@velarscript/compiler 0.12.0 → 0.13.0

package/dist/analyzer.js

@@ -1,11 +1,90 @@
 import { blockContainsDirectAwait } from "./ast.js";
 import { isPermanentNamespaceName } from "./core-vocabulary.js";
-import { diagnostic, mechanicalEdits, mechanicalFix, recoveredDiagnostic } from "./diagnostic.js";
+import { advisory, diagnostic, mechanicalEdits, mechanicalFix, recoveredDiagnostic } from "./diagnostic.js";
 import { VELAR_HOST_ERROR_NAMES, VELAR_HOST_ERROR_PATH_NAMES } from "./error-runtime.js";
 import { collectionMemberGuidance, removedGlobalFunctionGuidance, stringMemberGuidance, REST_PARAMETER_ELEMENT_TYPE_MESSAGE } from "./language-guidance.js";
 import { bindingNameRestriction } from "./source-names.js";
 import { span, spanIdentity } from "./source.js";
-import { analysisTypeIdentity, anyType, binaryStorageKind, boolType, boundGrants, collectGenericBoundViolations, collectTypeArgumentBoundViolations, describeType, genericApplicationType, instantiateGenericCallable, invalidType, isInvalidType, isAssignable, isReadonlyView, isTextConvertibleType, isTypeParameterBound, typeParameterBoundNames, mergeTypes, mutableViewOf, nullType, nonOptional, numberType, optionalOf, resolveTypeReference, readonlyViewOf, resolvedAsyncType, semanticTypeIdentity, sameType, sameTypeIgnoringCallableParameterNames, stringType, substituteTypeParameters, textConvertibleType, typeContainsParameter, typeContainsRuntimeTypeCheck, unifyTypeParameters, unionOf, unknownType, } from "./types.js";
+import { analysisTypeIdentity, anyType, binaryStorageKind, boolType, boundGrants, boundaryUnknownType, collectGenericBoundViolations, collectTypeArgumentBoundViolations, describeType, genericApplicationType, instantiateGenericCallable, invalidType, isInvalidType, isAssignable, isReadonlyView, isTextConvertibleType, isTypeParameterBound, typeParameterBoundNames, mergeTypes, mutableViewOf, nullType, nonOptional, numberType, optionalOf, resolveTypeReference, readonlyViewOf, resolvedAsyncType, semanticTypeIdentity, sameType, sameTypeIgnoringCallableParameterNames, stringType, substituteTypeParameters, textConvertibleType, typeContainsAnyOutput, typeContainsParameter, typeContainsRuntimeTypeCheck, unifyTypeParameters, unionOf, unknownType, } from "./types.js";
+/**
+ * How many back-edge passes may be running at once. One is what a single-level
+ * loop needs, and three covers a loop nest three deep — the deepest anyone
+ * writes on purpose — with every level analyzed exactly as before. Past that
+ * the count stops doubling per level: fourteen levels went from 3.2 seconds to
+ * 0.2, and seventeen from 30 seconds to 0.4.
+ */
+const maximumLoopReanalysisDepth = 3;
+/**
+ * D90 R12: the class and record names a consumer can read a value *out of*
+ * this type, collected into two frontiers so `exportReachableClasses` can walk
+ * a record's fields without recursing through a cyclic record here.
+ *
+ * It visits output positions for the reason `typeContainsAnyOutput` (types.ts)
+ * does: an input position accepts a value *from* the consumer, so a class
+ * named there is one the consumer already had. The one deliberate difference
+ * is an extension type's `properties`, documented at that case.
+ */
+function collectOutputTypeNames(type, classes, records) {
+    switch (type.kind) {
+        case "class":
+        case "classConstructor":
+            classes.push(type.name);
+            return;
+        case "optional":
+            collectOutputTypeNames(type.inner, classes, records);
+            return;
+        case "list":
+        case "set":
+            collectOutputTypeNames(type.element, classes, records);
+            return;
+        case "map":
+            collectOutputTypeNames(type.key, classes, records);
+            collectOutputTypeNames(type.value, classes, records);
+            return;
+        case "record":
+        case "promise":
+        case "runtimeType":
+            collectOutputTypeNames(type.value, classes, records);
+            return;
+        case "object":
+            for (const field of type.fields.values())
+                collectOutputTypeNames(field, classes, records);
+            return;
+        case "named":
+        case "typeObject":
+            // A `named` may still denote a class before resolveNamedClasses runs, so
+            // the name joins both frontiers; the one that does not match a
+            // declaration simply finds nothing.
+            classes.push(type.name);
+            records.push(type.name);
+            for (const argument of type.kind === "named" ? type.application?.arguments ?? [] : []) {
+                collectOutputTypeNames(argument, classes, records);
+            }
+            return;
+        case "extension":
+            // An extension family's `properties` are its *named parameters* — a Web
+            // component's props are supplied by whoever renders it — so they are the
+            // `function` case's `parameters` under another spelling, and are skipped
+            // for the same reason. Walking them made `export component Panel(inner:
+            // Inner)` report `Inner`'s inferred member while `export def take(box:
+            // Inner)` stayed silent: one question, two answers. `arguments` carry
+            // the family's payload — a component's exposed Handle, a route input's
+            // validated value, a provider's result — which a consumer does read out.
+            for (const argument of type.arguments)
+                collectOutputTypeNames(argument, classes, records);
+            return;
+        case "function":
+        case "action":
+        case "intrinsic":
+            collectOutputTypeNames(type.result, classes, records);
+            return;
+        case "union":
+            for (const member of type.members)
+                collectOutputTypeNames(member, classes, records);
+            return;
+        default:
+    }
+}
 function continuesOptionalChain(expression) {
     if (expression.kind === "MemberExpression") {
         return expression.optional || continuesOptionalChain(expression.object);
@@ -99,26 +178,53 @@ function sameInferredResult(left, right) {
         return false;
     return sameType(left, right);
 }
+/** The furthest a suggestion may be from what was written. */
+const nearestNameLimit = 2;
+/**
+ * Edit distance, abandoned as soon as it is known to exceed `nearestNameLimit`.
+ * Only cells within that many steps of the diagonal can hold a value inside the
+ * limit, so each row is a fixed-width band rather than the whole right operand,
+ * and a row whose every cell is already over the limit ends the walk.
+ */
+function boundedEditDistance(left, right) {
+    const over = nearestNameLimit + 1;
+    if (Math.abs(left.length - right.length) > nearestNameLimit)
+        return over;
+    let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+    let current = new Array(right.length + 1).fill(over);
+    for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
+        const from = Math.max(1, leftIndex - nearestNameLimit);
+        const to = Math.min(right.length, leftIndex + nearestNameLimit);
+        current[from - 1] = from === 1 ? leftIndex : over;
+        let rowBest = current[from - 1];
+        for (let rightIndex = from; rightIndex <= to; rightIndex += 1) {
+            const cell = Math.min(previous[rightIndex] + 1, current[rightIndex - 1] + 1, previous[rightIndex - 1] + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1));
+            current[rightIndex] = cell;
+            if (cell < rowBest)
+                rowBest = cell;
+        }
+        if (to < right.length)
+            current[to + 1] = over;
+        if (rowBest > nearestNameLimit)
+            return over;
+        const swap = previous;
+        previous = current;
+        current = swap;
+    }
+    return previous[right.length];
+}
 /** Returns the sole nearest spelling within two edits, never an ambiguous guess. */
 function uniqueNearestName(requested, candidates) {
-    const distance = (left, right) => {
-        let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
-        for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
-            const current = [leftIndex];
-            for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) {
-                current[rightIndex] = Math.min(previous[rightIndex] + 1, current[rightIndex - 1] + 1, previous[rightIndex - 1] + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1));
-            }
-            previous = current;
-        }
-        return previous[right.length];
-    };
+    // A Set argument is already deduplicated; copying it again cost one full
+    // rebuild per unresolved name for nothing.
+    const unique = candidates instanceof Set ? candidates : new Set(candidates);
     let best = null;
-    let bestDistance = 3;
+    let bestDistance = nearestNameLimit + 1;
     let tied = false;
-    for (const candidate of new Set(candidates)) {
-        if (candidate === requested || Math.abs(candidate.length - requested.length) > 2)
+    for (const candidate of unique) {
+        if (candidate === requested || Math.abs(candidate.length - requested.length) > nearestNameLimit)
             continue;
-        const candidateDistance = distance(requested, candidate);
+        const candidateDistance = boundedEditDistance(requested, candidate);
         if (candidateDistance < bestDistance) {
             best = candidate;
             bestDistance = candidateDistance;
@@ -128,7 +234,83 @@ function uniqueNearestName(requested, candidates) {
             tied = true;
         }
     }
-    return bestDistance <= 2 && !tied ? best : null;
+    return bestDistance <= nearestNameLimit && !tied ? best : null;
+}
+/**
+ * The roster a "did you mean" reads. It used to be rebuilt — core vocabulary,
+ * extension globals, imports, and every name in every live scope — and then run
+ * through a full edit-distance pass, once per unresolved name, which made a
+ * module of typos quadratic in its own size. The roster is now maintained as
+ * scopes come and go, and each name is filed under the strings left by deleting
+ * up to two of its characters: two spellings within two edits always share one
+ * of those, so a query reads a few buckets instead of the whole roster.
+ */
+class NearestNameRoster {
+    counts = new Map();
+    /** Filled on the first question asked of the roster; a module with no typo never pays for it. */
+    buckets = null;
+    add(name) {
+        const seen = this.counts.get(name) ?? 0;
+        this.counts.set(name, seen + 1);
+        if (seen === 0)
+            this.file(name);
+    }
+    remove(name) {
+        const seen = this.counts.get(name) ?? 0;
+        if (seen === 0)
+            return;
+        if (seen > 1) {
+            this.counts.set(name, seen - 1);
+            return;
+        }
+        this.counts.delete(name);
+        if (!this.buckets)
+            return;
+        for (const key of deletionKeys(name)) {
+            const bucket = this.buckets.get(key);
+            if (!bucket)
+                continue;
+            bucket.delete(name);
+            if (bucket.size === 0)
+                this.buckets.delete(key);
+        }
+    }
+    nearest(requested) {
+        if (!this.buckets) {
+            this.buckets = new Map();
+            for (const name of this.counts.keys())
+                this.file(name);
+        }
+        const candidates = new Set();
+        for (const key of deletionKeys(requested)) {
+            for (const candidate of this.buckets.get(key) ?? [])
+                candidates.add(candidate);
+        }
+        return uniqueNearestName(requested, candidates);
+    }
+    file(name) {
+        if (!this.buckets)
+            return;
+        for (const key of deletionKeys(name)) {
+            const bucket = this.buckets.get(key);
+            if (bucket)
+                bucket.add(name);
+            else
+                this.buckets.set(key, new Set([name]));
+        }
+    }
+}
+/** `name` with up to `nearestNameLimit` characters deleted, the shared key of any two near spellings. */
+function deletionKeys(name) {
+    const keys = [name];
+    for (let first = 0; first < name.length; first += 1) {
+        const once = name.slice(0, first) + name.slice(first + 1);
+        keys.push(once);
+        for (let second = first; second < once.length; second += 1) {
+            keys.push(once.slice(0, second) + once.slice(second + 1));
+        }
+    }
+    return keys;
 }
 const corePrimitiveNames = new Set(["string", "number", "bool", "null", "unknown", "Duration"]);
 const builtinTypeNames = new Set(["string", "number", "bool", "null", "unknown", "any", "List", "Set", "Map", "Record", "Promise", "Function", "Type", "Duration"]);
@@ -156,6 +338,14 @@ export const disposeMemberKey = "__velar:dispose";
  * member can answer it by accident and no author call can reach it.
  */
 export const iterateMemberKey = "__velar:iterate";
+/**
+ * The emitted member behind the asynchronous `@iterate:` form (D90 R18). It is
+ * a separate key because the two forms answer different questions — the
+ * synchronous member returns the finished collection once, this one is an
+ * async method `async for` pulls once per element — so no lowering can confuse
+ * one for the other.
+ */
+export const iterateAsyncMemberKey = "__velar:iterateAsync";
 /** What each bound admits, written the way a rejected call needs to hear it. */
 const boundVocabularyGuidance = {
     Text: "a Text parameter accepts the types with a hook-free text form — strings, numbers, bools, enums, and null",
@@ -190,23 +380,111 @@ const coreGlobalGuidance = new Map([
     ["len", "Use 'value.size'; strings and collections measure with the size member"],
     ["parseInt", "Use 'number(text)', then '.floor()' or '.round()' for an integer; VelarScript has one text-to-number conversion"],
     ["parseFloat", "Use 'number(text)'; VelarScript has one text-to-number conversion"],
+    // D89 (message correction): `enumerate` and `zip` are the two Python loop
+    // reflexes that reached an unadorned "Unknown name" with no successor at all
+    // — `zip` even earned a "did you mean 'Map'?". `enumerate` has a spelling
+    // that needs no import, so the loop is named first; `zip` has none, so its
+    // guidance is the import that makes it exist.
+    ["enumerate", "Use the two-slot loop — 'for value, index in values:' — which binds the value first; 'enumerate' is an import from \"velar/collections\" when you want the '{index, value}' List itself"],
+    ["zip", "Import the builder — 'import {zip} from \"velar/collections\"' — it pairs two Lists as '{first, second}' up to the shorter length"],
     ["stringify", "Use Json.stringify(value) directly; VelarScript's pure namespaces need no import"],
     ["parse", "Use Json.parse(text) directly; VelarScript's pure namespaces need no import"],
+    // D90 (coherence): the rest of the Python builtin surface a model reaches
+    // for. Every one of these had an answer sitting in a roster the compiler
+    // already owns, and reached the author either as a bare "Unknown name" or —
+    // worse — as a confident edit-distance guess at an unrelated name (`sum` ->
+    // `str`, `max` -> `Map`, `map` -> `Map`). Naming the successor also
+    // suppresses the guess, because guidance is consulted first.
+    ["sum", "Use 'values.sum()'; totalling is a List member"],
+    ["min", "Use 'Math.min(a, b)' for two numbers, or 'values.min()' for a List"],
+    ["max", "Use 'Math.max(a, b)' for two numbers, or 'values.max()' for a List"],
+    ["sorted", "Use 'values.sorted()'; it returns a new List and never mutates the receiver"],
+    ["reversed", "Use 'values.reversed()'; it returns a new List and never mutates the receiver"],
+    ["any", "Use 'values.some(test)'; the collection members carry the quantifiers"],
+    ["all", "Use 'values.every(test)'; the collection members carry the quantifiers"],
+    ["filter", "Use 'values.filter(test)'; the collection members carry the transforms"],
+    ["map", "Use 'values.map(transform)'; 'Map' with a capital M is the key-value collection, not the transform"],
+    ["isinstance", "Use the 'is' operator — 'value is Type' — which also narrows the binding inside the branch"],
+    ["pow", "Use 'Math.pow(base, exponent)'"],
+    ["divmod", "Use '(a / b).floor()' for the quotient and 'a % b' for the remainder; VelarScript returns one value per operation"],
+    ["repr", "Use 'print(value)' to inspect a value, 'str(value)' for its text form, or 'Json.stringify(value)' for data text"],
+    ["format", "Use an f-string — 'f\"{value}\"' — and format the value first: 'value.toFixed(2)' for fixed decimals, 'str(value).padStart(size)' for width"],
+    ["type", "Use 'value is Type' to test a value's type, and a 'type' declaration to name one; VelarScript has no runtime type-of function"],
+    ["iter", "Use a 'for' loop over the collection — 'for value in values:' — VelarScript has no 'iter'/'next' iterator pair"],
+    ["next", "Use a 'for' loop over the collection — 'for value in values:' — VelarScript has no 'iter'/'next' iterator pair"],
+    ["tuple", "Use a List — '[a, b]' — for a positional sequence, or a record — '{first: a, second: b}' — for named parts; VelarScript has no tuple type"],
+    ["bytes", "Import the Bytes type — 'import {Bytes} from \"velar/binary\"' — which is VelarScript's immutable byte snapshot"],
+    // The two capability answers. A terminal and a filesystem are target
+    // capabilities rather than prelude names, so the message names the module
+    // and says which extension carries it instead of implying a bare Core
+    // module can import it.
+    ["input", "Use velar/terminal — 'terminal.readLine(prompt)' returns the next line — a terminal is a target capability, so it arrives with the @velarscript/node extension rather than the Core prelude"],
+    ["open", "Use velar/fs to read or write a file, and 'using name = ...' to own a handle that must be released; a filesystem is a target capability, so it arrives with the @velarscript/node extension rather than the Core prelude"],
+    // D90 (coherence): the target-neutral host globals. Each of these is
+    // answered by a name a plain Core module can already reach, so the answer
+    // belongs here rather than in a target extension. `process`, `Buffer`,
+    // `require`, `localStorage` and the rest of the target-specific roster stay
+    // with the extension that owns their successor.
+    ["setTimeout", "Use 'await Promise.sleep(250ms)' and then run the work; VelarScript waits with a Duration rather than a callback and a millisecond number"],
+    ["setInterval", "Use a loop with 'await Promise.sleep(1s)' in it, or velar/task's 'task(work)' when the repetition must be cancellable; VelarScript has no callback scheduler"],
+    ...["clearTimeout", "clearInterval"].map((name) => [
+        name,
+        "There is no callback scheduler to clear; 'await Promise.sleep(250ms)' waits inline, and velar/task's 'task(work)' is the schedule a Cancellation can stop",
+    ]),
+    ["structuredClone", "Use 'Json.clone(value, Target)'; it validates against the runtime type as it copies"],
+    ["RegExp", "Use the Text pattern members — 'Text.matches', 'Text.findMatch', 'Text.findMatches', 'Text.replaceMatches' — which take the pattern as text"],
+    ["TextEncoder", "Use 'Text.utf8Size(value)' for the byte count, and \"velar/binary\" for the byte vocabulary itself; VelarScript does not expose the TextEncoder global"],
+    ["TextDecoder", "Use \"velar/binary\" for the byte vocabulary; VelarScript does not expose the TextDecoder global"],
+    ["URL", "Import from \"velar/url\" — 'parse', 'join', 'query', 'withQuery', 'encode' — instead of the URL global"],
+    ["AbortController", "Use the Cancellation that velar/task's 'task(work)' passes into its work; VelarScript cancels through that value rather than a signal object"],
+    ["Symbol", "VelarScript has no symbol type; use an enum for a closed set of names, or a plain string constant for a unique key"],
+    // `velar/worker` is a Core module, so the ambient `Worker` a host offers is
+    // answered once here rather than twice in the two extensions that also carry
+    // a worker surface.
+    ["Worker", "Import the builder — 'import {worker} from \"velar/worker\"' — it starts a typed worker from an entry declared in velar.json, and 'workerPool' runs several of them"],
     ...["length", "char", "slice", "trim", "lower", "upper", "startsWith", "endsWith", "includes", "split", "replace", "replaceAll", "repeat", "padStart", "padEnd", "abs", "round", "floor", "ceil", "isFinite", "isInteger"]
         .map((name) => [name, removedGlobalFunctionGuidance(name)]),
 ]);
+/**
+ * D90 (coherence): the foreign builtins — Python's and the host's — that a
+ * model writes from prior knowledge. A "did you mean" is an edit-distance
+ * guess over names this module can actually see, and on a foreign builtin it
+ * is confidently wrong: `sum` earned `str`, `max` and `map` earned `Map`,
+ * `dir` earned `str`. docs/ai-skill.md tells the model to do exactly what the
+ * diagnostic says, so a wrong successor is worse than none.
+ *
+ * Every name that has a Vel answer is in `coreGlobalGuidance` above, which is
+ * consulted first and short-circuits the guess on its own. This roster is the
+ * floor under the rest: a foreign builtin with no successor reads as a bare
+ * unknown name and stops there. It is deliberately a suppression rather than a
+ * change to `uniqueNearestName`, whose threshold and roster serve the field-
+ * name hints too.
+ */
+const foreignBuiltinNames = new Set([
+    // Python
+    "sum", "min", "max", "sorted", "reversed", "any", "all", "isinstance", "input", "open",
+    "filter", "map", "repr", "dir", "type", "id", "next", "iter", "format", "divmod", "pow",
+    "bytes", "tuple", "frozenset", "globals", "locals", "vars", "hasattr", "getattr", "setattr",
+    "callable", "issubclass", "abs", "round", "ord", "chr", "hex", "oct", "bin", "hash",
+    // Node and browser hosts
+    "setTimeout", "setInterval", "clearTimeout", "clearInterval", "structuredClone", "queueMicrotask",
+    "URL", "URLSearchParams", "RegExp", "TextEncoder", "TextDecoder", "AbortController", "AbortSignal",
+    "Symbol", "Proxy", "Reflect", "WeakMap", "WeakSet", "BigInt", "Intl", "globalThis",
+    "process", "Buffer", "require", "__dirname", "__filename", "module", "exports", "global",
+    "localStorage", "sessionStorage", "fetch", "document", "window", "navigator", "alert",
+]);
 const durationType = { kind: "named", name: "Duration" };
 const namespaceFunction = (name, parameterNames, parameters, result, requiredParameters = parameters.length) => ({ kind: "intrinsic", name, parameterNames, parameters, requiredParameters, result });
 const promiseOf = (value) => ({ kind: "promise", value });
 const jsonNamespaceType = {
     kind: "object",
     fields: new Map([
-        ["parse", namespaceFunction("json.parse", ["text", "target"], [stringType, anyType], unknownType, 1)],
-        ["tryParse", namespaceFunction("json.tryParse", ["text", "target", "fallback"], [stringType, anyType, anyType], unknownType, 1)],
-        ["stringify", namespaceFunction("json.stringify", ["value", "pretty"], [anyType, { kind: "union", members: [boolType, numberType] }], stringType, 1)],
-        ["stableStringify", namespaceFunction("json.stableStringify", ["value", "pretty"], [anyType, { kind: "union", members: [boolType, numberType] }], stringType, 1)],
-        ["clone", namespaceFunction("json.clone", ["value", "target"], [anyType, anyType], anyType, 1)],
-        ["isSerializable", { kind: "function", parameterNames: ["value"], parameters: [anyType], requiredParameters: 1, result: boolType }],
+        ["parse", namespaceFunction("json.parse", ["text", "target"], [stringType, unknownType], unknownType, 1)],
+        ["tryParse", namespaceFunction("json.tryParse", ["text", "target", "fallback"], [stringType, unknownType, unknownType], unknownType, 1)],
+        ["stringify", namespaceFunction("json.stringify", ["value", "pretty"], [unknownType, { kind: "union", members: [boolType, numberType] }], stringType, 1)],
+        ["stableStringify", namespaceFunction("json.stableStringify", ["value", "pretty"], [unknownType, { kind: "union", members: [boolType, numberType] }], stringType, 1)],
+        ["clone", namespaceFunction("json.clone", ["value", "target"], [unknownType, unknownType], unknownType, 1)],
+        ["isSerializable", { kind: "function", parameterNames: ["value"], parameters: [unknownType], requiredParameters: 1, result: boolType }],
     ]),
     readonlyFields: new Set(["parse", "tryParse", "stringify", "stableStringify", "clone", "isSerializable"]),
 };
@@ -273,13 +551,13 @@ const textNamespaceType = {
 const promiseNamespaceType = {
     kind: "object",
     fields: new Map([
-        ["all", namespaceFunction("async.all", ["values"], [anyType], promiseOf(anyType))],
-        ["race", namespaceFunction("async.race", ["values"], [{ kind: "list", element: anyType }], promiseOf(anyType))],
+        ["all", namespaceFunction("async.all", ["values"], [unknownType], promiseOf(unknownType))],
+        ["race", namespaceFunction("async.race", ["values"], [{ kind: "list", element: unknownType }], promiseOf(unknownType))],
         ["sleep", { kind: "function", parameterNames: ["duration"], parameters: [durationType], requiredParameters: 1, result: promiseOf(nullType) }],
-        ["timeout", namespaceFunction("async.timeout", ["value", "duration", "message"], [promiseOf(anyType), durationType, stringType], promiseOf(anyType), 2)],
-        ["retry", namespaceFunction("async.retry", ["task", "attempts", "delay"], [anyType, numberType, durationType], promiseOf(anyType), 1)],
-        ["map", namespaceFunction("async.map", ["values", "worker", "concurrency"], [{ kind: "list", element: anyType }, anyType, numberType], promiseOf({ kind: "list", element: anyType }), 2)],
-        ["series", namespaceFunction("async.series", ["tasks"], [{ kind: "list", element: anyType }], promiseOf({ kind: "list", element: anyType }))],
+        ["timeout", namespaceFunction("async.timeout", ["value", "duration", "message"], [promiseOf(unknownType), durationType, stringType], promiseOf(unknownType), 2)],
+        ["retry", namespaceFunction("async.retry", ["task", "attempts", "delay"], [unknownType, numberType, durationType], promiseOf(unknownType), 1)],
+        ["map", namespaceFunction("async.map", ["values", "worker", "concurrency"], [{ kind: "list", element: unknownType }, unknownType, numberType], promiseOf({ kind: "list", element: unknownType }), 2)],
+        ["series", namespaceFunction("async.series", ["tasks"], [{ kind: "list", element: unknownType }], promiseOf({ kind: "list", element: unknownType }))],
     ]),
     readonlyFields: new Set(["all", "race", "sleep", "timeout", "retry", "map", "series"]),
 };
@@ -344,8 +622,9 @@ const coreVocabularyTypes = {
     // `values.map(str)` — is checked against the same whitelist the direct
     // call form uses instead of executing a 'toString' hook.
     str: { kind: "function", parameterNames: ["value"], parameters: [textConvertibleType], requiredParameters: 1, result: stringType },
-    // `print` inspects any value by contract and keeps the `any` domain.
-    print: { kind: "function", parameterNames: ["value"], parameters: [anyType], requiredParameters: 1, result: nullType },
+    // `print` inspects any value by contract; its domain is the top type for
+    // assignment targets (D90 R17 keeps `any` for boundary declarations only).
+    print: { kind: "function", parameterNames: ["value"], parameters: [unknownType], requiredParameters: 1, result: nullType },
     // D47 rule 81: equals(a, b) — deep structural comparison over data.
     // Pure computation, so it lives in the prelude beside str/print; the
     // call site owns the domain checks (inferEqualsCall).
@@ -455,10 +734,120 @@ function externClassContract(info) {
         methodEntries(info.staticMethods),
     ]);
 }
+// D89 A2's two rosters. They are deliberately short: every name here is one a
+// Python author reaches for without thinking, and a name that has to be argued
+// for is a name the advisory would be guessing about.
+const loopIndexSlotNames = new Set(["i", "idx", "index", "pos", "position"]);
+const loopValueSlotNames = new Set(["v", "value", "item", "el", "element"]);
+/**
+ * The singular of the iterated collection's own name, so `for i, user in
+ * users` reads as the same swap as `for i, v in users`. Only a plain name is
+ * read; an arbitrary expression has no name to make singular.
+ */
+function singularIterableName(iterable) {
+    const name = iterable.kind === "IdentifierExpression" ? iterable.name
+        : iterable.kind === "MemberExpression" ? iterable.property
+            : null;
+    if (name === null || !name.endsWith("s") || name.endsWith("ss"))
+        return null;
+    if (name.endsWith("ies"))
+        return `${name.slice(0, -3)}y`;
+    if (/(?:ch|sh|[sxz])es$/u.test(name))
+        return name.slice(0, -2);
+    return name.slice(0, -1);
+}
+/**
+ * D85 rule 207: does this type still carry an unsettled collection — a List or
+ * Set element, or a Map's key and value together, that stayed `unknown`?
+ *
+ * This is the gate on the walk below, and it is what makes rule 208's boundary
+ * fall out of the semantics instead of out of a syntax list. `Set().size` is a
+ * number: nothing the empty `Set()` failed to say reaches the name, so the walk
+ * never descends to it. `[["a"], []]` is a `List<List<string>>`: the sibling
+ * element already said what the empty one holds, so there is nothing left to
+ * report. Only a hole that survives all the way out to the binding is a hole
+ * the author has to close.
+ */
+function carriesUnsettledCollection(type, seen = new Set()) {
+    if (seen.has(type))
+        return false;
+    seen.add(type);
+    switch (type.kind) {
+        case "list":
+        case "set":
+            return type.element.kind === "unknown" || carriesUnsettledCollection(type.element, seen);
+        case "map":
+            // A Map settles when either half does: `Map<string, unknown>` says its
+            // keys are strings, and only `Map()` with nothing at all is unsettled.
+            return (type.key.kind === "unknown" && type.value.kind === "unknown")
+                || carriesUnsettledCollection(type.key, seen)
+                || carriesUnsettledCollection(type.value, seen);
+        case "optional":
+            return carriesUnsettledCollection(type.inner, seen);
+        case "record":
+        case "promise":
+            return carriesUnsettledCollection(type.value, seen);
+        case "object":
+            return [...type.fields.values()].some((field) => carriesUnsettledCollection(field, seen));
+        case "union":
+            return type.members.some((member) => carriesUnsettledCollection(member, seen));
+        default:
+            return false;
+    }
+}
+/**
+ * D85 rule 207: the sub-expressions whose value becomes part of this
+ * expression's value, so each of them is a position that has to say what an
+ * empty collection written there holds.
+ *
+ * A receiver and an argument are here, but the caller only asks for them once
+ * `carriesUnsettledCollection` has said the enclosing value still has the hole
+ * in it — so `const a = [].copy()` and `const a = id([])` report at the `[]`
+ * that made the hole, while `print(Set().size)` and `const n = Set().size`
+ * never reach the receiver at all. That is rule 208 stated as a property of the
+ * value rather than as a list of node kinds.
+ */
+function settlingValuePositions(expression) {
+    switch (expression.kind) {
+        case "ConditionalExpression":
+            return [expression.thenValue, expression.elseValue];
+        case "ListExpression":
+            return expression.elements.map((element) => element.kind === "SpreadExpression" ? element.value : element);
+        case "ObjectExpression":
+            return expression.properties.map((entry) => entry.value);
+        case "BinaryExpression":
+            return expression.operator === "??" ? [expression.left, expression.right] : [];
+        case "CallExpression":
+            return [
+                ...(expression.callee.kind === "MemberExpression" ? [expression.callee.object] : []),
+                ...expression.arguments.map((argument) => argument.kind === "SpreadExpression" ? argument.value : argument),
+            ];
+        case "MemberExpression":
+            return [expression.object];
+        case "IndexExpression":
+            return [expression.object];
+        default:
+            return [];
+    }
+}
 export class Analyzer {
     diagnostics = [];
+    advisories = [];
+    advisedIdentities = new Set();
     scopes = [new Map()];
     memberNarrowings = [new Map()];
+    /** Per scope depth, the names a narrowing has written there; see `narrowingsForVisibleBindings`. */
+    narrowedNames = [new Set()];
+    /** How many loop back-edge passes are running; see `reanalyzeLoopBackEdge`. */
+    loopReanalysisDepth = 0;
+    /** The "did you mean" roster, and the names each scope depth contributed to it. */
+    nearestNames = new NearestNameRoster();
+    scopedNames = [[]];
+    nearestNamesSeeded = false;
+    /** Per scope depth, the bindings flow analysis has written; see `snapshotFlowFacts`. */
+    flowTouched = [new Set()];
+    /** What each of those held before its first write, or null for a shadow born mid-flow. */
+    flowOrigins = new Map();
     namedTypes = new Map();
     namedTypeReadonlyFields = new Map();
     namedTypeIdentities = new Map();
@@ -509,12 +898,10 @@ export class Analyzer {
     classDisposeChains = new Map();
     /** D68 rule 177: expression spans a consumer iterates through `@iterate:`. */
     iterationContracts = new Set();
-    /**
-     * D68 rule 177: the function depth of each `@iterate:` body being analyzed.
-     * A nested arrow inside the block is an ordinary callable and keeps the
-     * ordinary advice, so the contract's own message needs the exact depth.
-     */
-    iterateContractDepths = [];
+    /** D90 R18: `async for` statements pulling a declared asynchronous `@iterate:`. */
+    asyncIterationStatements = new Set();
+    /** D90 R18: `@iterate:` blocks that are the asynchronous pull form, by keyword span. */
+    asyncIterateBlocks = new Set();
     /** D51 rule 101: arrows that read a `using`-owned binding, by arrow span. */
     arrowOwnedCaptures = new Map();
     arrowCaptureFrames = [];
@@ -591,6 +978,22 @@ export class Analyzer {
     inferredFunctionResultSeeds;
     inferredFunctionResultTypes = new Map();
     finalizeFunctionResultInference;
+    /**
+     * D85 rule 209: one mistake is reported once. A reported VEL4039 hands its
+     * position `invalidType`, and an invalid body-inferred result is otherwise a
+     * convergence failure — so the four collections below carry the *reported*
+     * hole forward, and only that hole, to the place VEL4025 is decided.
+     * `reportedCollectionHoles` are the names bound to one, `reportedResultHoles`
+     * the local function results that are one, `functionResultKeys` maps a
+     * callable name to the result a call to it reaches, and
+     * `deferredConvergenceReports` holds the reports whose answer needs a callee
+     * that may be declared further down the module.
+     */
+    reportedCollectionHoles = new Set();
+    bindingHoleCauses = new Map();
+    reportedResultHoles = new Set();
+    functionResultKeys = new Map();
+    deferredConvergenceReports = [];
     logicalConditionNarrowings = new Map();
     privateFields = new Map();
     privateGetters = new Map();
@@ -624,8 +1027,27 @@ export class Analyzer {
     /** Namespace import locals by name, known before signature validation runs (ENM-I9 teaching). */
     namespaceImportLocals = new Map();
     initializationImportReadSites = new Map();
+    /**
+     * D31 item 23's recorded residual: a top-level call of a module-local
+     * function runs that body during module evaluation, so a read of an imported
+     * binding inside it is an initialization-position read reached through one
+     * hop. The stack is the function frame a deferred read belongs to; the map
+     * is that frame by the name it was bound to, so a call resolves to it after
+     * the whole module is analyzed and hoisting order stops mattering.
+     */
+    deferredReadFrames = [];
+    localFunctionFrames = new Map();
+    arrowDeferredFrames = new Map();
+    initializationLocalCalls = [];
     /** Local class bindings mapped to the source offset where their `class` statement evaluates (CLS-D8). */
     hoistedClassDeclarations = new Map();
+    /**
+     * D90 R12: public class members whose omitted annotation inferred an output
+     * `any`. Whether the member is at an export position depends on whether a
+     * consumer can reach its class, which is not settled until the whole module
+     * is analyzed, so the report waits for reportExportPositionAny.
+     */
+    exportPositionCandidates = [];
     /** Module-scope names bound to runtime Type objects (local and imported); see LoweringHints.runtimeTypeObjectNames. */
     runtimeTypeObjectNames = new Set();
     staticFieldInitialization = null;
@@ -690,16 +1112,20 @@ export class Analyzer {
             staticGetters: new Set(),
             staticMethods: new Map(),
         });
-        // ENM-U4 + COL-U5: the three compiler-raised error types are nameable —
+        // ENM-U4 + COL-U5: the compiler-raised error types are nameable —
         // catchable, `is`-narrowable, and constructible — wired exactly like
         // Error. ValidationError additionally carries the failure detail its
-        // parse sites report (path, field, reason).
+        // parse sites report (path, field, reason). AssertionError joins the
+        // roster because the charter already promises it does: "A `catch` block
+        // still receives all three, because a `catch` is explicit: the author
+        // wrote code to handle it, and `is` names which one it was."
         const builtinErrorDetails = [
             ["ValidationError", [
                     ["path", { mutable: false, type: optionalOf(stringType) }],
                     ["field", { mutable: false, type: optionalOf(stringType) }],
                     ["reason", { mutable: false, type: optionalOf(stringType) }],
                 ]],
+            ["AssertionError", []],
             ["NarrowingError", []],
             ["IndexError", []],
             // D50 rule 89: the capability failures a caller recovers from
@@ -826,18 +1252,38 @@ export class Analyzer {
         }
         return this.globalGuidance.get(name);
     }
+    /**
+     * D90 (coherence): the one report an unresolved name earns, wherever it was
+     * written. A reserved global names the module that replaced it, a foreign
+     * builtin with no successor stops at the bare message rather than guessing,
+     * and everything else may carry the nearest visible name. Both unresolved-
+     * name sites reach this, because `exports = {run: run}` is the same mistake
+     * as `const value = exports` and used to earn a strictly worse answer for
+     * standing on the left of the `=`.
+     */
+    reportUnresolvedName(name, span) {
+        const guidance = this.guidanceForGlobal(name);
+        const nearest = guidance || foreignBuiltinNames.has(name) ? null : this.nearestVisibleBindingName(name);
+        this.diagnostics.push(diagnostic(guidance ? "VEL3008" : "VEL3001", guidance ?? `Unknown name '${name}'${nearest ? `; did you mean '${nearest}'?` : ""}`, span));
+    }
     nearestVisibleBindingName(name) {
-        const candidates = new Set([
-            ...Object.keys(coreVocabularyTypes),
-            ...this.extensionGlobals.keys(),
-            ...this.importBindings.keys(),
-            "Map", "Set", "Error", "ValidationError", "NarrowingError", "IndexError",
-            ...VELAR_HOST_ERROR_NAMES,
-        ]);
-        for (const scope of this.scopes)
-            for (const candidate of scope.keys())
-                candidates.add(candidate);
-        return uniqueNearestName(name, candidates);
+        if (!this.nearestNamesSeeded) {
+            this.nearestNamesSeeded = true;
+            for (const candidate of [
+                ...Object.keys(coreVocabularyTypes),
+                ...this.extensionGlobals.keys(),
+                ...this.importBindings.keys(),
+                "Map", "Set", "Error", "ValidationError", "AssertionError", "NarrowingError", "IndexError",
+                ...VELAR_HOST_ERROR_NAMES,
+            ])
+                this.nearestNames.add(candidate);
+        }
+        return this.nearestNames.nearest(name);
+    }
+    /** Files a scope's name in the "did you mean" roster and takes it back out when the scope exits. */
+    recordScopedName(name) {
+        this.nearestNames.add(name);
+        this.scopedNames.at(-1).push(name);
     }
     modulePath;
     importBindings;
@@ -873,14 +1319,31 @@ export class Analyzer {
         for (const statement of program.body) {
             this.analyzeStatement(statement);
         }
+        // D90 R12 reports last for the same reason: whether a class member is at
+        // an export position is a question about the module's whole export
+        // surface, which no single declaration can answer as it is analyzed.
+        this.reportExportPositionAny(program);
         // D52 rules 114/116: both namespace migrations report last, because both
         // rewrites need the whole module before they can be written down — one has
         // to know every name the new import would have to clear, and the other has
         // to know every read the retiring import leaves behind.
         this.reportRetiredNamespaceUses(program);
         this.reportPermanentNamespaceImports(program);
+        this.reportPermanentNamespaceReExports(program);
+        // D85 rule 209 reports last for the same reason: a hole reaches a caller
+        // through a callee the module may not declare until later, so the second
+        // report is deleted once every hole in the module is on record.
+        this.resolveDeferredConvergenceReports();
         return this.diagnostics;
     }
+    /**
+     * D89: the advisories this analysis raised. `analyze` keeps returning the
+     * diagnostics alone, so the caller reads the two channels separately and the
+     * cursor arithmetic over `this.diagnostics` stays exact.
+     */
+    analyzedAdvisories() {
+        return this.advisories;
+    }
     registerExternTypeImports(program) {
         const classesBySource = new Map();
         for (const statement of program.body) {
@@ -1113,6 +1576,12 @@ export class Analyzer {
             }
             else if (statement.kind === "FunctionDeclaration") {
                 this.declareBinding(statement.name, false, this.functionType(statement), statement.span);
+                // D85 rule 209: the result a call to this name reaches, recorded before
+                // any body is analyzed so a call to a function declared further down
+                // the module still resolves to it.
+                const callable = this.scopes.at(-1)?.get(statement.name);
+                if (callable)
+                    this.functionResultKeys.set(callable, this.functionResultKey(statement));
                 this.predeclared.add(statement);
             }
             else if (this.predeclareExtensionStatement(statement)) {
@@ -1357,6 +1826,8 @@ export class Analyzer {
             usingDisposals: this.usingDisposals,
             classDisposeChains: this.classDisposeChains,
             iterationContracts: this.iterationContracts,
+            asyncIterationStatements: this.asyncIterationStatements,
+            asyncIterateBlocks: this.asyncIterateBlocks,
             moduleTopLevelHostCalls: this.moduleTopLevelHostCalls,
         };
     }
@@ -2310,8 +2781,10 @@ export class Analyzer {
                 // from the body — the same shape as an omitted function result, and it
                 // rides the same seeded convergence passes. The shape pre-pass seeds
                 // what the previous pass learned so a use written above the class sees
-                // the real collection instead of the placeholder.
-                ...(statement.iterate ? { iterate: this.seededIterationSource(statement.iterate) } : {}),
+                // the real collection instead of the placeholder. D90 R18: an optional
+                // seed is the asynchronous pull form — a collection can never validate
+                // to `T?` — so the seed's shape says which field it belongs in.
+                ...(statement.iterate ? this.seededIterationInfo(statement.iterate) : {}),
                 parameters: statement.parameters.map((parameter) => this.resolveValidatedAnnotation(parameter.type)),
                 parameterNames: statement.parameters.map((parameter) => parameter.name),
                 requiredParameters: statement.parameters.filter((parameter) => !parameter.defaultValue).length,
@@ -2596,8 +3069,26 @@ export class Analyzer {
                 const contract = annotationValid ? annotated ?? inferredStorage : invalidType;
                 if (annotationValid)
                     this.requireAssignable(actual, declared, statement.initializer.span);
-                this.requireSettledCollectionElement(statement.initializer, declared, annotated !== null);
-                this.declarePattern(statement.pattern, statement.binding === "let", declared, contract);
+                // D85 rule 209: the construction that just reported is invalid from
+                // here on. Binding the name to the hole instead would reproduce
+                // `Cannot assign List<unknown> to ...` on a later line that has no
+                // `[]` in it — the second, contradicting report the ruling deletes.
+                // D90 R12: `any` may not cross a module boundary. The written spelling
+                // is already refused by validateTypeReference above, so only the
+                // inferred one reaches here — and that asymmetry was the defect, since
+                // the spelling that got refused is the honest one. Checking the
+                // settled type before declarePattern covers every pattern shape at
+                // once, including `export const {a, b} = thing`.
+                if (statement.exported && annotationValid && typeContainsAnyOutput(declared)) {
+                    const exported = [];
+                    this.collectPatternNames(statement.pattern, (name) => exported.push(name));
+                    this.reportExportedAny(exported, statement.span);
+                }
+                const unsettled = this.requireSettledCollectionElement(statement.initializer, declared, annotated !== null);
+                this.declarePattern(statement.pattern, statement.binding === "let", unsettled ? invalidType : declared, unsettled ? invalidType : contract);
+                if (annotated === null)
+                    this.recordBindingHoleSource(statement.pattern, statement.initializer, unsettled);
+                this.claimArrowDeferredFrame(statement.pattern, statement.initializer);
                 // D51 rule 101: an alias of an owned handle — or a closure over one —
                 // is the same resource under a second name, so it inherits the
                 // ownership and the escape check follows it.
@@ -2669,10 +3160,35 @@ export class Analyzer {
                         this.asyncResolvedValues.add(spanIdentity(statement.value.span));
                     }
                 }
-                if (this.unreachableDiagnosticDepth === 0)
-                    (inferredReturns ?? returnContext?.observedReturns)?.push(returned);
-                if (inferredReturns)
+                if (inferredReturns) {
+                    // D85 rule 207: a body-inferred result has no annotation to settle
+                    // an empty collection, and the name that reads it can be in another
+                    // module — `export def make(): return []` publishes `List<unknown>`
+                    // across the interface. An annotated result is a contextual type and
+                    // settles the construction before it ever gets here. Rule 209: a
+                    // reported hole contributes `invalidType`, so the caller's
+                    // `const values: List<string> = make()` does not report the same
+                    // mistake a second time in a line that has no `[]` in it.
+                    const unsettled = statement.value !== null && this.requireSettledCollectionElement(statement.value, actual, false);
+                    if (returnContext) {
+                        // The hole reaches the result through whatever the author wrote
+                        // between it and the `return` — a name, a chain of them, or a call
+                        // to a local function whose own VEL4039 already reported. Each of
+                        // those is the same one mistake, so the convergence failure it
+                        // produces below is not a second problem to report.
+                        const causes = returnContext.resultHoleCauses ?? new Set();
+                        const carried = statement.value !== null && this.collectResultHoleSources(statement.value, causes);
+                        if (causes.size > 0)
+                            returnContext.resultHoleCauses = causes;
+                        if (unsettled || carried)
+                            returnContext.unsettledResult = true;
+                    }
+                    if (this.unreachableDiagnosticDepth === 0)
+                        inferredReturns.push(unsettled ? invalidType : returned);
                     break;
+                }
+                if (this.unreachableDiagnosticDepth === 0)
+                    returnContext?.observedReturns?.push(returned);
                 this.requireAssignable(returned, expected, statement.value?.span ?? statement.span);
                 break;
             }
@@ -2976,11 +3492,10 @@ export class Analyzer {
                     && this.builtinValueReferences.get(spanIdentity(statement.iterable.callee.span)) === "range") {
                     this.nativeRangeForStatements.add(statement.span.start);
                 }
-                // D68 rule 177: `async for` is deliberately outside the contract. It
-                // pulls a capability handle — a resource with a lifetime that `using`
-                // owns — and a class that answered it would make "does this need
-                // releasing?" undecidable, so the projection happens on the
-                // synchronous side only and `async for` keeps refusing user types.
+                // D68 rule 177 + D90 R18: the eight plain consumers project through
+                // the synchronous `@iterate:` answer; `async for` reads the
+                // asynchronous form's declaration inside asyncPullElementType, so the
+                // asynchronous side takes the operand unprojected.
                 const iterable = statement.asynchronous ? inferredIterable : this.iterationSource(statement.iterable, inferredIterable);
                 if (!statement.asynchronous
                     && (iterable.kind === "list" || iterable.kind === "map" || iterable.kind === "set" || iterable.kind === "record" || iterable.kind === "string")) {
@@ -3001,7 +3516,7 @@ export class Analyzer {
                                 ? this.invalidExtensionAwaitMessage() ?? "'async for' is not valid in this synchronous extension context"
                                 : "'async for' can only be used in an async function or at module scope", statement.span));
                     }
-                    first = this.asyncPullElementType(iterable, statement.iterable.span);
+                    first = this.asyncPullElementType(iterable, statement.iterable.span, statement.span.start);
                     second = numberType;
                     this.asyncForStatements.add(statement.span.start);
                 }
@@ -3020,6 +3535,8 @@ export class Analyzer {
                             : `Cannot iterate over ${describeType(iterable)}${this.iterationGuidance(iterable)}`, statement.iterable.span);
                     }
                 }
+                if (!statement.asynchronous)
+                    this.adviseSwappedLoopSlots(statement, iterable);
                 const baseline = this.snapshotFlowFacts();
                 this.loopFlowContexts.push({ baseline, visible: this.visibleBindings(), carried: [], backEdges: [], breakFacts: [], sawBreak: false });
                 const diagnosticStart = this.diagnostics.length;
@@ -3095,7 +3612,7 @@ export class Analyzer {
                 // FLW-S1: a loop the body can re-enter tests its condition again in
                 // the back-edge state, so the exit fact is what both tests agree on.
                 let repeatedFalsy = null;
-                const repeatedFlow = this.reanalyzeLoopBackEdge(baseline, loopFlow.visible, backEdges, statement.body, diagnosticStart, () => {
+                const backEdgePass = this.reanalyzeLoopBackEdge(baseline, loopFlow.visible, backEdges, statement.body, diagnosticStart, () => {
                     this.clearCachedFlowTypesInSpan(statement.condition.span);
                     const repeatedCondition = this.inferExpression(statement.condition);
                     this.requireCondition(repeatedCondition, statement.condition);
@@ -3124,15 +3641,19 @@ export class Analyzer {
                 // that always returns. A break can leave while the condition still
                 // holds, so one break drops the fact entirely.
                 if (!loopFlow.sawBreak) {
-                    this.persistNarrowings(repeatedFalsy === null ? falsy : this.joinedNarrowings(falsy, repeatedFalsy));
+                    // A widened exit confirmed nothing about the back edge, so it keeps
+                    // nothing: the condition's fact holds only if the second test agrees.
+                    this.persistNarrowings(backEdgePass.widened
+                        ? new Map()
+                        : repeatedFalsy === null ? falsy : this.joinedNarrowings(falsy, repeatedFalsy));
                 }
                 else if (statement.condition.kind === "LiteralExpression" && statement.condition.value === true) {
                     // FLW-N6: `while true:` has no failing condition, so its breaks are
                     // its only exits, and what every one of them proves holds after the
                     // loop. A loop whose condition can also fail keeps nothing: that
                     // exit proves none of it.
-                    const breakFacts = [...loopFlow.breakFacts, ...(repeatedFlow?.breakFacts ?? [])];
-                    if (breakFacts.length > 0)
+                    const breakFacts = [...loopFlow.breakFacts, ...(backEdgePass.repeated?.breakFacts ?? [])];
+                    if (breakFacts.length > 0 && !backEdgePass.widened)
                         this.persistNarrowings(this.commonNarrowings(breakFacts));
                 }
                 break;
@@ -3254,6 +3775,33 @@ export class Analyzer {
                 break;
         }
     }
+    /**
+     * D89 A2: the two-slot `for` over a List, Set, or string binds
+     * `value, index`, which matches JavaScript's `forEach((v, i) => …)` and
+     * inverts Python's `enumerate`. Python's own spelling is already a loud
+     * error, so nothing silent comes from it; the silence happens when a model
+     * writes `for i, v in nums`, a hybrid neither language has, and both names
+     * quietly hold the other one's value.
+     *
+     * Both rosters must hit. One name alone proves nothing — `for index, total
+     * in scores` may be counting exactly what it says — and a wrong guess here
+     * would tell a correct author to break working code. The value slot also
+     * accepts the singular of the collection's own name, because `for i, user
+     * in users` is the same reflex spelled from the data instead of a letter.
+     */
+    adviseSwappedLoopSlots(statement, iterable) {
+        if (iterable.kind !== "list" && iterable.kind !== "set" && iterable.kind !== "string")
+            return;
+        const indexSlot = statement.pattern;
+        const valueSlot = statement.secondPattern;
+        if (indexSlot.kind !== "NameBindingPattern" || valueSlot?.kind !== "NameBindingPattern")
+            return;
+        if (!loopIndexSlotNames.has(indexSlot.name))
+            return;
+        if (!loopValueSlotNames.has(valueSlot.name) && valueSlot.name !== singularIterableName(statement.iterable))
+            return;
+        this.advise("A2", `A two-slot 'for' binds 'value, index', so '${indexSlot.name}' receives the element and '${valueSlot.name}' receives the position; write 'for ${valueSlot.name}, ${indexSlot.name} in ...' to bind them the way the names read`, span(indexSlot.span.start, valueSlot.span.end), mechanicalEdits([{ span: indexSlot.span, text: valueSlot.name }, { span: valueSlot.span, text: indexSlot.name }], `Swap '${indexSlot.name}' and '${valueSlot.name}'`));
+    }
     // D32 item 30: a Promise-typed expression statement is a floating promise —
     // nothing waits for it and nothing owns its failure. The diagnostic teaches
     // both current spellings: 'await' waits, the 'async' statement detaches.
@@ -3318,7 +3866,19 @@ export class Analyzer {
     // The operation tables already prove which method the call lowered to, so
     // the check needs no user-function purity analysis.
     checkDiscardedPureResult(expression) {
-        if (expression.kind !== "CallExpression" || expression.callee.kind !== "MemberExpression")
+        if (expression.kind !== "CallExpression")
+            return;
+        // D29 item 14's own rationale reaches `expect(...)` with no matcher:
+        // building an expectation object and never asking it anything throws the
+        // only product away, and the statement reads as an assertion that passes.
+        // D30 item 17's general CallExpression exemption is untouched — a bare
+        // call may perform an effect — because `testExpectOperands` already
+        // proves this one call lowered to `test.expect`, which performs none.
+        if (this.testExpectOperands.has(spanIdentity(expression.span))) {
+            this.diagnostics.push(diagnostic("VEL4030", "'expect(...)' builds an expectation and asserts nothing on its own; add a matcher such as '.toBe(expected)'", expression.span));
+            return;
+        }
+        if (expression.callee.kind !== "MemberExpression")
             return;
         const collectionOperation = this.collectionCalls.get(expression.callee.span.end);
         const primitiveOperation = this.primitiveCalls.get(expression.callee.span.end);
@@ -3403,11 +3963,13 @@ export class Analyzer {
         const baseName = statement.base?.name ?? null;
         if (baseName) {
             const baseBinding = this.lookup(baseName) ?? this.builtin(baseName);
-            if (baseName === "ValidationError" || baseName === "NarrowingError" || baseName === "IndexError"
+            if (baseName === "ValidationError" || baseName === "AssertionError" || baseName === "NarrowingError"
+                || baseName === "IndexError"
                 || VELAR_HOST_ERROR_NAMES.includes(baseName)) {
                 // The compiler-raised error types are leaf contracts: user subclasses
-                // would dilute what a caught ValidationError/NarrowingError/IndexError
-                // proves. Extend Error for custom hierarchies.
+                // would dilute what a caught ValidationError/AssertionError/
+                // NarrowingError/IndexError proves. Extend Error for custom
+                // hierarchies.
                 this.typeError(`The builtin error type '${baseName}' cannot be extended; extend Error and declare your own fields`, statement.base.span);
             }
             else if (baseBinding?.type.kind === "classConstructor" && !this.classes.has(baseName)
@@ -3437,7 +3999,18 @@ export class Analyzer {
         this.enterScope();
         this.flowFrameDepth += 1;
         this.superMemberContext = "instance";
-        for (const parameter of statement.parameters) {
+        for (const [index, parameter] of statement.parameters.entries()) {
+            // D89 (message correction): `constructor(self, ...)` is the same Python
+            // receiver reflex a method's `self` parameter is, and it used to land on
+            // the bare reserved-binding refusal, which names no fix. A field-binding
+            // spelling (`const self`) is excluded because its `const`/`private`
+            // prefix sits outside the parameter span, so the deletion this report
+            // carries would leave the prefix stranded — and D38 §48 admits only
+            // rewrites that land on working source.
+            if (parameter.name === "self" && !parameter.rest && parameter.binding === null && statement.initialization !== null) {
+                this.reportImplicitSelfParameter(statement.parameters, index);
+                continue;
+            }
             const type = this.resolveAnnotation(parameter.type);
             const valid = parameter.type ? this.validateTypeReference(parameter.type) : true;
             if (parameter.defaultValue && valid) {
@@ -4058,14 +4631,30 @@ export class Analyzer {
     seededIterationSource(block) {
         return this.inferredFunctionResultSeeds.get(this.iterationResultKey(block)) ?? inferredResultPlaceholderType;
     }
+    /**
+     * D90 R18: the seed routed to the field its form owns. An optional seed can
+     * only have come from the asynchronous pull form — the synchronous form
+     * never validates to `T?` — so the shape pre-pass reads the form off the
+     * seed the previous convergence pass learned.
+     */
+    seededIterationInfo(block) {
+        const seed = this.seededIterationSource(block);
+        const expanded = this.expandAliases(seed);
+        return expanded.kind === "optional" ? { iterateAsync: expanded.inner } : { iterate: seed };
+    }
     /**
      * `@iterate:` answers the compiler's question "what does
-     * iterating you mean?" with a collection the language already iterates. It
-     * shares `@dispose:`'s compiler-name path, then supplies its own role: it is
-     * a contract, not a method, it produces a value, and it may not `await`,
-     * because every one of the eight consumers reads it synchronously.
+     * iterating you mean?". It shares `@dispose:`'s compiler-name path, then
+     * supplies its own role: it is a contract, not a method, and it produces a
+     * value. D90 R18 gives it two forms, told apart by the answer's shape the
+     * same way `@dispose:`'s async-ness is read off its own body: the
+     * synchronous form answers a collection the language already iterates and
+     * the eight plain consumers read it once; the asynchronous pull form
+     * answers `T?` — `async for` drives it once per element, it may await, and
+     * null is exhaustion.
      */
     analyzeClassIterate(statement, block, baseName) {
+        const awaits = blockContainsDirectAwait(block.body, (expression, contains) => this.extensionExpressionContainsDirectAwait(expression, contains), (owned, containsExpression, containsBlock) => this.extensionStatementContainsDirectAwait(owned, containsExpression, containsBlock));
         this.enterScope();
         this.flowFrameDepth += 1;
         this.functionDepth += 1;
@@ -4077,13 +4666,14 @@ export class Analyzer {
         const previousSuperMemberContext = this.superMemberContext;
         this.currentClass = statement.name;
         this.superMemberContext = "instance";
-        this.asynchronousFunctions.push(false);
-        this.iterateContractDepths.push(this.functionDepth);
+        // A block that awaits is the asynchronous form (the same reading
+        // `@dispose:` gets), so its awaits are legal; a block without one has
+        // nothing for the flag to allow.
+        this.asynchronousFunctions.push(awaits);
         const inferredReturns = [];
         this.returnContexts.push({ expected: unknownType, inferredReturns, observedReturns: null, declarationKind: "Iteration contract" });
         this.declareBinding("self", false, { kind: "class", name: statement.name }, block.span, true);
         this.analyzeStatements(block.body);
-        this.iterateContractDepths.pop();
         this.returnContexts.pop();
         this.asynchronousFunctions.pop();
         this.currentClass = previousClass;
@@ -4094,37 +4684,80 @@ export class Analyzer {
         this.flowFrameDepth -= 1;
         this.exitScope();
         const answered = this.inferCollectedFunctionResult(inferredReturns, !this.blockAlwaysReturns(block.body));
-        const source = this.validatedIterationSource(statement, block, answered, baseName);
-        this.inferredFunctionResultTypes.set(this.iterationResultKey(block), source);
+        const validated = this.validatedIterationSource(statement, block, answered, baseName, awaits);
+        // D90 R12: `@iterate:` is the class's other inferred public contract. A
+        // consumer writing `for item in box` reads the element straight out of
+        // this block, so an element the compiler makes no promise about crosses
+        // the boundary exactly as a method result does. The block has no
+        // annotation to refuse and no `private` spelling, so the class's own
+        // reachability is the whole question.
+        if (typeContainsAnyOutput(validated.source)) {
+            this.exportPositionCandidates.push({ className: statement.name, member: "@iterate", span: block.span });
+        }
+        // The stored result keeps the optional wrapper for the asynchronous form
+        // so the convergence seed round-trips carrying the form (see
+        // seededIterationInfo).
+        this.inferredFunctionResultTypes.set(this.iterationResultKey(block), validated.form === "async" && !isInvalidType(validated.source) ? optionalOf(validated.source) : validated.source);
+        if (validated.form === "async")
+            this.asyncIterateBlocks.add(spanIdentity(block.keywordSpan));
         const info = this.classes.get(statement.name);
-        if (info)
-            this.classes.set(statement.name, { ...info, iterate: source });
+        if (info) {
+            // Drop the other form's field: an earlier pass may have seeded it before
+            // this pass's answer settled which form the block is.
+            const { iterate: _sync, iterateAsync: _async, ...rest } = info;
+            this.classes.set(statement.name, validated.form === "async"
+                ? { ...rest, iterateAsync: validated.source }
+                : { ...rest, iterate: validated.source });
+        }
     }
     /**
-     * The four collections are the whole answer space: the block says "iterating
-     * me is iterating this", and the language already fixed what iterating a
-     * List, Set, Map, or Record means. Anything else would be a second iteration
-     * semantics, which is the thing charter section 19 keeps out.
+     * The answer space is the four collections plus `T?` (D90 R18): the
+     * synchronous form says "iterating me is iterating this", and the language
+     * already fixed what iterating a List, Set, Map, or Record means; the
+     * asynchronous pull form answers one element per pull, null for exhaustion.
+     * Anything else would be a second iteration semantics, which is the thing
+     * charter section 19 keeps out.
      */
-    validatedIterationSource(statement, block, answered, baseName) {
+    validatedIterationSource(statement, block, answered, baseName, awaits) {
         if (isInvalidType(answered) || containsInferredResultPlaceholder(answered))
-            return invalidType;
+            return { form: "sync", source: invalidType };
         const expanded = this.expandAliases(answered);
-        if (expanded.kind !== "list" && expanded.kind !== "set" && expanded.kind !== "map" && expanded.kind !== "record") {
-            this.diagnostics.push(diagnostic("VEL4038", `'@iterate' says which collection iterating '${statement.name}' means, so it returns a List, Set, Map, or Record — those are the shapes the language already knows how to iterate; this block returns ${describeType(answered)}`, block.keywordSpan));
-            return invalidType;
-        }
         // The override rule every other member already carries (a getter or method
         // override keeps the base result). `@iterate:` replaces rather than chains,
         // but the answer still has to be the one a base-typed binding was promised:
         // `for item in bag` inside a function taking the base would otherwise walk
-        // a different element type at runtime.
+        // a different element type — or a different form — at runtime.
         const inherited = baseName ? this.inheritedIterationSource(baseName) : null;
+        const inheritedAsync = baseName ? this.inheritedAsyncIterationSource(baseName) : null;
+        if (expanded.kind === "optional") {
+            const element = expanded.inner;
+            if (inherited && !isInvalidType(inherited)) {
+                this.diagnostics.push(diagnostic("VEL4038", `'@iterate' override in '${statement.name}' must keep the base form; '${baseName}' answers ${describeType(inherited)} to the plain 'for', and this block answers ${describeType(answered)} — the asynchronous pull form — so a base-typed binding would stream where it was promised a collection`, block.keywordSpan));
+                return { form: "sync", source: inherited };
+            }
+            if (inheritedAsync && !isInvalidType(inheritedAsync) && !sameType(this.expandAliases(element), this.expandAliases(inheritedAsync))) {
+                this.diagnostics.push(diagnostic("VEL4038", `'@iterate' override in '${statement.name}' must keep the base answer ${describeType(inheritedAsync)}?; '${baseName}' already promised every caller that pulling one of these yields ${describeType(inheritedAsync)}, and a derived value is still one of those`, block.keywordSpan));
+                return { form: "async", source: inheritedAsync };
+            }
+            return { form: "async", source: element };
+        }
+        if (expanded.kind !== "list" && expanded.kind !== "set" && expanded.kind !== "map" && expanded.kind !== "record") {
+            this.diagnostics.push(diagnostic("VEL4038", `'@iterate' says what iterating '${statement.name}' means: the synchronous form returns a List, Set, Map, or Record — the shapes the language already knows how to iterate — and the asynchronous pull form answers 'T?', one element per pull with null as exhaustion; this block returns ${describeType(answered)}`, block.keywordSpan));
+            return { form: "sync", source: invalidType };
+        }
+        if (awaits) {
+            this.diagnostics.push(diagnostic("VEL4038", `'@iterate' in '${statement.name}' awaits but answers ${describeType(answered)}; the synchronous form is read whole by the plain consumers, so await the work before construction and hold the finished collection — or answer 'T?' to be the asynchronous pull form 'async for' drives once per element`, block.keywordSpan));
+            return { form: "sync", source: invalidType };
+        }
+        if (inheritedAsync && !isInvalidType(inheritedAsync)) {
+            this.diagnostics.push(diagnostic("VEL4038", `'@iterate' override in '${statement.name}' must keep the base form; '${baseName}' answers ${describeType(inheritedAsync)}? — the asynchronous pull form — and this block answers ${describeType(answered)}, so a base-typed binding would read a collection where it was promised a stream`, block.keywordSpan));
+            return { form: "async", source: inheritedAsync };
+        }
         if (inherited && !isInvalidType(inherited) && !sameType(expanded, this.expandAliases(inherited))) {
             this.diagnostics.push(diagnostic("VEL4038", `'@iterate' override in '${statement.name}' must keep the base answer ${describeType(inherited)}; '${baseName}' already promised every caller that iterating one of these walks ${describeType(inherited)}, and a derived value is still one of those`, block.keywordSpan));
-            return inherited;
+            return { form: "sync", source: inherited };
         }
-        return expanded;
+        return { form: "sync", source: expanded };
     }
     /** The `@iterate:` answer a class inherits, most derived ancestor first. */
     inheritedIterationSource(className) {
@@ -4139,6 +4772,30 @@ export class Analyzer {
         }
         return null;
     }
+    /** D90 R18: the asynchronous `@iterate:` element a class inherits, most derived ancestor first. */
+    inheritedAsyncIterationSource(className) {
+        let current = className;
+        const visited = new Set();
+        while (current && !visited.has(current)) {
+            visited.add(current);
+            const info = this.classes.get(current);
+            if (info?.iterateAsync)
+                return info.iterateAsync;
+            current = info?.base ?? null;
+        }
+        return null;
+    }
+    /**
+     * D90 R18: what pulling this value under `async for` means. A class answers
+     * through the asynchronous `@iterate:` form — its own, or the one it
+     * inherits, mirroring the synchronous contract exactly.
+     */
+    asyncIterationContract(type) {
+        const resolved = this.resolveNamedClasses(this.expandAliases(type));
+        if (resolved.kind !== "class")
+            return null;
+        return this.inheritedAsyncIterationSource(resolved.identity ?? resolved.name);
+    }
     /**
      * D68 rule 177: what iterating this value means. A class answers through
      * `@iterate:` — its own, or the one it inherits, because overriding replaces
@@ -4178,6 +4835,12 @@ export class Analyzer {
         }
         if (this.iterationContract(resolved) !== null)
             return "";
+        // D90 R18: the refusal is symmetric with `async for` refusing the
+        // synchronous form — each names the other, so the author is one message
+        // away from the loop that fits the declaration.
+        if (this.asyncIterationContract(resolved) !== null) {
+            return "; '@iterate' on this class is the asynchronous pull form, which 'async for' drives — use 'async for', or answer a List, Set, Map, or Record to iterate here";
+        }
         return "; declare an '@iterate:' block on the class to say which List, Set, Map, or Record iterating it means";
     }
     validateConstructorShape(statement) {
@@ -4290,12 +4953,37 @@ export class Analyzer {
         }
         return null;
     }
-    asyncPullElementType(source, sourceSpan) {
+    asyncPullElementType(source, sourceSpan, statementStart) {
         const expanded = this.resolveNamedClasses(this.expandAliases(source));
         if (expanded.kind === "any")
             return anyType;
         if (isInvalidType(expanded))
             return invalidType;
+        // D90 R18: a VelarScript class declares itself an asynchronous stream
+        // through the asynchronous `@iterate:` form, exactly as it declares the
+        // synchronous one — `async for` reads the declaration, never a structural
+        // resemblance. The structural `next() -> Promise<T?>` pull below stays the
+        // contract of the declared foreign shapes: capability handles (a reply
+        // stream, a child process, a watcher) and extern classes whose own
+        // contract declares the pull as a function-valued field.
+        if (expanded.kind === "class" && !isExternClassIdentity(expanded.identity ?? null)) {
+            const declared = this.asyncIterationContract(expanded);
+            if (declared !== null) {
+                if (isInvalidType(declared))
+                    return invalidType;
+                this.asyncIterationStatements.add(statementStart);
+                return declared;
+            }
+            const identity = expanded.identity ?? expanded.name;
+            const synchronous = this.iterationContract(expanded);
+            if (synchronous !== null) {
+                this.typeError(`async for pulls a declared asynchronous '@iterate:'; '@iterate' on ${describeType(source)} ${isInvalidType(synchronous) ? "answers the plain 'for'" : `answers ${describeType(synchronous)} to the plain 'for'`} — declare the asynchronous form instead: a block that answers 'T?', one element per pull, null as exhaustion`, sourceSpan);
+                return unknownType;
+            }
+            const structuralNext = this.findMethod(identity, "next")?.type ?? this.findMethod(expanded.name, "next")?.type ?? null;
+            this.typeError(`async for pulls a declared asynchronous '@iterate:'; ${describeType(source)} does not declare one — a block that answers 'T?' (it may await; one element per pull, null is exhaustion)${structuralNext ? "; 'next()' is a method of the author's namespace, not the contract — move its body into the '@iterate:' block" : ""}`, sourceSpan);
+            return unknownType;
+        }
         let next = null;
         if (expanded.kind === "object") {
             next = expanded.optionalFields?.has("next") ? null : expanded.fields.get("next") ?? null;
@@ -4307,23 +4995,17 @@ export class Analyzer {
                 ?? null;
         }
         else if (expanded.kind === "class") {
-            const identity = expanded.identity ?? expanded.name;
-            next = this.findField(identity, "next")?.type
+            // An extern class: its own contract may declare the pull as a
+            // function-valued field; an extern method is never captured (charter
+            // section 12 trusts a checked declaration's member kinds, and only a
+            // field promises a function standing on the value).
+            next = this.findField(expanded.identity ?? expanded.name, "next")?.type
                 ?? this.findField(expanded.name, "next")?.type
-                ?? (!identity.startsWith("js:") ? this.findMethod(identity, "next")?.type : null)
-                ?? (!identity.startsWith("js:") ? this.findMethod(expanded.name, "next")?.type : null)
                 ?? null;
         }
         const callable = next ? this.expandAliases(next) : null;
         if (!callable || callable.kind !== "function" || callable.requiredParameters > 0 || (callable.typeParameterNames?.length ?? 0) > 0) {
-            // D68 rule 177 drew this line deliberately: `@iterate:` answers the
-            // synchronous question. An asynchronous stream is a resource — it has a
-            // lifetime, it fails, it needs releasing — so letting an ordinary class
-            // pose as one would make "does this need `using`?" undecidable.
-            const contractNote = this.iterationContract(source) === null
-                ? ""
-                : "; '@iterate' answers the plain 'for', not 'async for' — an async stream is a resource, so pull it from the capability handle that owns the lifetime";
-            this.typeError(`async for requires next() -> Promise<T?>; ${describeType(source)} does not expose that pull contract${contractNote}`, sourceSpan);
+            this.typeError(`async for requires next() -> Promise<T?>; ${describeType(source)} does not expose that pull contract`, sourceSpan);
             return unknownType;
         }
         const result = this.expandAliases(callable.result);
@@ -4478,6 +5160,25 @@ export class Analyzer {
         const deletion = statement.resultAnnotationSpan;
         this.diagnostics.push(diagnostic("VEL4037", `${declarationKind} '${statement.name}' infers '-> null' from its body; delete the annotation, and write it only where 'extern', 'abstract', or a function type leaves no body to infer`, reference.span, deletion ? mechanicalFix(deletion, "", "Delete the inferred '-> null'") : undefined));
     }
+    /**
+     * D89 (message correction): the one report a `self` parameter earns, and the
+     * deletion it names. The removed range reaches to the next parameter's start
+     * (or back to the previous one's end), so the separating comma and its
+     * whitespace come with it without reading the source text — the rewrite is a
+     * spelling change with no judgment in it, which is what D38 §48 requires of
+     * a registered fix.
+     */
+    reportImplicitSelfParameter(parameters, index) {
+        const parameter = parameters[index];
+        const next = parameters[index + 1];
+        const previous = parameters[index - 1];
+        const removal = next
+            ? span(parameter.span.start, next.span.start)
+            : previous
+                ? span(previous.span.end, parameter.span.end)
+                : parameter.span;
+        this.diagnostics.push(diagnostic("VEL3007", "'self' is the receiver a method body already has, not a parameter; delete it from the parameter list", parameter.span, mechanicalFix(removal, "", "Delete the implicit 'self' parameter")));
+    }
     analyzeFunctionDeclaration(statement, className, method = false, declareSelf = Boolean(className), forceAsynchronous = false, declarationKind = "accessor" in statement ? "Getter" : method ? "Method" : "Function") {
         const outerConstructorDepth = this.constructorDepth;
         if (!method && !className && !this.predeclared.has(statement)) {
@@ -4485,11 +5186,23 @@ export class Analyzer {
         }
         const candidateBinding = className === null ? this.lookup(statement.name) : null;
         const callableBinding = candidateBinding?.span.start === statement.span.start ? candidateBinding : null;
+        // D85 rule 209: the same registration the top-level predeclaration makes,
+        // for a `def` nested in a body, which nothing predeclares.
+        if (callableBinding && !this.functionResultKeys.has(callableBinding)) {
+            this.functionResultKeys.set(callableBinding, this.functionResultKey(statement));
+        }
         this.checkTypeParameterDeclarations(statement.typeParameters);
         this.typeParameterFrames.push(this.typeParameterFrame(statement.typeParameters));
         this.enterScope();
         this.flowFrameDepth += 1;
         this.functionDepth += 1;
+        // D31 item 23: this body is deferred, so its reads of imported bindings
+        // become initialization-position reads only when something runs it during
+        // module evaluation. Collect them here and let a top-level call decide.
+        const deferredFrame = { reads: [], calls: [] };
+        this.deferredReadFrames.push(deferredFrame);
+        if (callableBinding)
+            this.localFunctionFrames.set(callableBinding, deferredFrame);
         const previousLoopDepth = this.loopDepth;
         this.loopDepth = 0;
         const previousFinallyLoopDepths = this.finallyLoopDepths;
@@ -4533,7 +5246,19 @@ export class Analyzer {
             const selfType = { kind: "class", name: className };
             this.declareBinding("self", false, selfType, statement.span, true);
         }
-        for (const parameter of statement.parameters) {
+        for (const [index, parameter] of statement.parameters.entries()) {
+            // D89 (message correction): a method body already has `self`, so writing
+            // it as a parameter is Python's explicit receiver. It used to earn two
+            // reports — "already declared in this scope" and "reserved Core binding"
+            // — neither of which named the fix. Only a declaration that really has
+            // an implicit receiver takes this branch; a plain or static function's
+            // `self` keeps the reserved-binding refusal, which is the truth there.
+            // A rest spelling is not the receiver reflex, and its '...' sits outside
+            // the parameter span, so deleting the name alone would leave a stray one.
+            if (parameter.name === "self" && !parameter.rest && className !== null && declareSelf) {
+                this.reportImplicitSelfParameter(statement.parameters, index);
+                continue;
+            }
             const contextualType = !parameter.type && parameter.defaultValue
                 ? this.contextualFunctionParameterDefault(statement, parameter)
                 : null;
@@ -4556,10 +5281,29 @@ export class Analyzer {
             const inferred = this.inferCollectedFunctionResult(inferredReturns, !this.blockAlwaysReturns(statement.body));
             this.inferredFunctionResultTypes.set(resultKey, inferred);
             const seeded = this.inferredFunctionResultSeeds.get(resultKey) ?? inferredResultPlaceholderType;
-            if (this.finalizeFunctionResultInference
-                && (containsInferredResultPlaceholder(inferred) || isInvalidType(inferred) || !sameInferredResult(seeded, inferred))) {
-                this.diagnostics.push(diagnostic("VEL4025", `${declarationKind} '${statement.name}' result inference did not converge; add an explicit result annotation to this recursive contract`, statement.signatureSpan));
+            if (returnContext.unsettledResult === true) {
+                this.reportedResultHoles.add(resultKey);
             }
+            else if (this.finalizeFunctionResultInference
+                && (containsInferredResultPlaceholder(inferred) || isInvalidType(inferred) || !sameInferredResult(seeded, inferred))) {
+                const report = diagnostic("VEL4025", `${declarationKind} '${statement.name}' result inference did not converge; add an explicit result annotation to this recursive contract`, statement.signatureSpan);
+                this.diagnostics.push(report);
+                // D85 rule 209: a callee whose hole is reported after this caller is
+                // analyzed is a hole nobody can know about yet, so the report waits
+                // for the whole module before it is kept or deleted as the second
+                // half of one mistake.
+                const causes = returnContext.resultHoleCauses;
+                if (causes && causes.size > 0)
+                    this.deferredConvergenceReports.push({ report, resultKey, causes });
+            }
+            // D90 R12: an omitted result annotation publishes whatever the body
+            // inferred, so an exported `def` leaks `any` exactly as an exported
+            // `const` does. Deliberately not gated on finalizeFunctionResultInference:
+            // a probe pass is discarded whole — the driver keeps the first pass's
+            // diagnostics only when nothing was left to converge — which is why the
+            // VEL4006 below is ungated too.
+            if (typeContainsAnyOutput(inferred))
+                this.recordExportedAny(statement, className, statement.signatureSpan);
             this.updateInferredCallableResult(statement, className, callableBinding, inferred, asynchronous);
         }
         else {
@@ -4576,6 +5320,7 @@ export class Analyzer {
         this.superMemberContext = previousSuperMemberContext;
         this.loopDepth = previousLoopDepth;
         this.finallyLoopDepths = previousFinallyLoopDepths;
+        this.deferredReadFrames.pop();
         this.functionDepth -= 1;
         this.flowFrameDepth -= 1;
         this.exitScope();
@@ -4655,7 +5400,7 @@ export class Analyzer {
         if (statement.target.kind === "IdentifierExpression") {
             const binding = this.lookup(statement.target.name);
             if (!binding) {
-                this.diagnostics.push(diagnostic("VEL3001", `Unknown name '${statement.target.name}'`, statement.target.span));
+                this.reportUnresolvedName(statement.target.name, statement.target.span);
                 return;
             }
             this.checkShadowedRead(statement.target.name, statement.target.span);
@@ -4829,6 +5574,8 @@ export class Analyzer {
                 if (targetBinding?.mutable) {
                     const storageBinding = targetBinding.storageBinding ?? targetBinding;
                     const rebound = storageBinding.declaredType.kind !== "unknown" ? storageBinding.declaredType : valueType;
+                    this.recordFlowFactOrigin(storageBinding);
+                    this.recordFlowFactOrigin(targetBinding);
                     storageBinding.storageType = rebound;
                     if (storageBinding.narrowingFrame === null)
                         storageBinding.type = rebound;
@@ -5020,9 +5767,7 @@ export class Analyzer {
                             return unknownType;
                         }
                     }
-                    const guidance = this.guidanceForGlobal(expression.name);
-                    const nearest = guidance ? null : this.nearestVisibleBindingName(expression.name);
-                    this.diagnostics.push(diagnostic(guidance ? "VEL3008" : "VEL3001", guidance ?? `Unknown name '${expression.name}'${nearest ? `; did you mean '${nearest}'?` : ""}`, expression.span));
+                    this.reportUnresolvedName(expression.name, expression.span);
                     return unknownType;
                 }
                 if (lexical) {
@@ -5160,6 +5905,20 @@ export class Analyzer {
                         if (objectContext?.kind === "named" && expectedFields?.has(property.name)) {
                             this.semanticObjectPropertyOwners.set(`${property.span.start}:${property.name}`, objectContext);
                         }
+                        // D90 R11: a literal written at a type-annotated position is
+                        // closed. Every one of its keys is in front of the compiler here,
+                        // so an unrecognised one is a misspelling rather than a value that
+                        // happens to be wider — which is why the openness a non-literal
+                        // keeps is untouched. Only written keys are checked, so a spread's
+                        // surplus fields stay legal and this sits outside the
+                        // missing-field guard below rather than inside it. A `Record<T>`
+                        // context declares every string key, and leaves `expectedFields`
+                        // null, so no key of one is ever unrecognised.
+                        if (objectContext && expectedFields && !expectedFields.has(property.name)) {
+                            const nearest = uniqueNearestName(property.name, expectedFields.keys());
+                            const owner = objectContext.kind === "named" ? `Type '${objectContext.name}'` : "Object";
+                            this.typeError(`${owner} has no field '${property.name}'${nearest ? `; did you mean '${nearest}'?` : ""}`, property.span);
+                        }
                         const expected = expectedFields?.get(property.name) ?? expectedRecordValue ?? unknownType;
                         const actual = this.inferExpression(property.value, expected.kind === "optional" ? expected.inner : expected);
                         fields.set(property.name, expected.kind === "unknown" ? this.widenAggregateSingleton(actual) : actual);
@@ -5235,15 +5994,12 @@ export class Analyzer {
                     const invalidExtensionAwait = this.functionDepth === 0 && this.invalidExtensionAwaitContext();
                     if (this.parameterDefaultDepth === 0 && this.constructorDepth === 0 && (invalidFunctionAwait || invalidExtensionAwait)) {
                         this.diagnostics.push(diagnostic("VEL4007", 
-                        // D68 rule 177: a contract block takes no `async`, so the generic
-                        // advice would name a fix that cannot be written. All eight
-                        // consumers read `@iterate:` synchronously — `for item in bag`
-                        // is a plain loop — so the awaiting work belongs on the way in.
-                        this.iterateContractDepths.at(-1) === this.functionDepth
-                            ? "'await' cannot be used in an '@iterate' block; iterating is a synchronous question — await the work before construction and hold the finished collection"
-                            : invalidExtensionAwait
-                                ? this.invalidExtensionAwaitMessage() ?? "'await' is not valid in this synchronous extension context"
-                                : "'await' can only be used in an async function or at module scope", expression.span));
+                        // D90 R18: an `@iterate:` block that awaits is the asynchronous
+                        // pull form, so awaiting inside one is never refused here — the
+                        // form's own validation owns the answer-shape question.
+                        invalidExtensionAwait
+                            ? this.invalidExtensionAwaitMessage() ?? "'await' is not valid in this synchronous extension context"
+                            : "'await' can only be used in an async function or at module scope", expression.span));
                     }
                     const awaited = this.expandAliases(operand);
                     if (isInvalidType(awaited))
@@ -5256,11 +6012,12 @@ export class Analyzer {
                         }
                         return result;
                     }
-                    // ASY-U2: awaiting `any` adopts a foreign thenable — its hooks run
-                    // here and a raw undefined result skips null normalization — so the
-                    // unchecked domain is rejected exactly like `unknown`.
-                    this.typeError(awaited.kind === "any"
-                        ? "Cannot await any; validate the value into a checked Promise first — an unchecked thenable runs foreign hooks and can leak raw undefined"
+                    // ASY-U2 + D90 R17: awaiting an unchecked boundary value adopts a
+                    // foreign thenable — its hooks run here and a raw undefined result
+                    // skips null normalization — so `any` and `unknown` share one
+                    // refusal, and it teaches the way in: a declared contract.
+                    this.typeError(awaited.kind === "any" || awaited.kind === "unknown"
+                        ? `Cannot await ${describeType(operand)}; an unchecked thenable runs foreign hooks and can leak raw undefined — declare the source in an extern contract so the result is a checked Promise, or validate the resolved data at the edge with 'Type.parse'`
                         : `Cannot await ${describeType(operand)}`, expression.span);
                     return unknownType;
                 }
@@ -5415,6 +6172,7 @@ export class Analyzer {
             case "ArrowFunctionExpression":
                 return this.inferArrow(expression, contextualType);
             case "CallExpression": {
+                this.recordDeferredCallEdge(expression.callee, expression.span);
                 const result = this.inferCall(expression.callee, expression.arguments, expression.argumentNames, expression.span, contextualType, expression.optional);
                 if (this.expandAliases(result).kind === "null")
                     this.normalizedNullResults.add(spanIdentity(expression.span));
@@ -5482,7 +6240,9 @@ export class Analyzer {
                     return unknownType;
                 }
                 if (object.kind !== "any") {
-                    this.typeError(`Cannot index ${describeType(object)}`, expression.span);
+                    // D90 R17: an unknown is a boundary value, so the refusal teaches
+                    // the validation ritual instead of restating the kind.
+                    this.typeError(`Cannot index ${describeType(object)}${object.kind === "unknown" && !isInvalidType(object) ? this.boundaryValidationGuidance(expression.object, null) : ""}`, expression.span);
                 }
                 return object.kind === "any" ? anyType : unknownType;
             }
@@ -5577,10 +6337,19 @@ export class Analyzer {
                 this.collectionMemberships.set(spanIdentity(operationSpan), container.kind);
             }
             if (container.kind === "list" || container.kind === "set") {
-                this.requireMembershipIntersection(left, this.readonlyDataViewOf(container.element), leftExpression.span, operator);
+                // COL-I3 second half: `in` is the thirteenth membership probe and the
+                // one that does not route through `checkProbeArgument`, so it carries
+                // the fresh-literal rejection itself — against the probe only, never
+                // the container, because the fresh List in `x in [1, 2, 3]` is the
+                // domain being searched rather than the question being asked.
+                if (!this.requireMembershipIntersection(left, this.readonlyDataViewOf(container.element), leftExpression.span, operator)) {
+                    this.rejectFreshCollectionProbe(leftExpression, operator, "element");
+                }
             }
             else if (container.kind === "map") {
-                this.requireMembershipIntersection(left, this.readonlyDataViewOf(container.key), leftExpression.span, operator);
+                if (!this.requireMembershipIntersection(left, this.readonlyDataViewOf(container.key), leftExpression.span, operator)) {
+                    this.rejectFreshCollectionProbe(leftExpression, operator, "key");
+                }
             }
             else if (container.kind === "record") {
                 this.requireMembershipIntersection(left, stringType, leftExpression.span, operator);
@@ -5612,10 +6381,63 @@ export class Analyzer {
             this.typeError(`String concatenation requires two strings; use an f-string or str(value), received ${describeType(left)} and ${describeType(right)}`, operationSpan);
             return stringType;
         }
+        if (operator === "%")
+            this.adviseNegativeLiteralModulo(leftExpression, rightExpression, operationSpan);
         this.requireAssignable(left, numberType, leftExpression.span);
         this.requireAssignable(right, numberType, rightExpression.span);
         return numberType;
     }
+    /**
+     * D89 A3: `%` follows JavaScript and keeps the dividend's sign, so `-7 % 3`
+     * is `-1` where Python answers `2`. Nothing here reports an error — both
+     * languages accept the spelling, they just disagree about the result.
+     *
+     * Only a literal negative dividend triggers. A variable's sign is not
+     * knowable, and advising every `%` whose left side might go negative would
+     * be the noise the tier exists to avoid. The shape matched is a unary minus
+     * wrapping a numeric literal, because that is what `-7` parses as; there is
+     * no negative-valued literal for a value test to find.
+     *
+     * The admission bar is "Vel accepts the spelling as a different meaning", so
+     * every shape whose two answers are the same is silent rather than advised:
+     * a remainder of zero (`-6 % 3`) agrees, `% 0` answers NaN here and raises
+     * in Python so there is no Python answer to name, and a non-finite dividend
+     * answers NaN on both sides. A message that states a disagreement and then
+     * prints the same number twice is a new defect, not a weaker advisory.
+     */
+    adviseNegativeLiteralModulo(leftExpression, rightExpression, operationSpan) {
+        if (leftExpression.kind !== "UnaryExpression" || leftExpression.operator !== "-")
+            return;
+        const dividend = leftExpression.operand;
+        if (dividend.kind !== "LiteralExpression" || typeof dividend.value !== "number")
+            return;
+        const divisor = rightExpression.kind === "LiteralExpression" && typeof rightExpression.value === "number"
+            ? rightExpression
+            : null;
+        if (divisor !== null) {
+            const divisorValue = Number(divisor.value);
+            if (divisorValue === 0)
+                return;
+            // `-0` renders as `0`, so a zero remainder would print one number on
+            // both sides of a sentence claiming they differ.
+            const remainder = -Number(dividend.value) % divisorValue;
+            if (!Number.isFinite(remainder) || remainder === 0)
+                return;
+            // A literal divisor is always positive — a negative one parses as a
+            // unary minus, not a literal — so Python's answer, which takes the
+            // divisor's sign, is this remainder lifted by one divisor.
+            const python = remainder + divisorValue;
+            // The rewrite the message advertises is its own remedy, so quoting an
+            // answer that rewrite does not produce would be false. The two part ways
+            // only when the lift rounds back onto the divisor; the general sentence
+            // below covers that without naming a number.
+            if ((remainder + divisorValue) % divisorValue === python) {
+                this.advise("A3", `VelarScript's '%' follows JavaScript and keeps the dividend's sign, so '-${dividend.raw} % ${divisor.raw}' is ${remainder} where Python answers ${python}; write '((a % b) + b) % b' for the Python answer`, operationSpan);
+                return;
+            }
+        }
+        this.advise("A3", "VelarScript's '%' follows JavaScript and keeps the dividend's sign, so a negative dividend leaves a remainder that is negative or zero, where Python's takes the divisor's sign; write '((a % b) + b) % b' for the Python answer", operationSpan);
+    }
     // D42 item 64: `==`/`!=` require the operand types to intersect. Strict
     // equality between two types that no single value inhabits is constant, so
     // the tightening converts a silent logic bug into a compile error. Runtime
@@ -5681,12 +6503,36 @@ export class Analyzer {
     // the same enum/string boundary as D42 item 64.
     requireMembershipIntersection(probe, domain, span, operation) {
         if (isInvalidType(probe) || isInvalidType(domain))
-            return;
+            return false;
         if (this.equalityTypesIntersect(probe, domain))
-            return;
+            return false;
         this.typeError(this.typesIntersect(probe, domain, false)
             ? `${describeType(probe)} can match ${describeType(domain)} only as an enum member against a raw string, and the enum and string domains never meet in '${operation}'${this.equalityGuidance(probe, domain)}`
             : `${describeType(probe)} and ${describeType(domain)} have no values in common, so '${operation}' can never match${this.equalityGuidance(probe, domain)}`, span);
+        return true;
+    }
+    // COL-I3 second half: the same ruling that rejects a freshly built literal
+    // as an `==` operand governs the membership vocabulary, because a membership
+    // test asks the `==` question one element at a time. A literal written
+    // inside the probe is a new object no element can be identical to, so the
+    // answer is provable from the literal alone.
+    //
+    // Only the probe side is closed, deliberately. The container side is an
+    // ordinary spelling — `x in [1, 2, 3]` builds the fresh List as the domain,
+    // not as the question — and `Set.add`, `Set<Record>` and `Map<Record, V>`
+    // are left alone for the same reason: an identity-keyed container of records
+    // is a legitimate program (adding the same object twice, holding a record as
+    // an identity token), so a diagnostic there would refuse correct code. A
+    // false positive on a correct program is worse than silence; the probe is
+    // the one position where the always-false answer is provable.
+    rejectFreshCollectionProbe(probe, operation, probes) {
+        const fresh = this.freshCollectionOperand(probe);
+        if (!fresh)
+            return false;
+        this.typeError(`A ${fresh.description} built inside the probe is a new object, and '${operation}' compares ${probes} identity, so it can never match; ${probes === "key"
+            ? "hold the key in a binding and probe with that binding, or compare contents with equals(a, b)"
+            : "compare contents with equals(a, b) — 'values.some(item => equals(item, probe))' asks the same question one element at a time"}`, fresh.span);
+        return true;
     }
     // ENM-I1: `is` / `is not` between statically disjoint enum domains is the
     // last equality surface that could launder one enum's member into another
@@ -5742,6 +6588,79 @@ export class Analyzer {
             return;
         this.rejectDisjointEnumTest(probe, target, "is", argument.span);
     }
+    /**
+     * D59 rule 141 settled that `toBe` *is* `==` ("toBe 必须用语言自己的 `==`")
+     * and rule 141.1 settled that `toContain` *is* `values.has(item)`. The
+     * runtime half of both landed; the compile-time half did not travel with
+     * them, so `expect([1]).toBe([1])` compiled and failed at run time with
+     * both operands rendering byte-identically, while `[1] == [1]` is refused
+     * where it is written. This runs the operator's own two gates on the
+     * matcher: D42 item 64's intersection requirement, and COL-I3's rejection
+     * of a freshly built literal in an identity comparison.
+     *
+     * `toBe` and `toEqual` deliberately part company on the fresh-literal gate.
+     * `toBe` asks the `==` question, where a new object can never be identical
+     * to anything, so the literal proves the answer. `toEqual` asks the
+     * `equals(a, b)` question, where a fresh literal is the normal and correct
+     * spelling of the expected value — rejecting it there would refuse the very
+     * repair the `toBe` message teaches. The intersection gate has no such
+     * split: two types with no values in common never deeply equal either.
+     *
+     * `toHaveLength` and `toMatch` are left alone. Neither takes a comparand:
+     * `toHaveLength` takes a count, and `toMatch` takes a regular-expression
+     * pattern whose relation to the subject is matching, not equality.
+     */
+    checkTestMatcherComparand(calleeExpression, arguments_) {
+        if (calleeExpression.kind !== "MemberExpression" || arguments_.length !== 1)
+            return;
+        const matcher = calleeExpression.property;
+        if (matcher !== "toBe" && matcher !== "toEqual" && matcher !== "toContain")
+            return;
+        const receiver = calleeExpression.object;
+        if (receiver.kind !== "CallExpression")
+            return;
+        const operand = this.testExpectOperands.get(spanIdentity(receiver.span));
+        if (operand === undefined)
+            return;
+        const argument = arguments_[0];
+        if (argument.kind === "SpreadExpression")
+            return;
+        const probe = this.inferredExpressionTypes.get(spanIdentity(argument.span));
+        if (!probe)
+            return;
+        // `==` leaves through `inferBinary`'s invalid-type exit before either of
+        // these gates runs, so the matcher that inherits the gates leaves there
+        // too: an operand the compiler already refused has been named once, and
+        // the always-false reading of a program that does not yet type-check is
+        // not a second mistake to report.
+        if (isInvalidType(operand) || isInvalidType(probe))
+            return;
+        if (matcher === "toContain") {
+            // The membership vocabulary's own pair (ENM-I3 and COL-I3's second
+            // half), asked one element at a time. Only a List receiver compares
+            // element identity; text containment is code-point containment, and a
+            // dynamic receiver proves nothing about which of the two it will be.
+            if (operand.kind !== "list")
+                return;
+            const contained = this.readonlyDataViewOf(operand.element);
+            if (!this.requireMembershipIntersection(probe, contained, argument.span, matcher)) {
+                this.rejectFreshCollectionProbe(argument, matcher, "element");
+            }
+            return;
+        }
+        if (this.requireMembershipIntersection(probe, operand, argument.span, matcher))
+            return;
+        if (matcher !== "toBe")
+            return;
+        // Either side settles it: `expect([1]).toBe(list)` is as constant as
+        // `expect(list).toBe([1])`, exactly as `==` treats its two operands.
+        const actualExpression = receiver.arguments[0];
+        const fresh = this.freshCollectionOperand(argument)
+            ?? (actualExpression && actualExpression.kind !== "SpreadExpression" ? this.freshCollectionOperand(actualExpression) : null);
+        if (!fresh)
+            return;
+        this.typeError(`A ${fresh.description} built inside the expectation is a new object, and 'toBe' compares collection identity, so it can never match; compare contents with 'toEqual(expected)'`, fresh.span);
+    }
     enumTargetOfValidatorObject(object) {
         if (object.kind !== "IdentifierExpression")
             return null;
@@ -6131,6 +7050,13 @@ export class Analyzer {
         this.enterScope();
         this.flowFrameDepth += 1;
         this.functionDepth += 1;
+        // D31 item 23: an arrow bound to a module-local name is the other deferred
+        // body a top-level call can run, and the binding does not exist until the
+        // declaration finishes, so the frame is filed by the arrow's own span and
+        // the declaration claims it afterwards.
+        const deferredFrame = { reads: [], calls: [] };
+        this.deferredReadFrames.push(deferredFrame);
+        this.arrowDeferredFrames.set(spanIdentity(expression.span), deferredFrame);
         const previousFinallyLoopDepths = this.finallyLoopDepths;
         this.finallyLoopDepths = [];
         this.asynchronousFunctions.push(expression.asynchronous);
@@ -6179,12 +7105,21 @@ export class Analyzer {
             this.arrowOwnedCaptures.set(spanIdentity(expression.span), captured);
         this.parameterDefaultDepth = outerParameterDefaultDepth;
         this.constructorDepth = outerConstructorDepth;
-        const checkedBodyResult = expected
+        let checkedBodyResult = expected
             && expandedExpectedResult.kind !== "unknown"
             && expandedExpectedResult.kind !== "any"
             && this.contextuallyAssignable(bodyResult, contextualResult, expression.body.span)
             ? contextualResult
             : bodyResult;
+        // D85 rule 207: with no contextual result the arrow's body is the only
+        // thing that says what it returns, so an empty collection written there
+        // has nothing settling it — the same position a body-inferred `return`
+        // occupies, reported the same way. Rule 209: once reported, the arrow's
+        // result is invalid rather than a `List<unknown>` a caller reports again.
+        if (expandedExpectedResult.kind === "unknown"
+            && this.requireSettledCollectionElement(expression.body, checkedBodyResult, false)) {
+            checkedBodyResult = invalidType;
+        }
         const result = expression.asynchronous
             ? { kind: "promise", value: this.resolvedAsyncResult(checkedBodyResult) }
             : checkedBodyResult;
@@ -6200,6 +7135,7 @@ export class Analyzer {
         }
         this.asynchronousFunctions.pop();
         this.finallyLoopDepths = previousFinallyLoopDepths;
+        this.deferredReadFrames.pop();
         this.functionDepth -= 1;
         this.flowFrameDepth -= 1;
         this.exitScope();
@@ -6351,6 +7287,18 @@ export class Analyzer {
                 }
                 return source.fields.size === 0 && expectedMap ? expectedMap : { kind: "map", key: stringType, value };
             }
+            // A `Record<V>` is the dynamic-key record, and `__velarCreateMap` has
+            // always read it. Only the structural `object` shape was accepted here,
+            // so the diagnostic below listed "a record" among the forms it takes and
+            // then refused one. Keys of a record are strings by construction.
+            if (source.kind === "record") {
+                const value = source.readonlyView ? this.readonlyDataViewOf(source.value) : source.value;
+                if (expectedMap) {
+                    this.requireAssignable(stringType, expectedMap.key, argument.span);
+                    this.requireAssignable(value, expectedMap.value, argument.span);
+                }
+                return { kind: "map", key: stringType, value };
+            }
             if (source.kind === "any")
                 return { kind: "map", key: anyType, value: anyType };
             this.typeError(`Map construction requires a Map, a List of [key, value] Lists, or a record, received ${describeType(source)}${this.iterationGuidance(source)}`, argument.span);
@@ -6467,8 +7415,15 @@ export class Analyzer {
                 && arguments_[0]?.kind === "ObjectExpression" && callee.result.kind === "named") {
                 this.recordRuntimeObjectShape(arguments_[0], callee.result);
             }
+            const diagnosticsBeforeArguments = this.diagnostics.length;
             this.checkArguments(arguments_, callee.parameters, callSpan, callee.requiredParameters, callee.rest, argumentNames, callee.parameterNames);
             this.rejectDisjointEnumValidatorProbe(calleeExpression, arguments_);
+            // One mistake, one diagnostic: the matcher gate speaks only when the
+            // argument itself checked out, because an unassignable comparand has
+            // already been named in the words the author needs.
+            if (this.diagnostics.length === diagnosticsBeforeArguments) {
+                this.checkTestMatcherComparand(calleeExpression, arguments_);
+            }
             this.reportPromiseCarrierHazard(callee.result, callSpan);
             if (callee.result.kind === "optional")
                 this.optionalCalls.add(spanIdentity(callSpan));
@@ -6507,7 +7462,10 @@ export class Analyzer {
                 for (const argument of arguments_) {
                     this.inferExpression(argument);
                 }
-                this.typeError("Cannot call an unknown JavaScript value without a declaration or validation", callSpan);
+                // D90 R17: a call needs a declared signature — `Type.parse` validates
+                // data, so the way in for a callable is the extern contract.
+                const receiver = calleeExpression ? this.boundaryReceiverText(calleeExpression) : null;
+                this.typeError(`Cannot call an unknown JavaScript value without a declaration or validation; declare the signature — an 'extern module' contract or a contracted 'extern js' block gives ${receiver ? `'${receiver}'` : "the value"} a checked type — or validate the data it came from with 'Type.parse' first`, callSpan);
             }
             return unknownType;
         }
@@ -6741,8 +7699,17 @@ export class Analyzer {
                 const value = argument.kind === "SpreadExpression" ? argument.value : argument;
                 if (value.kind === "ArrowFunctionExpression")
                     deferredNamedArrows.add(value);
-                else
-                    this.inferExpression(value, target === null ? unknownType : intrinsic.parameters[target] ?? intrinsic.rest ?? unknownType);
+                else {
+                    const declared = target === null ? unknownType : intrinsic.parameters[target] ?? intrinsic.rest ?? unknownType;
+                    // D90 R17: an accept-anything parameter is spelled `List<unknown>`
+                    // in the vocabulary tables, and that spelling carries no element
+                    // information — preanalyzing a literal against it would launder
+                    // `[1, 2]` into a list the handler can read no numbers from, so the
+                    // literal keeps its own inferred element and the handler's own
+                    // expected type does the checking.
+                    const context = declared.kind === "list" && declared.element.kind === "unknown" ? unknownType : declared;
+                    this.inferExpression(value, context);
+                }
             }
             if (!named.valid) {
                 for (const argument of deferredNamedArrows)
@@ -7142,7 +8109,9 @@ export class Analyzer {
                     fields.set("toBeFalsy", { kind: "function", parameters: [], requiredParameters: 0, result: nullType });
                 }
                 if (matched.kind === "list" || matched.kind === "string" || dynamic) {
-                    const contained = matched.kind === "list" ? matched.element : matched.kind === "string" ? stringType : anyType;
+                    // D90 R17: an accept-anything parameter position is `unknown`, the
+                    // top type for assignment targets; `any` stays a value kind only.
+                    const contained = matched.kind === "list" ? matched.element : matched.kind === "string" ? stringType : unknownType;
                     fields.set("toContain", { kind: "function", parameterNames: ["expected"], parameters: [contained], requiredParameters: 1, result: nullType });
                     fields.set("toHaveLength", { kind: "function", parameterNames: ["length"], parameters: [numberType], requiredParameters: 1, result: nullType });
                 }
@@ -7432,7 +8401,7 @@ export class Analyzer {
         // Map/Record key of `get`) is judged by intersection with the element or
         // key domain — the per-element `==` question — rather than assignability,
         // whose enum -> string one-way exit would launder a bare-string match.
-        const checkProbeArgument = (domain, operation) => {
+        const checkProbeArgument = (domain, operation, probes = "element") => {
             requireCount(1);
             const argument = argumentAt(0);
             if (!argument)
@@ -7442,7 +8411,12 @@ export class Analyzer {
                 return;
             }
             const probe = namedPreanalyzed ? this.inferredExpressionType(argument) : this.inferExpression(argument, domain);
-            this.requireMembershipIntersection(probe, domain, argument.span, operation);
+            // The domain mismatch is the more precise answer where both apply, so
+            // the fresh-literal rejection speaks only when the probe's type is right
+            // and identity is the sole reason it can never match.
+            if (!this.requireMembershipIntersection(probe, domain, argument.span, operation)) {
+                this.rejectFreshCollectionProbe(argument, operation, probes);
+            }
             if (!namedPreanalyzed) {
                 for (const extra of arguments_.slice(1)) {
                     if (!omitted(extra))
@@ -7736,7 +8710,7 @@ export class Analyzer {
                     this.typeError("Use 'get(key) ?? fallback'; Map.get has one optional-result contract", callSpan);
                     return optionalOf(readonlyValue);
                 }
-                checkProbeArgument(comparisonKey, "Map.get");
+                checkProbeArgument(comparisonKey, "Map.get", "key");
                 return optionalOf(readonlyValue);
             }
             if (member.property === "keys") {
@@ -7756,12 +8730,12 @@ export class Analyzer {
             }
             if (member.property === "has") {
                 this.collectionCalls.set(member.span.end, "mapHas");
-                checkProbeArgument(comparisonKey, "Map.has");
+                checkProbeArgument(comparisonKey, "Map.has", "key");
                 return boolType;
             }
             if (member.property === "remove") {
                 this.collectionCalls.set(member.span.end, "mapRemove");
-                checkProbeArgument(comparisonKey, "Map.remove");
+                checkProbeArgument(comparisonKey, "Map.remove", "key");
                 return boolType;
             }
             if (member.property === "clear") {
@@ -7783,7 +8757,7 @@ export class Analyzer {
             }
             if (member.property === "get") {
                 this.collectionCalls.set(member.span.end, "recordGet");
-                checkProbeArgument(stringType, "Record.get");
+                checkProbeArgument(stringType, "Record.get", "key");
                 return optionalOf(readonlyValue);
             }
             if (member.property === "keys") {
@@ -7803,12 +8777,12 @@ export class Analyzer {
             }
             if (member.property === "has") {
                 this.collectionCalls.set(member.span.end, "recordHas");
-                checkProbeArgument(stringType, "Record.has");
+                checkProbeArgument(stringType, "Record.has", "key");
                 return boolType;
             }
             if (member.property === "remove") {
                 this.collectionCalls.set(member.span.end, "recordRemove");
-                checkProbeArgument(stringType, "Record.remove");
+                checkProbeArgument(stringType, "Record.remove", "key");
                 return boolType;
             }
             if (member.property === "clear") {
@@ -8048,7 +9022,7 @@ export class Analyzer {
             if (isInvalidType(object))
                 result = invalidType;
             else
-                this.typeError(`Cannot access '${property}' on unknown without validation`, memberSpan);
+                this.typeError(`Cannot access '${property}' on unknown without validation${this.boundaryValidationGuidance(objectExpression, property)}`, memberSpan);
         }
         else if (object.kind === "string") {
             result = this.stringMember(property) ?? unknownType;
@@ -8741,6 +9715,7 @@ export class Analyzer {
     updateInferredCallableResult(statement, className, binding, result, asynchronous) {
         if (binding) {
             const type = this.callableWithInferredResult(binding.declaredType, result, asynchronous);
+            this.recordFlowFactOrigin(binding);
             binding.type = type;
             binding.declaredType = type;
             binding.storageType = type;
@@ -8919,8 +9894,18 @@ export class Analyzer {
                 this.classDisplayNames.set(type.identity, local);
             return type;
         }
+        // D90 R17: an undeclared foreign value arrives as unknown — R12 refused
+        // `any` at export positions, and this closes the entry. The value must be
+        // validated into a concrete type (`Type.parse`) before members, calls, or
+        // operators touch it; `unsafe` names the missing declaration, not a
+        // license to chain through the boundary. A host-injected binding is a
+        // declaration — the host answered for the name — so it still wins. The
+        // boundary marker matters: a bare `unknown` is the inference seed a merge
+        // absorbs, while this value is *known to be unchecked*, so `[mystery, 5]`
+        // must stay `List<unknown | number>` instead of laundering into
+        // `List<number>`.
         if (statement.unsafe)
-            return anyType;
+            return this.importBindings.get(local) ?? boundaryUnknownType;
         const declarations = this.externModules.get(statement.source);
         if (namespace)
             return declarations
@@ -9278,9 +10263,10 @@ export class Analyzer {
     // whether the value is true, so 'false' and null take the same else path and
     // 'if flag:' stays the spelling for both. Any other optional has to say
     // which question it asks, because "holds a value" and "is true" are
-    // different tests. BRG-N4: `any` is rejected too — raw JavaScript
-    // truthiness would judge 0 and "" false, which breaks the owner's ruling
-    // that a condition judges only bool; validate the boundary value first.
+    // different tests. BRG-N4 + D90 R17: an unchecked boundary value — `any` or
+    // `unknown` — is rejected with one message: raw JavaScript truthiness would
+    // judge 0 and "" false, which breaks the owner's ruling that a condition
+    // judges only bool, so the boundary value is validated first.
     requireCondition(type, condition) {
         this.checkGetterNarrowingTest(condition);
         if (isInvalidType(type))
@@ -9288,8 +10274,8 @@ export class Analyzer {
         const expanded = this.expandAliases(type);
         if (expanded.kind === "bool")
             return;
-        if (expanded.kind === "any") {
-            this.typeError("A condition judges only bool, and an unchecked any would ride JavaScript truthiness (0 and \"\" become false); validate the value first, or compare it explicitly", condition.span);
+        if (expanded.kind === "any" || expanded.kind === "unknown") {
+            this.typeError(`A condition judges only bool, and an unchecked ${describeType(type)} would ride JavaScript truthiness (0 and "" become false); validate the value at the edge — 'Type.parse' — and judge the checked result, or compare it explicitly`, condition.span);
             return;
         }
         if (expanded.kind === "optional") {
@@ -9377,6 +10363,45 @@ export class Analyzer {
         }
         return null;
     }
+    /**
+     * D90 R17: the author's own spelling of a boundary value, for the
+     * diagnostics that teach `Type.parse`. Identifier and member paths render
+     * exactly, a simple call renders as `name(...)`, and anything else answers
+     * null so the caller falls back to the word `value`.
+     */
+    boundaryReceiverText(expression) {
+        if (expression.kind === "IdentifierExpression")
+            return expression.name;
+        if (expression.kind === "MemberExpression" && !expression.optional) {
+            const owner = this.boundaryReceiverText(expression.object);
+            return owner === null ? null : `${owner}.${expression.property}`;
+        }
+        if (expression.kind === "CallExpression") {
+            const callee = this.boundaryReceiverText(expression.callee);
+            return callee === null ? null : `${callee}(...)`;
+        }
+        return null;
+    }
+    /** A type name suggested from the receiver's last name segment, or 'X' when none reads naturally. */
+    boundaryTypeNameSuggestion(receiver) {
+        const segment = receiver?.replace(/\(\.\.\.\)$/u, "").split(".").at(-1) ?? "";
+        return /^[a-zA-Z]/u.test(segment) ? segment[0].toUpperCase() + segment.slice(1) : "X";
+    }
+    /**
+     * D90 R17: an undeclared foreign value arrives as unknown, and the way into
+     * the typed world is `Type.parse` at the edge. Every refusal on an unknown
+     * teaches that ritual with the author's own expression spelled into it.
+     */
+    boundaryValidationGuidance(expression, property) {
+        const receiver = expression ? this.boundaryReceiverText(expression) : null;
+        const name = this.boundaryTypeNameSuggestion(receiver);
+        const spelled = receiver ?? "value";
+        const declared = property === null
+            ? `declare a type naming the shape you rely on — 'type ${name}:'`
+            : `declare a type naming the fields you rely on — 'type ${name}:' with the '${property}' field`;
+        const read = property === null ? "use 'checked' from there" : `read 'checked.${property}'`;
+        return `; ${declared} — then validate first: 'const checked = ${name}.parse(${spelled})' and ${read}`;
+    }
     // Presence guidance names the exact spelling to write whenever the condition
     // is a plain name or a plain member path; anything else is taught the
     // operator without inventing source text for it.
@@ -9434,6 +10459,17 @@ export class Analyzer {
                 this.typeError(`Cannot assign ${actualDescription} to ${expectedDescription}; ${asyncResult}`, valueSpan);
                 return;
             }
+            // D90 R17: an undeclared foreign value is unknown until validated, so
+            // the mismatch teaches the entry ritual instead of restating the kinds.
+            if (expandedActual.kind === "unknown" && !isInvalidType(expandedActual)) {
+                const named = expectedCore.kind === "named" || expectedCore.kind === "enum"
+                    ? `'const checked = ${describeType(expectedCore)}.parse(value)'`
+                    : expectedCore.kind === "string" || expectedCore.kind === "number" || expectedCore.kind === "bool"
+                        ? `narrow it with 'value is ${describeType(expectedCore)}', or parse a declared shape`
+                        : "declare a type naming the shape you rely on and call 'Type.parse' on the value";
+                this.typeError(`Cannot assign ${actualDescription} to ${expectedDescription}; a boundary value stays unknown until validated at the edge — ${named}`, valueSpan);
+                return;
+            }
             // COL-U10: a value of one collection family in another family's
             // position gets the bridge spelling, not a bare mismatch.
             const bridge = this.collectionBridgeGuidance(expandedActual, expectedCore);
@@ -9979,8 +11015,12 @@ export class Analyzer {
                 return extensionResult;
             switch (syntax.kind) {
                 case "NamedTypeSyntax": {
+                    // D90 R17 removed the boundary that used to produce `any`, so the
+                    // old reason clause ("reserved for explicit unsafe JavaScript
+                    // boundaries") named a producer that no longer exists. The refusal
+                    // now teaches the same entrance every other unknown refusal teaches.
                     if (syntax.name === "any") {
-                        this.typeError("'any' is reserved for explicit unsafe JavaScript boundaries; use 'unknown' in VelarScript", syntax.span);
+                        this.typeError(`'any' is not a VelarScript type; a foreign value arrives as 'unknown', which is what you annotate${this.boundaryValidationGuidance(null, null)}`, syntax.span);
                         return false;
                     }
                     if (this.invalidDeclaredTypes.has(syntax.name))
@@ -10387,6 +11427,30 @@ export class Analyzer {
             }
         }
     }
+    /**
+     * D50 rule 97.3: a retirement that leaves one surviving spelling did not
+     * happen. `export {stringify} from "velar/json"` is an import spelling with
+     * an export in front of it — the barrel republishes the retired bare name
+     * and every downstream `import {stringify} from "./barrel.vel"` is clean
+     * forever after. No mechanical fix: which reads in which other modules
+     * wanted the name is not a rewrite this module can make.
+     */
+    reportPermanentNamespaceReExports(program) {
+        for (const statement of program.body) {
+            if (statement.kind !== "ReExportDeclaration")
+                continue;
+            const roster = permanentNamespaceImportRoster(statement.source);
+            if (!roster)
+                continue;
+            for (const specifier of statement.specifiers) {
+                if (!roster.members.has(specifier.imported))
+                    continue;
+                this.diagnostics.push(diagnostic("VEL3008", roster.namespace === null
+                    ? `Use ${specifier.imported}(...) directly; a re-export cannot restore a retired import spelling, and the Core prelude needs none`
+                    : `Use ${roster.namespace}.${specifier.imported} directly; a re-export cannot restore a retired import spelling`, specifier.span));
+            }
+        }
+    }
     /** A member name to show in the rule 106 guidance, so the fix is concrete. */
     firstNamespaceMember(namespace) {
         const binding = this.builtin(namespace);
@@ -10403,6 +11467,25 @@ export class Analyzer {
     recoveredTypeError(message, errorSpan, fix) {
         this.diagnostics.push(recoveredDiagnostic("VEL4001", message, errorSpan, fix));
     }
+    /**
+     * D89: raises a roster advisory. It cannot reach `this.diagnostics`, so it
+     * cannot fail a build and cannot shift the diagnostic cursors this analyzer
+     * reads as array lengths.
+     *
+     * One report per code and span. `reanalyzeLoopBackEdge` runs a loop body a
+     * second time whenever the back edge invalidates a fact, and its diagnostic
+     * answer is `deduplicateDiagnostics`, which only ever touches
+     * `this.diagnostics`. Deduplicating where the advisory is raised covers that
+     * pass and every other re-analysis without a second pair of cursors, which
+     * is the whole reason the two channels are separate arrays.
+     */
+    advise(code, message, adviceSpan, fix) {
+        const identity = `${code}\u0000${adviceSpan.start}\u0000${adviceSpan.end}`;
+        if (this.advisedIdentities.has(identity))
+            return;
+        this.advisedIdentities.add(identity);
+        this.advisories.push(advisory(code, message, adviceSpan, fix));
+    }
     analyzeMatchPattern(pattern, input, bindings) {
         switch (pattern.kind) {
             case "MatchAsPattern": {
@@ -10884,11 +11967,15 @@ export class Analyzer {
     }
     builtin(name) {
         const type = this.extensionGlobals.get(name) ?? coreVocabularyType(name)
-            ?? (name === "Error" || name === "ValidationError" || name === "NarrowingError" || name === "IndexError"
+            ?? (name === "Error" || name === "ValidationError" || name === "AssertionError"
+                || name === "NarrowingError" || name === "IndexError"
                 || VELAR_HOST_ERROR_NAMES.includes(name)
                 ? { kind: "classConstructor", name }
                 : null)
-            ?? (name === "Map" || name === "Set" ? anyType : null);
+            // D90 R17: `Map`/`Set` as bare values are collection constructors the
+            // call path special-cases; the bare binding itself carries no members,
+            // so it is unknown, never a silent `any`.
+            ?? (name === "Map" || name === "Set" ? unknownType : null);
         return type ? {
             mutable: false,
             type,
@@ -10904,19 +11991,144 @@ export class Analyzer {
      * constructor's own arguments. Nothing infers it from a later mutation, so a
      * binding left with no source is reported at the construction rather than
      * kept as `unknown` for a following line to fill in.
+     *
+     * The value written at this position is not always the construction itself.
+     * A ternary arm, a list element or its spread, a record-literal field, a
+     * `??` fallback, a receiver and an argument all become part of the value the
+     * name holds, so each is its own settling position and each reports at its
+     * own `[]`. What stops the walk is the value, not the syntax: it descends
+     * only while `carriesUnsettledCollection` still sees the hole in the type
+     * arriving here, so `print(Set().size)` and `const n = Set().size` stay
+     * legal per rule 208 — neither of those names holds a collection — while a
+     * spread whose `unknown` the merge absorbs (`["x", ...[]]`) leaves nothing
+     * to report. A sibling settles nothing for its neighbour: `[["a"], []]`
+     * merges through `unionOf`, so the union still carries the hole and the
+     * empty `[]` reports on its own.
+     *
+     * Returns whether it reported, so the caller can hand the name `invalidType`
+     * instead of the hole. Rule 209 requires one mistake to be reported once,
+     * and `List<unknown>` reaching a later line is what produces the second,
+     * contradicting report the ruling exists to delete.
      */
     requireSettledCollectionElement(initializer, declared, annotated) {
         if (annotated)
+            return false;
+        return this.reportUnsettledCollection(initializer, this.expandAliases(declared));
+    }
+    /**
+     * D85 rule 209: where the value at this position came from, when it came
+     * from a hole VEL4039 already reported. The answer is two-part because a
+     * callee can be declared after its caller: `true` is a hole already on
+     * record, and `causes` are the local results that make this position a hole
+     * too if theirs turn out to be one.
+     *
+     * Only a name and a call to a local name are modelled — the two shapes an
+     * author writes between an empty collection and the `return` that publishes
+     * it. Anything else contributes nothing, so an unmodelled position keeps the
+     * report it has today rather than losing one.
+     */
+    collectResultHoleSources(expression, causes) {
+        if (expression.kind === "IdentifierExpression") {
+            const binding = this.lookup(expression.name);
+            if (!binding)
+                return false;
+            for (const cause of this.bindingHoleCauses.get(binding) ?? [])
+                causes.add(cause);
+            return this.reportedCollectionHoles.has(binding);
+        }
+        if (expression.kind === "CallExpression" && expression.callee.kind === "IdentifierExpression") {
+            const binding = this.lookup(expression.callee.name);
+            const resultKey = binding ? this.functionResultKeys.get(binding) : undefined;
+            // An imported, dynamically dispatched, or method call resolves to no
+            // local result. Its hole — if it has one — was reported in the module
+            // that owns it, and nothing here can say so, so the call is not a cause.
+            if (resultKey === undefined)
+                return false;
+            if (this.reportedResultHoles.has(resultKey))
+                return true;
+            causes.add(resultKey);
+            return false;
+        }
+        return false;
+    }
+    /**
+     * D85 rule 209: a name bound to a reported hole carries it, so `const a = []`
+     * followed by `return a` is the same one mistake `return []` is. Only an
+     * unannotated `const`/`let` of a single name carries anything: an annotation
+     * settles the construction, and a destructuring pattern takes the hole apart
+     * rather than passing it on.
+     */
+    recordBindingHoleSource(pattern, initializer, reported) {
+        if (pattern.kind !== "NameBindingPattern")
+            return;
+        const binding = this.scopes.at(-1)?.get(pattern.name);
+        if (!binding)
             return;
-        const type = this.expandAliases(declared);
-        if (!this.isFreshUnresolvedCollection(initializer, type))
+        const causes = new Set();
+        if (reported || this.collectResultHoleSources(initializer, causes)) {
+            this.reportedCollectionHoles.add(binding);
+            return;
+        }
+        if (causes.size > 0)
+            this.bindingHoleCauses.set(binding, causes);
+    }
+    /**
+     * D85 rule 209: delete the convergence report of every function whose result
+     * is invalid only because a hole VEL4039 already explained reached it through
+     * a local call. The set grows until it stops growing, because a chain of
+     * forwarding functions is still one mistake however long it is — and a cycle
+     * with no empty collection anywhere in it never enters the set, so a genuine
+     * convergence failure still reports on both of its halves.
+     */
+    resolveDeferredConvergenceReports() {
+        if (this.deferredConvergenceReports.length === 0)
             return;
-        const [spelling, holds, example] = type.kind === "list"
-            ? ["[]", "what the List holds", "let items: List<string> = []"]
-            : type.kind === "set"
-                ? ["Set()", "what the Set holds", "const tags: Set<string> = Set()"]
-                : ["Map()", "what the Map holds", "const users: Map<string, User> = Map()"];
-        this.diagnostics.push(diagnostic("VEL4039", `Empty '${spelling}' requires an explicit type; nothing at this position says ${holds} — write '${example}'`, initializer.span));
+        const suppressed = new Set();
+        for (let growing = true; growing;) {
+            growing = false;
+            for (const entry of this.deferredConvergenceReports) {
+                if (suppressed.has(entry.report))
+                    continue;
+                if (![...entry.causes].some((cause) => this.reportedResultHoles.has(cause)))
+                    continue;
+                suppressed.add(entry.report);
+                this.reportedResultHoles.add(entry.resultKey);
+                growing = true;
+            }
+        }
+        for (let index = this.diagnostics.length - 1; index >= 0; index -= 1) {
+            const report = this.diagnostics[index];
+            if (report && suppressed.has(report))
+                this.diagnostics.splice(index, 1);
+        }
+    }
+    reportUnsettledCollection(expression, type) {
+        if (type !== null) {
+            if (this.isFreshUnresolvedCollection(expression, type)) {
+                const [spelling, holds, example] = type.kind === "list"
+                    ? ["[]", "what the List holds", "let items: List<string> = []"]
+                    : type.kind === "set"
+                        ? ["Set()", "what the Set holds", "const tags: Set<string> = Set()"]
+                        : ["Map()", "what the Map holds", "const users: Map<string, User> = Map()"];
+                this.diagnostics.push(diagnostic("VEL4039", `Empty '${spelling}' requires an explicit type; nothing at this position says ${holds} — write '${example}'`, expression.span));
+                return true;
+            }
+            if (!carriesUnsettledCollection(type))
+                return false;
+        }
+        let reported = false;
+        for (const part of settlingValuePositions(expression)) {
+            // A part analyzed under a contextual type that settled it never reaches
+            // here as `unknown`; one that was analyzed at all has its answer on
+            // record. A part with no answer on record was never inferred as a whole
+            // — `Map([[key, value]])` reads the entry's two leaves and never the
+            // entry list itself — so the walk carries on through the gap rather
+            // than stopping at one it did not make.
+            const partType = this.inferredExpressionTypes.get(spanIdentity(part.span));
+            if (this.reportUnsettledCollection(part, partType ? this.expandAliases(partType) : null))
+                reported = true;
+        }
+        return reported;
     }
     isFreshUnresolvedCollection(expression, type) {
         const unresolved = type.kind === "list" ? type.element.kind === "unknown"
@@ -10998,7 +12210,9 @@ export class Analyzer {
             storageType: type,
             span: declarationSpan,
             narrowingFrame: null,
+            flowScope: this.scopes.length - 1,
         };
+        this.recordScopedName(name);
         scope.set(name, binding);
         if (this.scopes.length === 1 && type.kind === "typeObject")
             this.runtimeTypeObjectNames.add(name);
@@ -11024,12 +12238,54 @@ export class Analyzer {
     }
     recordInitializationImportRead(binding, local, span) {
         const origin = this.importedBindingSources.get(binding);
-        if (origin === undefined || !this.inModuleInitializationPosition())
+        if (origin === undefined)
+            return;
+        const read = { local, source: origin.source, imported: origin.imported, span };
+        // D31 item 23: a read inside a deferred body belongs to that body, not to
+        // the module. Whether it runs during module evaluation is decided by
+        // `moduleInitializationImportReads`, once the top-level calls are known.
+        const frame = this.deferredReadFrames.at(-1);
+        if (frame) {
+            frame.reads.push(read);
             return;
-        const key = spanIdentity(span);
-        if (!this.initializationImportReadSites.has(key)) {
-            this.initializationImportReadSites.set(key, { local, source: origin.source, imported: origin.imported, span });
         }
+        if (!this.inModuleInitializationPosition())
+            return;
+        const key = spanIdentity(span);
+        if (!this.initializationImportReadSites.has(key))
+            this.initializationImportReadSites.set(key, read);
+    }
+    /**
+     * D31 item 23: the call edge. Inside a deferred body it is an edge of the
+     * reachability graph; at module top level it is a root, because that call
+     * runs the callee while the module itself evaluates. The callee is held as
+     * a binding, not as a frame — a `def` is hoisted, so `const x = pull()` can
+     * be analyzed before `def pull()` is.
+     */
+    recordDeferredCallEdge(callee, span) {
+        if (callee.kind !== "IdentifierExpression")
+            return;
+        // The two cheap questions first: every other call would pay for a scope
+        // lookup whose answer nothing reads.
+        const frame = this.deferredReadFrames.at(-1);
+        if (!frame && !this.inModuleInitializationPosition())
+            return;
+        const binding = this.lookup(callee.name);
+        if (!binding)
+            return;
+        if (frame)
+            frame.calls.push(binding);
+        else
+            this.initializationLocalCalls.push({ binding, span });
+    }
+    /** Files an arrow's deferred frame under the module-local name it was bound to. */
+    claimArrowDeferredFrame(pattern, initializer) {
+        if (initializer.kind !== "ArrowFunctionExpression" || pattern.kind !== "NameBindingPattern")
+            return;
+        const frame = this.arrowDeferredFrames.get(spanIdentity(initializer.span));
+        const binding = this.scopes.at(-1)?.get(pattern.name);
+        if (frame && binding)
+            this.localFunctionFrames.set(binding, frame);
     }
     // True while code at this point runs during module evaluation itself:
     // top-level initializers and expression statements (including nested
@@ -11047,9 +12303,52 @@ export class Analyzer {
             && this.instanceFieldInitializerDepth === 0
             && this.deferredExecutionDepth === 0;
     }
-    /** Initialization-position reads of imported bindings, for the project module-cycle check. */
+    /**
+     * Initialization-position reads of imported bindings, for the project
+     * module-cycle check.
+     *
+     * D31 item 23 recorded the indirect shape as a v1 residual: a top-level call
+     * of a module-local function runs that body while the module evaluates, so
+     * an imported binding read inside it is an initialization-position read too
+     * — and following VEL3019's own remediation ("Move this read into a
+     * function") and then calling that function at top level re-created the bare
+     * `ReferenceError` the check exists to delete. The closure below is the
+     * intra-module reachability pass that closes it: one module, one walk over
+     * the call edges already collected, no cross-module analysis.
+     *
+     * An indirect read is reported at the *call*, not at the read. The call is
+     * the line that runs during module evaluation and the line an author can
+     * move; the read inside the body is already in a function, which is what the
+     * remediation asks for.
+     */
     moduleInitializationImportReads() {
-        return [...this.initializationImportReadSites.values()];
+        const sites = new Map(this.initializationImportReadSites);
+        const visited = new Set();
+        const collect = (frame, callSpan) => {
+            if (visited.has(frame))
+                return;
+            visited.add(frame);
+            for (const read of frame.reads) {
+                const key = `${spanIdentity(callSpan)}\0${read.local}\0${read.source}`;
+                if (!sites.has(key))
+                    sites.set(key, { ...read, span: callSpan });
+            }
+            for (const called of frame.calls) {
+                const next = this.localFunctionFrames.get(called);
+                if (next)
+                    collect(next, callSpan);
+            }
+        };
+        for (const call of this.initializationLocalCalls) {
+            const frame = this.localFunctionFrames.get(call.binding);
+            // One root at a time: two roots reaching the same body must each report,
+            // so the visited set is per root rather than per module.
+            if (frame) {
+                visited.clear();
+                collect(frame, call.span);
+            }
+        }
+        return [...sites.values()];
     }
     // D32 item 29: the language-wide text-conversion contract (charter
     // section 14) shared by f-strings, str(), and target-owned render sites.
@@ -11330,6 +12629,128 @@ export class Analyzer {
             }
         }
     }
+    /**
+     * D90 R12: "exported" is a property of the declaration a consumer can reach,
+     * not of the `def` keyword. A module-level declaration carries the flag
+     * itself and is judged here and now. A class member carries none — a public
+     * member of a class this module publishes is read by a consumer exactly as
+     * an exported `const` is — but whether the class is published is a question
+     * about the whole module, so the member waits for reportExportPositionAny. A
+     * `private` member is never reachable, and R12's boundary does not move:
+     * module-internal `any` stays legal.
+     */
+    recordExportedAny(statement, className, span) {
+        if (statement.exported === true) {
+            this.reportExportedAny([statement.name], span);
+            return;
+        }
+        if (className === null || statement.private === true)
+            return;
+        this.exportPositionCandidates.push({ className, member: statement.name, span });
+    }
+    /**
+     * D90 R12: the class members that turned out to be at an export position.
+     * Reported once the module is analyzed, because the answer is reachability
+     * and reachability is a property of the module, not of the declaration.
+     */
+    reportExportPositionAny(program) {
+        if (this.exportPositionCandidates.length === 0)
+            return;
+        const reachable = this.exportReachableClasses(program);
+        for (const candidate of this.exportPositionCandidates) {
+            if (reachable.has(candidate.className)) {
+                this.reportExportedAny([`${candidate.className}.${candidate.member}`], candidate.span);
+            }
+        }
+    }
+    /**
+     * D90 R12: which class declarations a consuming module can reach. Exported
+     * classes seed the set; from there it follows every position a consumer can
+     * read a value *out of* — the type of anything else this module exports, the
+     * base a reachable class names, and the public surface of a class already
+     * reachable. `export class Box extends Base:` publishes `Base`'s members,
+     * and `def make() -> Inner` publishes `Inner`'s, whether or not either name
+     * is exported.
+     *
+     * Input positions are deliberately absent, for the same reason
+     * `typeContainsAnyOutput` omits them: a consumer that has to *supply* an
+     * instance obtained it from an output position first, and that position is
+     * what makes the class reachable.
+     */
+    exportReachableClasses(program) {
+        const classes = [];
+        const records = [];
+        const reach = (type) => {
+            if (type)
+                collectOutputTypeNames(type, classes, records);
+        };
+        // The same walk validateReExports makes over the module's export surface,
+        // so the two cannot disagree about what "this module exports" means.
+        const publish = (name) => {
+            reach(this.scopes[0].get(name)?.type);
+            records.push(name);
+        };
+        for (const statement of program.body) {
+            if (statement.kind === "ReExportDeclaration" || !("exported" in statement) || !statement.exported)
+                continue;
+            if (statement.kind === "ClassDeclaration")
+                classes.push(statement.name);
+            else if (statement.kind === "VariableDeclaration")
+                this.collectPatternNames(statement.pattern, publish);
+            else if ("name" in statement && typeof statement.name === "string")
+                publish(statement.name);
+        }
+        const reachable = new Set();
+        const visitedRecords = new Set();
+        while (classes.length > 0 || records.length > 0) {
+            if (records.length > 0) {
+                const name = records.pop();
+                if (visitedRecords.has(name))
+                    continue;
+                visitedRecords.add(name);
+                // A record a consumer holds is read field by field, so a class in a
+                // field is reachable even when the record type itself is not exported.
+                for (const field of this.namedTypes.get(name)?.values() ?? [])
+                    reach(field);
+                reach(this.typeAliases.get(name));
+                continue;
+            }
+            const name = classes.pop();
+            if (reachable.has(name))
+                continue;
+            reachable.add(name);
+            const info = this.classes.get(name);
+            if (!info)
+                continue;
+            if (info.base)
+                classes.push(info.base);
+            reach(info.iterate);
+            // ClassInfo is exactly the public surface — private members live in
+            // their own tables — and `fields` carries the getters' result types.
+            // The constructor's parameters are inputs, so they are not followed.
+            for (const field of info.fields.values())
+                reach(field.type);
+            for (const field of info.staticFields.values())
+                reach(field.type);
+            for (const method of info.methods.values())
+                reach(method);
+            for (const method of info.staticMethods.values())
+                reach(method);
+        }
+        return reachable;
+    }
+    /**
+     * D90 R12: the diagnostic has to teach the way out, not only refuse. A
+     * consuming module never writes `unsafe`, so an exported `any` hands it a
+     * value carrying no guarantee at all; the escape is to validate the value
+     * into a declared type in the module that owns the boundary, which is what
+     * `Type.parse` exists for. No new diagnostic code and no unsafe marker: this
+     * is the rule at validateTypeReference finished, not a second rule.
+     */
+    reportExportedAny(exported, span) {
+        const names = exported.map((name) => `'${name}'`).join(", ");
+        this.typeError(`${exported.length === 1 ? "Export" : "Exports"} ${names} ${exported.length === 1 ? "is" : "are"} 'any', which cannot cross a module boundary; validate the value into a declared type in this module first — 'const settled = Config.parse(candidate)' — and export that`, span);
+    }
     collectPatternNames(pattern, add) {
         if (pattern.kind === "NameBindingPattern") {
             add(pattern.name);
@@ -11391,7 +12812,10 @@ export class Analyzer {
                 : type.kind === "any" ? anyType : unknownType;
             const declaredElement = declaredType.kind === "list" ? declaredType.readonlyView ? this.readonlyDataViewOf(declaredType.element) : declaredType.element
                 : declaredType.kind === "any" ? anyType : unknownType;
-            if (type.kind !== "list" && type.kind !== "any") {
+            // An invalid source has already been reported where it went wrong —
+            // D85 rule 209's "one mistake, one report" — and `describeType` would
+            // render it as the bare `unknown` nobody wrote.
+            if (type.kind !== "list" && type.kind !== "any" && !isInvalidType(type)) {
                 this.typeError(`Cannot list-destructure ${describeType(type)}`, pattern.span);
             }
             for (const child of pattern.elements)
@@ -11520,7 +12944,7 @@ export class Analyzer {
             }
             else {
                 const binding = this.lookup(key);
-                this.scopes.at(-1).set(key, {
+                const shadow = {
                     mutable: binding?.mutable ?? false,
                     type,
                     declaredType: binding?.declaredType ?? type,
@@ -11528,8 +12952,14 @@ export class Analyzer {
                     ...(binding ? { storageBinding: binding.storageBinding ?? binding } : {}),
                     span: binding?.span ?? narrowingSpan,
                     narrowingFrame: this.flowFrameDepth,
+                    flowScope: this.scopes.length - 1,
                     ...(binding?.reactiveKind ? { reactiveKind: binding.reactiveKind } : {}),
-                });
+                };
+                this.trackNarrowingShadow(shadow);
+                this.narrowedNames.at(-1).add(key);
+                if (!this.scopes.at(-1).has(key))
+                    this.recordScopedName(key);
+                this.scopes.at(-1).set(key, shadow);
             }
         }
     }
@@ -11545,14 +12975,16 @@ export class Analyzer {
             if (!binding)
                 continue;
             const local = scope.get(key);
+            this.narrowedNames.at(-1).add(key);
             if (local) {
+                this.recordFlowFactOrigin(local);
                 local.type = type;
                 local.narrowingFrame = this.flowFrameDepth;
                 // A persisted (checked or merged) fact is not assignment-established.
                 local.assignedFact = false;
             }
             else {
-                scope.set(key, {
+                const shadow = {
                     mutable: binding.mutable,
                     type,
                     declaredType: binding.declaredType,
@@ -11560,8 +12992,12 @@ export class Analyzer {
                     storageBinding: binding.storageBinding ?? binding,
                     span: binding.span,
                     narrowingFrame: this.flowFrameDepth,
+                    flowScope: this.scopes.length - 1,
                     ...(binding.reactiveKind ? { reactiveKind: binding.reactiveKind } : {}),
-                });
+                };
+                this.trackNarrowingShadow(shadow);
+                this.recordScopedName(key);
+                scope.set(key, shadow);
             }
         }
     }
@@ -11613,6 +13049,7 @@ export class Analyzer {
             const shadow = scope.get(name);
             if (!shadow || shadow === target || (shadow.storageBinding ?? shadow) !== storage)
                 continue;
+            this.recordFlowFactOrigin(shadow);
             shadow.storageType = storage.storageType;
             shadow.type = storage.storageType;
             shadow.narrowingFrame = null;
@@ -11628,13 +13065,15 @@ export class Analyzer {
             return;
         const scope = this.scopes.at(-1);
         const local = scope.get(name);
+        this.narrowedNames.at(-1).add(name);
         if (local) {
+            this.recordFlowFactOrigin(local);
             local.type = fact;
             local.narrowingFrame = this.flowFrameDepth;
             local.assignedFact = true;
         }
         else {
-            scope.set(name, {
+            const shadow = {
                 mutable: binding.mutable,
                 type: fact,
                 declaredType: binding.declaredType,
@@ -11643,8 +13082,12 @@ export class Analyzer {
                 span: binding.span,
                 narrowingFrame: this.flowFrameDepth,
                 assignedFact: true,
+                flowScope: this.scopes.length - 1,
                 ...(binding.reactiveKind ? { reactiveKind: binding.reactiveKind } : {}),
-            });
+            };
+            this.trackNarrowingShadow(shadow);
+            this.recordScopedName(name);
+            scope.set(name, shadow);
         }
     }
     /** Rule 71 for member targets: establish after invalidation so the new fact survives its own write. */
@@ -11786,6 +13229,7 @@ export class Analyzer {
     invalidateAssignmentNarrowings(target, binding) {
         if (target.kind === "IdentifierExpression") {
             if (binding && binding.narrowingFrame !== null) {
+                this.recordFlowFactOrigin(binding);
                 binding.type = binding.storageType;
                 binding.narrowingFrame = null;
                 binding.assignedFact = false;
@@ -11935,25 +13379,66 @@ export class Analyzer {
                 : null;
         return pattern.entries.some((entry) => this.matchPatternReflectionMayExecute(entry.pattern, fields?.get(entry.property) ?? unknownType));
     }
+    /**
+     * A snapshot used to copy every binding of every live scope, which made a
+     * branch cost O(names in the module) and whole-module analysis quadratic in
+     * module size. A binding nothing ever narrows cannot differ between two
+     * moments, so only the bindings flow analysis has actually written are
+     * visited — `flowTouched`, kept per scope depth so an exiting scope drops
+     * its own, and `flowOrigins`, which remembers what each one held before its
+     * first write. `flowOrigins` answers for a binding a *later* write touched
+     * than the snapshot being restored: the snapshot has no entry, and its
+     * pre-write state is exactly the state that snapshot recorded. A narrowing
+     * shadow born after the snapshot stores `null` instead, because a full-scope
+     * snapshot had nothing to restore it to either.
+     */
+    flowFactState(binding) {
+        return {
+            type: binding.type,
+            storageType: binding.storageType,
+            frame: binding.narrowingFrame,
+            assigned: binding.assignedFact === true,
+        };
+    }
+    /** Called immediately before flow analysis writes a binding, so the recorded state is the pre-write one. */
+    recordFlowFactOrigin(binding) {
+        if (this.flowOrigins.has(binding))
+            return;
+        this.flowOrigins.set(binding, this.flowFactState(binding));
+        this.trackFlowBinding(binding);
+    }
+    /** A narrowing shadow created mid-flow: no older snapshot has a state for it. */
+    trackNarrowingShadow(shadow) {
+        this.flowOrigins.set(shadow, null);
+        this.trackFlowBinding(shadow);
+    }
+    trackFlowBinding(binding) {
+        const depth = Math.min(binding.flowScope ?? 0, this.flowTouched.length - 1);
+        this.flowTouched[depth].add(binding);
+    }
+    /** Every binding whose flow facts may differ from another moment's, outermost scope first. */
+    *touchedFlowBindings() {
+        for (const level of this.flowTouched)
+            yield* level;
+    }
+    /** The state `snapshot` recorded for `binding`, or null when it did not exist yet. */
+    flowStateIn(snapshot, binding) {
+        return snapshot.bindings.get(binding) ?? this.flowOrigins.get(binding) ?? null;
+    }
     snapshotFlowFacts() {
         const bindings = new Map();
-        for (const scope of this.scopes) {
-            for (const binding of scope.values()) {
-                bindings.set(binding, {
-                    type: binding.type,
-                    storageType: binding.storageType,
-                    frame: binding.narrowingFrame,
-                    assigned: binding.assignedFact === true,
-                });
-            }
-        }
+        for (const binding of this.touchedFlowBindings())
+            bindings.set(binding, this.flowFactState(binding));
         return {
             bindings,
             members: this.memberNarrowings.map((scope) => new Map(scope)),
         };
     }
     restoreFlowFacts(snapshot) {
-        for (const [binding, state] of snapshot.bindings) {
+        for (const binding of this.touchedFlowBindings()) {
+            const state = this.flowStateIn(snapshot, binding);
+            if (!state)
+                continue;
             binding.type = state.type;
             binding.storageType = state.storageType;
             binding.narrowingFrame = state.frame;
@@ -11978,7 +13463,13 @@ export class Analyzer {
     flowInvalidationsSince(snapshot) {
         const bindings = new Set();
         const storageTypes = new Map();
-        for (const [binding, state] of snapshot.bindings) {
+        // Only a written binding can carry a storage type this branch moved. One
+        // nothing wrote merges its own storage type with itself, which is the
+        // identity, so leaving it out of the set is what the merge already did.
+        for (const binding of this.touchedFlowBindings()) {
+            const state = this.flowStateIn(snapshot, binding);
+            if (!state)
+                continue;
             if (state.frame !== null
                 && (binding.narrowingFrame !== state.frame || !sameType(binding.type, state.type)))
                 bindings.add(binding);
@@ -11998,23 +13489,38 @@ export class Analyzer {
         });
         return { bindings, members, storageTypes };
     }
+    /**
+     * A loop's back-edge pass re-runs the whole body, and a nested loop inside
+     * that pass runs its own, so the work doubled with every level of loop
+     * nesting: fourteen levels of `while` in a 91-line file took 2.4 seconds and
+     * seventeen took 35. The passes are budgeted by how many back-edge passes
+     * are already running. Past the budget a loop analyzes its body once and its
+     * exit keeps nothing — `widened` — which is what the loop would answer if
+     * its back edge had falsified every fact, so the degradation only ever
+     * removes a fact, never invents one. Real code does not nest loops four
+     * deep, so nothing reachable by hand reaches the budget.
+     */
     reanalyzeLoopBackEdge(baseline, visible, backEdges, body, diagnosticStart, analyze) {
         if (!this.flowInvalidationsAffectFacts(backEdges))
-            return null;
+            return { repeated: null, widened: false };
+        if (this.loopReanalysisDepth >= maximumLoopReanalysisDepth)
+            return { repeated: null, widened: true };
         const loopHead = this.flowSnapshotAfterInvalidations(baseline, backEdges);
         this.loopFlowContexts.push({ baseline: loopHead, visible, carried: [], backEdges: [], breakFacts: [], sawBreak: false });
         const secondDiagnosticStart = this.diagnostics.length;
         this.clearCachedFlowTypes(body);
         let repeated = null;
+        this.loopReanalysisDepth += 1;
         try {
             this.analyzeIsolatedFlow(loopHead, analyze);
             this.deduplicateDiagnostics(diagnosticStart, secondDiagnosticStart);
         }
         finally {
+            this.loopReanalysisDepth -= 1;
             repeated = this.loopFlowContexts.pop() ?? null;
             this.restoreFlowFacts(baseline);
         }
-        return repeated;
+        return { repeated, widened: false };
     }
     flowInvalidationsAffectFacts(invalidations) {
         return invalidations.some((item) => item.bindings.size > 0
@@ -12073,37 +13579,63 @@ export class Analyzer {
         return result;
     }
     visibleBindings() {
-        const visible = new Map();
-        for (let index = this.scopes.length - 1; index >= 0; index -= 1) {
-            for (const [name, binding] of this.scopes[index]) {
-                if (!visible.has(name))
-                    visible.set(name, binding);
-            }
+        return this.scopes.length;
+    }
+    /** The binding a name resolved to when `visible` was captured. */
+    visibleBinding(visible, name) {
+        for (let index = Math.min(visible, this.scopes.length) - 1; index >= 0; index -= 1) {
+            const binding = this.scopes[index]?.get(name);
+            if (binding)
+                return binding;
         }
-        return visible;
+        return null;
     }
+    /**
+     * Only a name a narrowing has written can carry a fact, and `narrowedNames`
+     * is the roster of those per scope — so this walks the narrowings rather
+     * than every name in scope. The member half matches a dotted path against
+     * the binding its root names instead of spreading the whole root set per
+     * path, which is O(one lookup) rather than O(names in the module).
+     */
     narrowingsForVisibleBindings(visible) {
         const narrowed = new Map();
-        const roots = new Set();
-        for (const [name, original] of visible) {
-            roots.add(`${original.span.start}:${name}`);
-            const current = this.lookup(name);
-            if (current?.narrowingFrame === this.flowFrameDepth
-                && current.span.start === original.span.start
-                && current.span.end === original.span.end)
-                narrowed.set(name, current.type);
+        const seen = new Set();
+        for (let index = this.scopes.length - 1; index >= 0; index -= 1) {
+            for (const name of this.narrowedNames[index]) {
+                if (seen.has(name))
+                    continue;
+                seen.add(name);
+                const original = this.visibleBinding(visible, name);
+                if (!original)
+                    continue;
+                const current = this.lookup(name);
+                if (current?.narrowingFrame === this.flowFrameDepth
+                    && current.span.start === original.span.start
+                    && current.span.end === original.span.end)
+                    narrowed.set(name, current.type);
+            }
         }
         for (let index = this.memberNarrowings.length - 1; index >= 0; index -= 1) {
             for (const [path, fact] of this.memberNarrowings[index]) {
                 if (fact.frame !== this.flowFrameDepth || narrowed.has(`${memberNarrowingPrefix}${path}`))
                     continue;
-                if ([...roots].some((root) => path === root || path.startsWith(`${root}.`))) {
+                if (this.memberNarrowingRootIsVisible(visible, path)) {
                     narrowed.set(`${memberNarrowingPrefix}${path}`, fact.type);
                 }
             }
         }
         return narrowed;
     }
+    /** Whether a member path's root — `<declaration offset>:<name>` — names a binding visible then. */
+    memberNarrowingRootIsVisible(visible, path) {
+        const separator = path.indexOf(":");
+        if (separator < 0)
+            return false;
+        const dot = path.indexOf(".");
+        const start = Number(path.slice(0, separator));
+        const name = path.slice(separator + 1, dot < 0 ? path.length : dot);
+        return this.visibleBinding(visible, name)?.span.start === start;
+    }
     narrowingsInSnapshot(snapshot, visible, restore) {
         this.restoreFlowFacts(snapshot);
         const narrowed = this.narrowingsForVisibleBindings(visible);
@@ -12146,6 +13678,7 @@ export class Analyzer {
                 const candidates = branches.map((branch) => branch.storageTypes.get(binding) ?? binding.storageType);
                 if (includeBaseline)
                     candidates.unshift(binding.storageType);
+                this.recordFlowFactOrigin(binding);
                 binding.storageType = candidates.reduce((merged, candidate) => mergeTypes(merged, candidate));
                 if (binding.narrowingFrame === null)
                     binding.type = binding.storageType;
@@ -12153,6 +13686,7 @@ export class Analyzer {
         }
         for (const branch of branches) {
             for (const binding of branch.bindings) {
+                this.recordFlowFactOrigin(binding);
                 binding.type = binding.storageType;
                 binding.narrowingFrame = null;
                 binding.assignedFact = false;
@@ -12170,11 +13704,21 @@ export class Analyzer {
         this.scopes.push(new Map());
         this.memberNarrowings.push(new Map());
         this.pendingScopeDeclarations.push(new Map());
+        this.narrowedNames.push(new Set());
+        this.scopedNames.push([]);
+        this.flowTouched.push(new Set());
     }
     exitScope() {
         this.scopes.pop();
         this.memberNarrowings.pop();
         this.pendingScopeDeclarations.pop();
+        this.narrowedNames.pop();
+        for (const name of this.scopedNames.pop() ?? [])
+            this.nearestNames.remove(name);
+        // The bindings this scope created are unreachable now, so the flow-fact
+        // working set shrinks with it rather than growing across the module.
+        for (const binding of this.flowTouched.pop() ?? [])
+            this.flowOrigins.delete(binding);
     }
 }
 //# sourceMappingURL=analyzer.js.map