (the broad runner entry, not the older v95-specific index note):
+
+```md
+`retry-matcher.ts` and `timeline-dedup-repair.ts` are static dependencies because `runMigrations()` executes from live engine initialization; the engine dynamic-import guard scans this file with both engine implementations.
+```
+
+Keep all three entries current-state only: no `v0.42.x`, branch, commit, “previously,” or “was/now” narration.
+
+- [ ] **Step 5: Regenerate the llms bundles**
+
+```bash
+bun run build:llms > .context/engine-dynamic-import-build-llms.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; `llms.txt` and/or `llms-full.txt` update according to their configured linked/inlined status. Byte-identical output for a linked source is acceptable; the freshness test is authoritative.
+
+- [ ] **Step 6: Run documentation freshness checks**
+
+```bash
+bun test test/build-llms.test.ts > .context/engine-dynamic-import-llms-test.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`.
+
+```bash
+bun run check:doc-history > .context/engine-dynamic-import-doc-history.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; no release-history marker is introduced into current-state reference docs.
+
+- [ ] **Step 7: Confirm prohibited release files remain untouched**
+
+```bash
+git diff --name-only d7f52d8c..HEAD -- VERSION CHANGELOG.md TODOS.md
+```
+
+Expected: no output.
+
+- [ ] **Step 8: Commit documentation and generated bundles locally**
+
+```bash
+git add CLAUDE.md docs/architecture/KEY_FILES.md llms.txt llms-full.txt
+```
+
+```bash
+git commit -m "docs(engine): record static import invariant"
+```
+
+Expected: one local documentation commit. If one generated bundle is byte-identical, Git simply omits it.
+
+---
+
+### Task 4: Verify and review the complete local reconciliation
+
+**Files:**
+- Verify all files changed since `d7f52d8c`.
+- Do not create or modify release/publication metadata.
+
+**Interfaces:**
+- Consumes: Tasks 1–3.
+- Produces: full local verification evidence and an implementation diff ready for user review, not publication.
+
+- [ ] **Step 1: Run the regression test and direct guard again**
+
+```bash
+bun test test/scripts/check-engine-dynamic-import.test.ts > .context/engine-dynamic-import-final-test.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; the full guard regression suite passes.
+
+```bash
+bash scripts/check-engine-dynamic-import.sh > .context/engine-dynamic-import-final-guard.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; three files scanned.
+
+- [ ] **Step 2: Run TypeScript checking**
+
+```bash
+bun run typecheck > .context/engine-dynamic-import-typecheck.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`. Report exact diagnostics if the branch or current Windows environment has a pre-existing failure.
+
+- [ ] **Step 3: Run the authoritative verify dispatcher**
+
+```bash
+bun run verify > .context/engine-dynamic-import-verify.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`, including `check:engine-dynamic-import`. On Windows, classify any per-check timeout from the complete log instead of treating the aggregate result as a source regression without evidence.
+
+- [ ] **Step 4: Re-run focused tests as an ownership check**
+
+```bash
+bun test test/chronicle-ontology.test.ts test/chronicle-ontology-ops.test.ts test/recency-decay.test.ts test/core/retry.test.ts test/retry-matcher.test.ts test/audit/pool-recovery-audit.test.ts test/migrate-retry.test.ts test/timeline-dedup-repair.test.ts > .context/engine-dynamic-import-final-focused.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`; record any infrastructure abort separately and rerun only the named file before classifying it.
+
+- [ ] **Step 5: Run the llms freshness test after all documentation settles**
+
+```bash
+bun test test/build-llms.test.ts > .context/engine-dynamic-import-final-llms.txt 2>&1; rc=$?; printf 'EXIT=%s\n' "$rc"; exit "$rc"
+```
+
+Expected: exit `0`.
+
+- [ ] **Step 6: Run whitespace and scope checks**
+
+```bash
+git diff --check d7f52d8c..HEAD
+```
+
+Expected: exit `0`, no output.
+
+```bash
+git diff --name-only d7f52d8c..HEAD
+```
+
+Expected files only:
+
+```text
+CLAUDE.md
+docs/architecture/KEY_FILES.md
+docs/superpowers/plans/2026-07-28-engine-dynamic-import-reconciliation.md
+llms-full.txt
+llms.txt
+package.json
+scripts/check-engine-dynamic-import.sh
+scripts/check-engine-dynamic-import.ts
+scripts/run-verify-parallel.sh
+src/core/migrate.ts
+src/core/pglite-engine.ts
+src/core/postgres-engine.ts
+test/scripts/check-engine-dynamic-import.test.ts
+```
+
+Either generated llms file may be absent if regeneration proves it byte-identical. `VERSION`, `CHANGELOG.md`, and `TODOS.md` must be absent.
+
+- [ ] **Step 7: Review the exact implementation diff**
+
+```bash
+git diff --stat d7f52d8c..HEAD && git diff d7f52d8c..HEAD -- src/core/pglite-engine.ts src/core/postgres-engine.ts src/core/migrate.ts scripts/check-engine-dynamic-import.sh test/scripts/check-engine-dynamic-import.test.ts package.json scripts/run-verify-parallel.sh CLAUDE.md docs/architecture/KEY_FILES.md
+```
+
+Expected review findings:
+
+- Exactly 13 safe `await import(...)` statements are removed.
+- Exactly four `ai/gateway.ts` imports remain, all marked on the same line.
+- All four gateway imports remain inside their original local `try/catch` fallback boundaries.
+- No accessor logic, fallback ordering, SQL, public signature, or engine parity behavior changes.
+- The parser-backed guard reports all violations plus read/parse failures, preserves CRLF line accounting, ignores comments/literals/type-only syntax, detects every runtime `import()` call expression, and accepts opt-outs only from real comment trivia on the same physical line.
+- The package script invokes the shell guard through Bash; `check:all` invokes that shell guard directly, and the parallel verify dispatcher invokes the package check.
+- Documentation is current-state and makes no deterministic Windows-crash claim.
+
+**Observed Windows verification classification:** The authoritative aggregate completed with 25 of 33 checks passing. Individual reruns showed `check:test-names` and `typecheck` green; privacy/isolation exceeded Windows timing budgets; WASM failed in unrelated temporary-symlink setup; eval-glossary was CRLF/LF drift; resolver/brain-first findings predated and did not intersect this branch. The focused aggregate produced 103 pass / 5 fail: three setup-hook timeouts reproduced at the untouched base, and the known `migrate-retry` polling failure reproduced there. Its additional race-status assertion did not reproduce at base, so it remains an unresolved timing-sensitive limitation in untouched code—not evidence of an in-scope defect and not claimed as conclusively pre-existing.
+
+- [ ] **Step 8: Commit the approved plan document locally**
+
+The plan is an approved, tracked execution artifact and must not be left as an uncommitted file after implementation:
+
+```bash
+git add docs/superpowers/plans/2026-07-28-engine-dynamic-import-reconciliation.md
+```
+
+```bash
+git commit -m "docs: plan engine dynamic-import reconciliation"
+```
+
+Expected: one local plan commit; no release metadata staged.
+
+- [ ] **Step 9: Inspect final status without publishing**
+
+```bash
+git status --short --branch
+```
+
+Expected: branch `claude/kind-meitner-330c90` with a clean working tree. No push, PR, upstream comment, or other external side effect.
+
+- [ ] **Step 10: Capture the completed milestone to memory**
+
+Before writing, search MemPalace wing `gbrain` for this exact reconciliation to avoid duplication. Add a verbatim drawer recording exact base/head commits, the 13 hoists, four gateway opt-outs and rationale, guard/test/docs files, every verification command with exit code, and any environment-owned failures. Add a GBrain project timeline entry only if there is an existing relevant gbrain project page; do not create duplicate release metadata.
+
+- [ ] **Step 11: Report the local result and ask separately before publication**
+
+Report:
+
+- exact local commits;
+- changed files;
+- test/check exit codes;
+- any blocked or pre-existing failures;
+- confirmation that release files were untouched;
+- confirmation that nothing was pushed or published.
+
+Do not run any publication command. Wait for explicit user approval before any push, PR, or upstream interaction.
@@ -0,0 +1,142 @@
+# Engine dynamic-import reconciliation design
+
+**Date:** 2026-07-28
+
+## Goal
+
+Reconcile the overlapping engine dynamic-import changes from:
+
+- `claude/hungry-edison-8bb1cd` at release commits `48ada48f` and `248bfe55`
+- `claude/elegant-gates-e5275e` at `ef4cf7a8`
+
+onto a fresh branch from current `origin/master`, without merging or cherry-picking either lineage wholesale and without adding a release/version bump.
+
+## Established state
+
+At investigation time:
+
+- `origin/master` was `6136e139972a5449630b4f47f5ed7b4cbe5b811b`, version `0.42.67.0`.
+- Upstream PR #3511 was still open, so trunk did not contain its two `chronicle/ontology.ts` hoists.
+- Neither source branch was an ancestor of trunk.
+- Trunk contained 17 dynamic imports in the three engine-path files:
+  - 13 safe-hoist candidates: two ontology imports, nine engine helper/audit imports, and two migration imports.
+  - Four `ai/gateway.ts` imports, all inside `try/catch` fallback paths.
+- `git log -G` showed the separate ontology, helper, migration, and gateway histories. `git log -S` is not suitable for this dynamic-to-static replacement because the relevant token can remain present while its context changes.
+- The guard from `ef4cf7a8` passed against that commit but failed against trunk. It also knew about only two gateway opt-outs because two `_upsertChunksOnce` gateway lookups landed later in trunk.
+
+## Selected approach
+
+Reconstruct the intended current state directly on fresh `origin/master`.
+
+Do not merge or cherry-pick either old lineage. Selectively reproduce the desired source changes, adapt the guard to the current four gateway call sites, and write current-state documentation. This avoids importing stale release metadata, stale TODO claims, and unrelated lineage changes.
+
+## Source changes
+
+### Safe static imports
+
+Hoist all 13 safe candidates:
+
+- `src/core/pglite-engine.ts`
+  - `valueHash`, `normalizeDimension`, `isNovelDimension` from `chronicle/ontology.ts`
+  - `isRetryableConnError` through the existing `retry.ts` import
+  - `resolveRecencyDecayMap`, `DEFAULT_FALLBACK` from `search/recency-decay.ts`
+- `src/core/postgres-engine.ts`
+  - the same ontology, retry, and recency helpers
+  - `isConnectionEndedError` from `retry-matcher.ts`
+  - `logDbDisconnect` from `audit/db-disconnect-audit.ts`
+  - `logPoolRecovery` from `audit/pool-recovery-audit.ts`
+- `src/core/migrate.ts`
+  - `isStatementTimeoutError`, `isRetryableConnError` from `retry-matcher.ts`
+  - `repairTimelineDedupIndex` from `timeline-dedup-repair.ts`
+
+The implementation must keep the two engines in parity where the behavior is shared. Comments should describe current invariants, not repeat an unproven causal claim that these hoists fix the Windows test-runner crash.
+
+### Deliberately lazy gateway imports
+
+Keep all four `await import('./ai/gateway.ts')` call sites lazy:
+
+- PGLite `initSchema`
+- PGLite `_upsertChunksOnce`
+- Postgres `initSchema`
+- Postgres `_upsertChunksOnce`
+
+Each line receives the explicit `engine-dynamic-import-ok` marker and a concise nearby rationale.
+
+The rationale has two parts:
+
+1. The gateway's static closure includes the AI SDK, provider packages, and validation/config machinery, so eager loading would tax engine startup paths that do not otherwise need it.
+2. More importantly, each lookup is inside a `try/catch` that preserves a soft fallback (compiled defaults or the brain's stored embedding-model config). Hoisting the module would evaluate it before that catch can run and could convert a recoverable configuration/import failure into a module-load-time hard failure.
+
+The guard must not allow unmarked gateway imports or a broad file-level exemption.
+
+## Guard and wiring
+
+Add `scripts/check-engine-dynamic-import.sh`, adapted from `ef4cf7a8`, with these properties:
+
+- Default scan set:
+  - `src/core/pglite-engine.ts`
+  - `src/core/postgres-engine.ts`
+  - `src/core/migrate.ts`
+- Normalize trailing CR before matching so CRLF checkouts cannot bypass the check.
+- Ignore comment-only lines.
+- Ignore only lines carrying `engine-dynamic-import-ok`.
+- Report every unmarked `await import(` with file and line.
+- Explain that contributors should prefer a static import and must justify a real opt-out.
+- Avoid asserting that every dynamic import deterministically crashes Windows; the measured evidence supports treating the pattern as an engine-path hardening invariant, while box-level commit exhaustion remained a confound in prior runs.
+
+Wire it into:
+
+- `package.json` as `check:engine-dynamic-import`
+- `package.json` `check:all`
+- `scripts/run-verify-parallel.sh`
+
+Follow trunk's current rule that package scripts invoke repository shell scripts through `bash`.
+
+## Regression coverage
+
+Add an automated test for the guard. It must cover:
+
+- A real dynamic import produces exit 1 and is reported.
+- A line carrying `engine-dynamic-import-ok` is allowed.
+- Line comments and block-comment lines do not produce findings.
+- The same violation is caught with CRLF input.
+- The default repository scan passes after the source reconciliation.
+
+Use a temporary fixture rather than mutating tracked source files. Keep assertions path-portable.
+
+The pre-fix red demonstration is the exact guard from `ef4cf7a8` run against current trunk: it exits 1 and reports the existing unmarked imports. The post-fix guard and test must pass.
+
+## Documentation policy
+
+Preserve current behavior, not either old release narrative:
+
+- Do not modify `VERSION` or add a release `CHANGELOG.md` entry.
+- Do not copy old version headings or completed release TODO blocks.
+- Do not retain the old TODO claiming that extracting gateway accessors is necessarily the fix; the lazy imports are deliberately protected by their local soft-failure boundaries.
+- Add the cross-cutting no-unmarked-dynamic-import invariant to `CLAUDE.md`.
+- Update the current-state entries for `src/core/pglite-engine.ts`, `src/core/postgres-engine.ts`, and `src/core/migrate.ts` in `docs/architecture/KEY_FILES.md` where needed.
+- Regenerate `llms.txt` and `llms-full.txt` after the documentation edits.
+- Add a TODO only if implementation uncovers a real unresolved action.
+
+Public documentation must use generic language and must not overstate the historical Windows crash causality.
+
+## Verification
+
+Capture full output to files before inspecting summaries. Run, at minimum:
+
+1. The guard regression test.
+2. `bash scripts/check-engine-dynamic-import.sh`.
+3. Focused tests that exercise the touched engine, migration, retry, audit, and recency modules.
+4. `bun run typecheck`.
+5. `bun run verify`.
+6. `bun run build:llms` followed by `bun test test/build-llms.test.ts`.
+7. `git diff --check` and a final clean-status/diff review.
+
+If platform contention or existing Windows suite defects block a broad test, report the exact command, exit code, and ownership classification rather than declaring success from a partial run.
+
+## Git and publication boundary
+
+- Work on `claude/kind-meitner-330c90`, reset locally to the exact investigated `origin/master` base.
+- Preserve the previous worktree tip under `claude/kind-meitner-330c90-pre-reconcile`.
+- Keep implementation and verification commits local.
+- Do not push, create a PR, comment upstream, or otherwise publish without explicit user approval after the local result is complete.
@@ -216,6 +216,19 @@ Per-file detail is in `docs/architecture/KEY_FILES.md`.
  text, the cast parses it). Guarded by `scripts/check-jsonb-pattern.sh` (template grep) +
  `scripts/check-jsonb-params.mjs` (positional AST scanner); the real backstop is the DATABASE_URL-gated
  e2e parity tests, since PGLite can't surface the bug. Full rule in `docs/ENGINES.md`.
+- **Engine-live paths avoid runtime dynamic `import()` for helper dependencies.** In
+  `src/core/pglite-engine.ts`, `src/core/postgres-engine.ts`, and
+  `src/core/migrate.ts`, dependencies previously reached through runtime dynamic
+  imports use static top-level imports. The only current dynamic-`import()` exceptions
+  are the four `ai/gateway.ts` lookups in both engines'
+  `initSchema()` and `_upsertChunksOnce()` methods; each remains lazy inside a
+  local `try/catch` because the gateway has a large provider/config closure and,
+  more importantly, eager evaluation would occur before the catch and could
+  turn a recoverable default/config-row fallback into a module-load failure.
+  Every exception carries `engine-dynamic-import-ok` on the import line.
+  `scripts/check-engine-dynamic-import.sh` enforces the rule. For history, use
+  `git log -G'await[[:space:]]+import\\('`, not `git log -S`: a dynamic-to-static
+  rewrite can preserve the searched token while changing its context.
 - **Engine parity.** `src/core/postgres-engine.ts` and `src/core/pglite-engine.ts` move in
  lockstep — a new method/SQL shape lands in BOTH, pinned by `test/e2e/engine-parity.test.ts`.
  Forward-referenced columns/indexes go in the bootstrap probe set (guarded by
@@ -48,7 +48,8 @@
    "check:system-of-record": "bash scripts/check-system-of-record.sh",
    "check:admin-scope-drift": "bash scripts/check-admin-scope-drift.sh",
    "check:cli-exec": "bash scripts/check-cli-executable.sh",
-    "check:all": "bash scripts/check-privacy.sh && bash scripts/check-proposal-pii.sh && bash scripts/check-test-real-names.sh && bash scripts/check-jsonb-pattern.sh && bash scripts/check-source-id-projection.sh && bash scripts/check-source-config-leak.sh && bash scripts/check-progress-to-stdout.sh && bash scripts/check-no-tracked-symlinks.sh && bash scripts/check-no-legacy-getconnection.sh && bash scripts/check-test-isolation.sh && bash scripts/check-trailing-newline.sh && bash scripts/check-wasm-embedded.sh && bash scripts/check-exports-count.sh && bash scripts/check-admin-build.sh && bash scripts/check-admin-scope-drift.sh && bash scripts/check-cli-executable.sh && bash scripts/check-skill-brain-first.sh && bash scripts/check-operations-filter-bypass.sh && bash scripts/check-gateway-routed-no-direct-anthropic.sh && bash scripts/check-worker-pool-atomicity.sh && bash scripts/check-key-files-current-state.sh && bash scripts/check-no-double-retry.sh && bash scripts/check-batch-audit-site.sh",
+    "check:engine-dynamic-import": "bash scripts/check-engine-dynamic-import.sh",
+    "check:all": "bash scripts/check-privacy.sh && bash scripts/check-proposal-pii.sh && bash scripts/check-test-real-names.sh && bash scripts/check-jsonb-pattern.sh && bash scripts/check-source-id-projection.sh && bash scripts/check-source-config-leak.sh && bash scripts/check-progress-to-stdout.sh && bash scripts/check-no-tracked-symlinks.sh && bash scripts/check-no-legacy-getconnection.sh && bash scripts/check-test-isolation.sh && bash scripts/check-trailing-newline.sh && bash scripts/check-wasm-embedded.sh && bash scripts/check-exports-count.sh && bash scripts/check-admin-build.sh && bash scripts/check-admin-scope-drift.sh && bash scripts/check-cli-executable.sh && bash scripts/check-skill-brain-first.sh && bash scripts/check-operations-filter-bypass.sh && bash scripts/check-gateway-routed-no-direct-anthropic.sh && bash scripts/check-worker-pool-atomicity.sh && bash scripts/check-key-files-current-state.sh && bash scripts/check-no-double-retry.sh && bash scripts/check-batch-audit-site.sh && bash scripts/check-engine-dynamic-import.sh",
    "check:gateway-routed": "bash scripts/check-gateway-routed-no-direct-anthropic.sh",
    "check:worker-pool-atomicity": "bash scripts/check-worker-pool-atomicity.sh",
    "check:doc-history": "bash scripts/check-key-files-current-state.sh",
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Engine-live paths use static imports by default. A line-level
+# `engine-dynamic-import-ok` marker is required for a justified lazy import.
+#
+# Historical Windows runs associated imports on these paths with abrupt Bun
+# test-process exits, but system-wide commit exhaustion remained a confound.
+# This guard therefore enforces a reviewed engine-path hardening invariant; it
+# does not claim every dynamic import deterministically crashes Windows.
+#
+# Usage:
+#   bash scripts/check-engine-dynamic-import.sh
+#   bash scripts/check-engine-dynamic-import.sh FILE [FILE...]
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" || exit 1
+
+if [ "$#" -gt 0 ]; then
+  FILES=("$@")
+else
+  ROOT="$(git -C "$SCRIPT_DIR/.." rev-parse --show-toplevel 2>/dev/null || true)"
+  [ -n "$ROOT" ] || ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  cd "$ROOT" || exit 1
+  FILES=(
+    src/core/pglite-engine.ts
+    src/core/postgres-engine.ts
+    src/core/migrate.ts
+  )
+fi
+
+exec bun "$SCRIPT_DIR/check-engine-dynamic-import.ts" "${FILES[@]}"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bun
+
+import { readFile } from 'node:fs/promises';
+import ts from 'typescript';
+
+const MARKER = 'engine-dynamic-import-ok';
+const MARKER_TOKEN_CHAR = /[\p{ID_Continue}$-]/u;
+const files = process.argv.slice(2);
+const violations: string[] = [];
+const readErrors: string[] = [];
+
+for (const file of files) {
+  let sourceText: string;
+  try {
+    sourceText = await readFile(file, 'utf8');
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    readErrors.push(`ERROR: cannot read input file ${file}: ${detail}`);
+    continue;
+  }
+
+  const sourceFile = ts.createSourceFile(
+    file,
+    sourceText,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  );
+  const lines = sourceText.split(/\r?\n/);
+  const markerLines = new Set<number>();
+
+  if (sourceFile.parseDiagnostics.length > 0) {
+    const diagnostics = sourceFile.parseDiagnostics
+      .map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, ' '))
+      .join('; ');
+    readErrors.push(`ERROR: cannot parse input file ${file}: ${diagnostics}`);
+  }
+
+  for (let markerPos = sourceText.indexOf(MARKER); markerPos >= 0; markerPos = sourceText.indexOf(MARKER, markerPos + MARKER.length)) {
+    const before = Array.from(sourceText.slice(0, markerPos)).at(-1);
+    const after = Array.from(sourceText.slice(markerPos + MARKER.length))[0];
+    const standaloneMarker = (!before || !MARKER_TOKEN_CHAR.test(before))
+      && (!after || !MARKER_TOKEN_CHAR.test(after));
+    const token = ts.getTokenAtPosition(sourceFile, markerPos);
+    const insideToken = token.getStart(sourceFile) <= markerPos && markerPos < token.end;
+    if (standaloneMarker && !insideToken) {
+      markerLines.add(sourceFile.getLineAndCharacterOfPosition(markerPos).line);
+    }
+  }
+
+  function visit(node: ts.Node): void {
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+      const { line } = sourceFile.getLineAndCharacterOfPosition(node.expression.getStart(sourceFile));
+      const sourceLine = lines[line] ?? '';
+      if (!markerLines.has(line)) {
+        violations.push(`  ${file}:${line + 1}:${sourceLine}`);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+}
+
+for (const error of readErrors) console.error(error);
+
+if (violations.length > 0) {
+  console.error('ERROR: unreviewed dynamic import on an engine-live path:');
+  console.error();
+  console.error(violations.join('\n'));
+  console.error();
+  console.error('Prefer a static top-level import. If lazy loading is load-bearing,');
+  console.error("append 'engine-dynamic-import-ok' to that exact line and document");
+  console.error('the startup or soft-failure boundary that requires it.');
+  process.exit(1);
+}
+
+if (readErrors.length > 0) process.exit(1);
+
+console.log(`check-engine-dynamic-import: ok (${files.length} file(s) scanned)`);
@@ -64,6 +64,7 @@ CHECKS=(
  "check:source-scope-onboard"
  "check:no-double-retry"
  "check:batch-audit-site"
+  "check:engine-dynamic-import"
  "check:worker-lock-renewal-shape"
  "typecheck"
 )
@@ -2,6 +2,13 @@ import type { BrainEngine } from './engine.ts';
 import { slugifyPath } from './sync.ts';
 import { getFtsLanguage } from './fts-language.ts';
 import { hnswMaxDimsForType } from './vector-index.ts';
+// runMigrations executes while an initialized engine is live. Keep its helper
+// modules in the static graph rather than importing them from async handlers.
+import {
+  isStatementTimeoutError,
+  isRetryableConnError,
+} from './retry-matcher.ts';
+import { repairTimelineDedupIndex } from './timeline-dedup-repair.ts';

 /**
 * Schema migrations — run automatically on initSchema().
@@ -5801,7 +5808,6 @@ async function runMigrationSQLWithRetry(
  m: Migration,
  sql: string,
 ): Promise<void> {
-  const { isStatementTimeoutError, isRetryableConnError } = await import('./retry-matcher.ts');
  // GBRAIN_MIGRATE_BACKOFF_MS lets tests skip the 5s/15s/45s backoff. In
  // production the env var is unset and the default cadence applies.
  const fastBackoff = process.env.GBRAIN_MIGRATE_BACKOFF_MS;
@@ -6071,7 +6077,6 @@ export async function runMigrations(engine: BrainEngine): Promise<{ applied: num
  // reach the loop below). Best-effort + idempotent: a no-op on a healthy
  // index; `doctor` surfaces it independently if this ever fails.
  try {
-    const { repairTimelineDedupIndex } = await import('./timeline-dedup-repair.ts');
    const r = await repairTimelineDedupIndex(engine);
    if (r.repaired) {
      console.error(
@@ -17,7 +17,26 @@ import type {
  SourceRow,
 } from './engine.ts';
 import { MAX_SEARCH_LIMIT, clampSearchLimit } from './engine.ts';
-import { withRetry, BULK_RETRY_OPTS, resolveBulkRetryOpts, computeNextDelay, type BatchAuditSite } from './retry.ts';
+// Engine-path imports stay static unless a call site carries an explicit
+// engine-dynamic-import-ok justification. The gateway is the only current
+// exception because its local try/catch preserves a soft fallback.
+import {
+  withRetry,
+  BULK_RETRY_OPTS,
+  resolveBulkRetryOpts,
+  computeNextDelay,
+  isRetryableConnError,
+  type BatchAuditSite,
+} from './retry.ts';
+import {
+  valueHash,
+  normalizeDimension,
+  isNovelDimension,
+} from './chronicle/ontology.ts';
+import {
+  resolveRecencyDecayMap,
+  DEFAULT_FALLBACK,
+} from './search/recency-decay.ts';
 import { logBatchRetry as auditLogBatchRetry, logBatchExhausted as auditLogBatchExhausted } from './audit/batch-retry-audit.ts';
 import { runMigrations } from './migrate.ts';
 import { PGLITE_SCHEMA_SQL, getPGLiteSchema } from './pglite-schema.ts';
@@ -419,7 +438,9 @@ export class PGLiteEngine implements BrainEngine {
    let dims: number = DEFAULT_EMBEDDING_DIMENSIONS;
    let model: string = DEFAULT_EMBEDDING_MODEL;
    try {
-      const gw = await import('./ai/gateway.ts');
+      // Keep the gateway lazy: its static closure is large, and evaluation inside
+      // this try/catch preserves the unconfigured-gateway default fallback.
+      const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
      // Both accessors THROW when the gateway is unconfigured (they never
      // return falsy), so the catch below is the only fallback path (#3461).
      dims = gw.getEmbeddingDimensions();
@@ -2264,7 +2285,6 @@ export class PGLiteEngine implements BrainEngine {
      });
    } catch (err) {
      if (err instanceof Error && err.name === 'RetryAbortError') throw err;
-      const { isRetryableConnError } = await import('./retry.ts');
      if (isRetryableConnError(err)) {
        auditLogBatchExhausted(auditSite, batchSize, opts.maxRetries + 1, err);
      }
@@ -2330,7 +2350,9 @@ export class PGLiteEngine implements BrainEngine {
    // rationale — pglite mirrors it for parity.
    let resolvedModel: string | null = null;
    try {
-      const gw = await import('./ai/gateway.ts');
+      // Keep the gateway lazy so module-load failure remains inside this soft
+      // fallback boundary; eager evaluation would bypass the config-row fallback.
+      const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
      resolvedModel = gw.getEmbeddingModel();
    } catch {
      try {
@@ -3842,7 +3864,6 @@ export class PGLiteEngine implements BrainEngine {

  async mergeOntologyFact(obs: OntologyObservationInput): Promise<OntologyMergeResult> {
    const sourceId = obs.sourceId ?? 'default';
-    const { valueHash, normalizeDimension, isNovelDimension } = await import('./chronicle/ontology.ts');
    const dimension = normalizeDimension(obs.dimension);
    const vh = valueHash(obs.value);
    const conf = obs.confidence ?? 0.7;
@@ -6005,7 +6026,6 @@ export class PGLiteEngine implements BrainEngine {
    const recencyBias = opts.recency_bias ?? 'flat';
    let recencySql: string;
    if (recencyBias === 'on') {
-      const { resolveRecencyDecayMap, DEFAULT_FALLBACK } = await import('./search/recency-decay.ts');
      recencySql = buildRecencyComponentSql({
        slugColumn: 'p.slug',
        dateExpr: 'COALESCE(p.effective_date, p.updated_at)',
@@ -13,7 +13,29 @@ import type {
  NewFact, FactListOpts, FactsHealth,
  SourceRow,
 } from './engine.ts';
-import { withRetry, BULK_RETRY_OPTS, resolveBulkRetryOpts, computeNextDelay, type BatchAuditSite } from './retry.ts';
+// Engine-path imports stay static unless a call site carries an explicit
+// engine-dynamic-import-ok justification. The gateway is the only current
+// exception because its local try/catch preserves a soft fallback.
+import {
+  withRetry,
+  BULK_RETRY_OPTS,
+  resolveBulkRetryOpts,
+  computeNextDelay,
+  isRetryableConnError,
+  type BatchAuditSite,
+} from './retry.ts';
+import { isConnectionEndedError } from './retry-matcher.ts';
+import {
+  valueHash,
+  normalizeDimension,
+  isNovelDimension,
+} from './chronicle/ontology.ts';
+import {
+  resolveRecencyDecayMap,
+  DEFAULT_FALLBACK,
+} from './search/recency-decay.ts';
+import { logDbDisconnect } from './audit/db-disconnect-audit.ts';
+import { logPoolRecovery } from './audit/pool-recovery-audit.ts';
 import { logBatchRetry as auditLogBatchRetry, logBatchExhausted as auditLogBatchExhausted } from './audit/batch-retry-audit.ts';
 import type {
  DomainBankSampleOpts, CorpusSampleOpts, DomainBankRow,
@@ -331,7 +353,6 @@ export class PostgresEngine implements BrainEngine {
    // even a no-op disconnect (engine that was never connected) is
    // recorded — that case may itself be a caller-side bug worth seeing.
    try {
-      const { logDbDisconnect } = await import('./audit/db-disconnect-audit.ts');
      logDbDisconnect('postgres', this._connectionStyle ?? 'unknown');
    } catch { /* best-effort; never block disconnect on audit failure */ }
    // v0.30.1: tear down the direct pool first if the manager owns one.
@@ -381,7 +402,9 @@ export class PostgresEngine implements BrainEngine {
    let dims: number = DEFAULT_EMBEDDING_DIMENSIONS;
    let model: string = DEFAULT_EMBEDDING_MODEL;
    try {
-      const gw = await import('./ai/gateway.ts');
+      // Keep the gateway lazy: its static closure is large, and evaluation inside
+      // this try/catch preserves the unconfigured-gateway default fallback.
+      const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
      // Both accessors THROW when the gateway is unconfigured (they never
      // return falsy), so the catch below is the only fallback path (#3461).
      dims = gw.getEmbeddingDimensions();
@@ -2381,8 +2404,8 @@ export class PostgresEngine implements BrainEngine {
      if (err instanceof Error && err.name === 'RetryAbortError') throw err;
      // Best-effort exhausted-retry log. If the error wasn't retryable in
      // the first place, isRetryableConnError(err) is false and we skip.
-      // Lazy-import to avoid a circular dep concern.
-      const { isRetryableConnError } = await import('./retry.ts');
+      // retry.ts is already in this module's static graph through withRetry, so
+      // classifying the exhausted error does not need a second runtime import.
      if (isRetryableConnError(err)) {
        auditLogBatchExhausted(auditSite, batchSize, opts.maxRetries + 1, err);
      }
@@ -2451,7 +2474,9 @@ export class PostgresEngine implements BrainEngine {
    // is the LAST resort (fresh brain whose config row doesn't exist yet).
    let resolvedModel: string | null = null;
    try {
-      const gw = await import('./ai/gateway.ts');
+      // Keep the gateway lazy so module-load failure remains inside this soft
+      // fallback boundary; eager evaluation would bypass the config-row fallback.
+      const gw = await import('./ai/gateway.ts'); // engine-dynamic-import-ok
      resolvedModel = gw.getEmbeddingModel();
    } catch {
      try {
@@ -3983,7 +4008,6 @@ export class PostgresEngine implements BrainEngine {
  async mergeOntologyFact(obs: OntologyObservationInput): Promise<OntologyMergeResult> {
    const sql = this.sql;
    const sourceId = obs.sourceId ?? 'default';
-    const { valueHash, normalizeDimension, isNovelDimension } = await import('./chronicle/ontology.ts');
    const dimension = normalizeDimension(obs.dimension);
    const vh = valueHash(obs.value);
    const conf = obs.confidence ?? 0.7;
@@ -5823,12 +5847,10 @@ export class PostgresEngine implements BrainEngine {
    let isReap = false;
    if (ctx?.error !== undefined) {
      try {
-        const { isConnectionEndedError } = await import('./retry-matcher.ts');
        isReap = isConnectionEndedError(ctx.error);
      } catch { /* classification is best-effort */ }
    }
    try {
-      const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
      logPoolRecovery(isReap ? 'reap_detected' : 'reconnect_other', ctx?.error);
    } catch { /* audit is best-effort */ }

@@ -5852,7 +5874,6 @@ export class PostgresEngine implements BrainEngine {
      // New pool is live — discard the old one best-effort.
      if (oldSql) { try { await oldSql.end({ timeout: 5 }); } catch { /* swallow */ } }
      try {
-        const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
        logPoolRecovery('reconnect_succeeded');
      } catch { /* best-effort */ }
    } catch (err) {
@@ -5864,7 +5885,6 @@ export class PostgresEngine implements BrainEngine {
      this._sql = oldSql;
      this.connectionManager = oldManager;
      try {
-        const { logPoolRecovery } = await import('./audit/pool-recovery-audit.ts');
        logPoolRecovery('reconnect_failed', err);
      } catch { /* best-effort */ }
      throw err; // let batchRetry's backoff handle the retry
@@ -6301,7 +6321,6 @@ export class PostgresEngine implements BrainEngine {
    const recencyBias = opts.recency_bias ?? 'flat';
    let recencySql: string;
    if (recencyBias === 'on') {
-      const { resolveRecencyDecayMap, DEFAULT_FALLBACK } = await import('./search/recency-decay.ts');
      recencySql = buildRecencyComponentSql({
        slugColumn: 'p.slug',
        dateExpr: 'COALESCE(p.effective_date, p.updated_at)',
@@ -0,0 +1,330 @@
+import { afterEach, describe, expect, it, setDefaultTimeout } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const REPO_ROOT = resolve(import.meta.dir, '..', '..');
+const PACKAGE_JSON = resolve(REPO_ROOT, 'package.json');
+const GUARD = resolve(REPO_ROOT, 'scripts', 'check-engine-dynamic-import.sh');
+const VERIFY_DISPATCHER = resolve(REPO_ROOT, 'scripts', 'run-verify-parallel.sh');
+const BASH = process.platform === 'win32'
+  ? resolve(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe')
+  : 'bash';
+const tempDirs: string[] = [];
+
+setDefaultTimeout(30_000);
+
+function fixture(name: string, content: string): string {
+  const dir = mkdtempSync(join(tmpdir(), 'gbrain-engine-import-'));
+  tempDirs.push(dir);
+  const path = join(dir, name);
+  writeFileSync(path, content, 'utf8');
+  return path;
+}
+
+function runGuard(files: string[] = [], cwd = REPO_ROOT) {
+  const result = spawnSync(BASH, [GUARD, ...files], {
+    cwd,
+    encoding: 'utf8',
+    timeout: 30_000,
+  });
+  return {
+    code: result.status ?? -1,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+  };
+}
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe('check-engine-dynamic-import.sh', () => {
+  it('exists', () => {
+    expect(existsSync(GUARD)).toBe(true);
+  });
+
+  it('rejects and reports an unmarked dynamic import', () => {
+    const path = fixture('violator.ts', "async function load() {\n  return await import('./helper.ts');\n}\n");
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+    expect(result.stderr).toContain("await import('./helper.ts')");
+  });
+
+  it('allows a same-line marker for multiple non-gateway imports and ignores comment-only matches', () => {
+    const path = fixture(
+      'allowed.ts',
+      [
+        "// await import('./comment.ts')",
+        '/*',
+        " * await import('./block-body.ts')",
+        ' */',
+        "const first = import('./first.ts'); const second = import('./second.ts'); // engine-dynamic-import-ok",
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain('check-engine-dynamic-import: ok (1 file(s) scanned)');
+  });
+
+  it('rejects live code after a closed leading block comment', () => {
+    const path = fixture(
+      'leading-block-comment.ts',
+      "/* load only when needed */ const helper = await import('./helper.ts');\n",
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+    expect(result.stderr).toContain("await import('./helper.ts')");
+  });
+
+  it('ignores dynamic-import text wholly inside a multiline block comment', () => {
+    const path = fixture(
+      'multiline-block-comment.ts',
+      [
+        '/*',
+        " * await import('./comment-only.ts')",
+        ' */',
+        'const value = 1;',
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain('check-engine-dynamic-import: ok (1 file(s) scanned)');
+  });
+
+  it('reports every violation across multiple files', () => {
+    const first = fixture(
+      'first-violator.ts',
+      "const first = await import('./first.ts');\nconst second = await import('./second.ts');\n",
+    );
+    const second = fixture(
+      'second-violator.ts',
+      "/* explanation */ const third = await import('./third.ts');\n",
+    );
+    const result = runGuard([first, second]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(first)}:1:`);
+    expect(result.stderr).toContain(`${basename(first)}:2:`);
+    expect(result.stderr).toContain(`${basename(second)}:1:`);
+  }, 30_000);
+
+  it('does not mistake comment delimiters inside literals for comments', () => {
+    const path = fixture(
+      'literal-delimiters.ts',
+      [
+        'const url = "https://example.test";',
+        'const block = "/* not a comment";',
+        'const template = `https://example.test`;',
+        'const pattern = /\\/\\//;',
+        "const helper = await import('./helper.ts');",
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:5:`);
+  }, 30_000);
+
+  it('detects bare and trivia-separated dynamic imports', () => {
+    const path = fixture(
+      'dynamic-import-syntax.ts',
+      [
+        "const first = import('./first.ts');",
+        "const second = await import /* explanation */ ('./second.ts');",
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+  }, 30_000);
+
+  it('detects live code after a multiline block comment closes', () => {
+    const path = fixture(
+      'after-multiline-comment.ts',
+      "/*\n * explanation\n */ const helper = await import('./helper.ts');\n",
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:3:`);
+  });
+
+  it('requires the allow marker on the import line', () => {
+    const path = fixture(
+      'marker-line.ts',
+      "// engine-dynamic-import-ok\nconst helper = await import('./helper.ts');\n",
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+  });
+
+  it('does not accept marker text outside comment trivia or within longer comment tokens', () => {
+    const path = fixture(
+      'marker-text.ts',
+      [
+        "const first = import('./engine-dynamic-import-ok.ts');",
+        "const marker = 'engine-dynamic-import-ok'; const second = import('./second.ts');",
+        'const template = `prefix',
+        '// engine-dynamic-import-ok ${import("./third.ts")}`;',
+        "const fourth = import('./fourth.ts'); // no-engine-dynamic-import-ok: not approved",
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+    expect(result.stderr).toContain(`${basename(path)}:4:`);
+    expect(result.stderr).toContain(`${basename(path)}:5:`);
+  });
+
+  it('does not accept markers adjacent to Unicode identifier characters', () => {
+    const path = fixture(
+      'unicode-marker-text.ts',
+      [
+        "const first = import('./first.ts'); // noéengine-dynamic-import-ok: not approved",
+        "const second = import('./second.ts'); // engine-dynamic-import-oké: not approved",
+        "const third = import('./third.ts'); // éengine-dynamic-import-oké: not approved",
+        "const fourth = import('./fourth.ts'); // nóengine-dynamic-import-ok: not approved",
+        "const fifth = import('./fifth.ts'); // 𐐀engine-dynamic-import-ok: not approved",
+        "const sixth = import('./sixth.ts'); // engine-dynamic-import-ok𐐀: not approved",
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+    expect(result.stderr).toContain(`${basename(path)}:3:`);
+    expect(result.stderr).toContain(`${basename(path)}:4:`);
+    expect(result.stderr).toContain(`${basename(path)}:5:`);
+    expect(result.stderr).toContain(`${basename(path)}:6:`);
+  });
+
+  it('allows a marker in real multiline comment trivia on the import line', () => {
+    const path = fixture(
+      'multiline-marker.ts',
+      [
+        '/* rationale',
+        ' * engine-dynamic-import-ok */ const helper = import("./helper.ts");',
+        '',
+      ].join('\n'),
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(0);
+  });
+
+  it('fails on TypeScript parse diagnostics', () => {
+    const path = fixture('malformed.ts', 'const broken = ;\n');
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain('cannot parse input file');
+    expect(result.stderr).toContain(basename(path));
+  });
+
+  it('reports recovered-AST violations alongside parse diagnostics', () => {
+    const path = fixture(
+      'malformed-violator.ts',
+      "const helper = import('./helper.ts');\nconst broken = ;\n",
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain('cannot parse input file');
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+  });
+
+  it('ignores type-position imports', () => {
+    const path = fixture(
+      'type-import.ts',
+      "type Helper = import('./helper.ts').Helper;\n",
+    );
+    const result = runGuard([path]);
+    expect(result.code).toBe(0);
+  });
+
+  it('reports readable-file violations alongside missing inputs', () => {
+    const path = fixture('mixed-violator.ts', "const helper = import('./helper.ts');\n");
+    const missing = join(tmpdir(), `gbrain-engine-import-missing-${process.pid}.ts`);
+    const result = runGuard([path, missing]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:1:`);
+    expect(result.stderr).toContain('cannot read input file');
+    expect(result.stderr).toContain(basename(missing));
+  });
+
+  it('fails when an explicit input file is missing', () => {
+    const missing = join(tmpdir(), `gbrain-engine-import-missing-${process.pid}.ts`);
+    const result = runGuard([missing]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain('cannot read input file');
+    expect(result.stderr).toContain(basename(missing));
+  });
+
+  it('resolves default inputs from the guard repository', () => {
+    const foreign = mkdtempSync(join(tmpdir(), 'gbrain-engine-import-foreign-'));
+    tempDirs.push(foreign);
+    const foreignCore = join(foreign, 'src', 'core');
+    mkdirSync(foreignCore, { recursive: true });
+    expect(spawnSync('git', ['init', '-q'], { cwd: foreign }).status).toBe(0);
+    writeFileSync(
+      join(foreignCore, 'pglite-engine.ts'),
+      "const foreign = import('./foreign.ts');\n",
+      'utf8',
+    );
+    for (const name of ['postgres-engine.ts', 'migrate.ts']) {
+      writeFileSync(join(foreignCore, name), '', 'utf8');
+    }
+
+    const result = runGuard([], foreign);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain('check-engine-dynamic-import: ok (3 file(s) scanned)');
+  }, 30_000);
+
+  it('still catches a violation in CRLF input', () => {
+    const path = fixture('crlf.ts', "async function load() {\r\n  return await import('./helper.ts');\r\n}\r\n");
+    const result = runGuard([path]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain(`${basename(path)}:2:`);
+  });
+
+  it('passes on the reconciled repository sources', () => {
+    const result = runGuard();
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain('check-engine-dynamic-import: ok (3 file(s) scanned)');
+  }, 30_000);
+});
+
+describe('engine dynamic-import guard wiring', () => {
+  it('is invoked through bash by check:all', () => {
+    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')) as {
+      scripts: Record<string, string>;
+    };
+    expect(pkg.scripts['check:engine-dynamic-import']).toBe(
+      'bash scripts/check-engine-dynamic-import.sh',
+    );
+    expect(pkg.scripts['check:all']).toContain(
+      'bash scripts/check-engine-dynamic-import.sh',
+    );
+  });
+
+  it('is listed by the authoritative verify dispatcher', () => {
+    const result = spawnSync(BASH, [VERIFY_DISPATCHER, '--dry-list'], {
+      cwd: REPO_ROOT,
+      encoding: 'utf8',
+      timeout: 30_000,
+    });
+    expect(result.status).toBe(0);
+    expect(new Set((result.stdout ?? '').trim().split('\n'))).toContain(
+      'check:engine-dynamic-import',
+    );
+  });
+});