candor-ts 0.14.1 → 0.16.0

package/AGENTS.md

@@ -12,7 +12,7 @@ chains by hand.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.14)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.16)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >

package/README.md

@@ -184,7 +184,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.14" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.16" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -202,7 +202,7 @@ read the Rust source".
 
 ## Status
 
-0.14.x, speaking candor-spec 0.14: the analysis core, the gate (`--policy` / `--gate-json` /
+0.16.x, speaking candor-spec 0.16: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier), the MCP server, the LSP server, and the watch loop are
 real, behaviorally tested (`npm test` — the behavioral suite across six harnesses), **soundness-fuzzed

package/mcp.mjs

@@ -291,8 +291,12 @@ const TOOLS = {
       // ⟨spec 0.12 staged⟩ baseline callgraph → byFunction[].origin, same as the CLI (parity). The
       // loader's non-enumerable `partial` tag rides along: a corrupt baseline sidecar (edges dropped,
       // disclosed) downgrades origin to "unknown", never a fabricated "new" over a truncated graph.
+      // ⟨0.15 staged⟩ coverage disclosure — the SAME gainsCoverage the CLI verb spreads (the parity
+      // rule): optional `coverage` (current envelope's ledger) + `coverageDelta` (baseline names
+      // differ), both omitted when nothing applies — no other field of the tool result changes.
       return { baseline_version: Q.reportVersion(b) ?? "", engine_version: Q.reportVersion(p) ?? "",
-               ...Q.gains(loadReportLoud(p), loadReportLoud(b), Q.loadCallgraph(b)) };
+               ...Q.gains(loadReportLoud(p), loadReportLoud(b), Q.loadCallgraph(b)),
+               ...Q.gainsCoverage(p, b) };
     },
   },
   candor_activity: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.14.1",
-  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.14)",
+  "version": "0.16.0",
+  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.16)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",

package/query-core.mjs

@@ -124,6 +124,57 @@ function packagesLabel(pkgs) {
   return first.slice(0, n).join(".");
 }
 
+/** ⟨0.15 staged⟩ the report's §2 `coverage` envelope field (COVERAGE-DESIGN.md §1) — the κ ledger of
+ *  packages whose effects were INVISIBLE to the scan (absent, NOT a claim they're pure). Returns the
+ *  normalized uncovered list [{name, calls}] (multi-report siblings merged, counts summed, sorted the
+ *  producer's way: count desc, name asc), or null when absent/empty — the pre-0.15 report and the
+ *  fully-covered report look identical here, and null keeps the consumer's output field OMITTED
+ *  (never a fabricated `coverage: []` claim over a report that never carried the field). */
+export function reportCoverage(prefix) {
+  const files = fs.existsSync(`${prefix}.json`) ? [`${prefix}.json`] : siblings(prefix, isReport);
+  const merged = new Map();
+  for (const f of files) {
+    try {
+      const unc = JSON.parse(fs.readFileSync(f, "utf8"))?.coverage?.uncovered;
+      if (!Array.isArray(unc)) continue;   // absent/malformed field → contributes nothing (§2 forward-compat)
+      for (const e of unc) {
+        // Tolerate a foreign/hand-edited entry: a string `name` is required; a non-numeric `calls`
+        // counts as 0 (the entry still NAMES the blind spot — dropping it would under-disclose).
+        if (e && typeof e === "object" && typeof e.name === "string" && e.name) {
+          const n = typeof e.calls === "number" && Number.isFinite(e.calls) ? e.calls : 0;
+          merged.set(e.name, (merged.get(e.name) ?? 0) + n);
+        }
+      }
+    } catch { /* unreadable sibling — the reportVersion posture: keep looking */ }
+  }
+  if (merged.size === 0) return null;
+  return [...merged.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .map(([name, calls]) => ({ name, calls }));
+}
+
+/** ⟨0.15 staged⟩ gains' coverage disclosure (COVERAGE-DESIGN.md §3) — the OPTIONAL blocks the gains
+ *  JSON carries, computed from the two reports' envelopes. ONE code path for the CLI verb and the MCP
+ *  `candor_gains` tool (the parity rule). Returns a spreadable object:
+ *   · `coverage: {uncovered:[{name,calls}]}` — the CURRENT report's ledger, when non-empty (a gained
+ *     effect in an uncovered dep is invisible, so "no gains" must not read as total);
+ *   · `coverageDelta: {nowUncovered:[name], noLongerUncovered:[name]}` — whenever the two ledgers
+ *     NAME different packages (a dep becoming uncovered between scans is itself a signal). The field
+ *     names are the java reference engine's exactly (cross-engine wire parity). Keyed on names, not
+ *     counts: a call-count wobble is ordinary code change, a new blind package is the alarm.
+ *  Both omitted when nothing applies — a coverage-free comparison is byte-identical to ⟨0.14⟩. */
+export function gainsCoverage(curPrefix, basePrefix) {
+  const cur = reportCoverage(curPrefix);
+  const base = reportCoverage(basePrefix);
+  const out = {};
+  if (cur) out.coverage = { uncovered: cur };
+  const curNames = new Set((cur ?? []).map((e) => e.name));
+  const baseNames = new Set((base ?? []).map((e) => e.name));
+  const nowUncovered = [...curNames].filter((n) => !baseNames.has(n)).sort();
+  const noLongerUncovered = [...baseNames].filter((n) => !curNames.has(n)).sort();
+  if (nowUncovered.length || noLongerUncovered.length) out.coverageDelta = { nowUncovered, noLongerUncovered };
+  return out;
+}
+
 // The returned array carries a non-enumerable `hardFail` flag: true iff a report file was FOUND but
 // yielded NO trustworthy functions — a parse failure OR a malformed shape (a `null`/array/wrong-typed
 // doc, a non-array `functions`, all-junk entries). The loud CLI wrapper (loadReportOrDie) needs it to

package/query.mjs

@@ -38,7 +38,7 @@ import { impact as coreImpact, path as corePath, gains as coreGains,
          containment as coreContainment, diff as coreDiff,
          where as coreWhere, map as coreMap, whatif as coreWhatif,
          fix as coreFix, fixGate as coreFixGate, unverified as coreUnverified,
-         matches as coreMatches,
+         matches as coreMatches, gainsCoverage,
          loadReport, loadCallgraph, reportVersion, reportPackage } from "./query-core.mjs";
 const emit = (v) => console.log(JSON.stringify(v, null, 1));
 
@@ -94,7 +94,7 @@ function renderPathHuman(fns, cg, fnQ, eff) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.14";
+const SPEC_VERSION = "0.16";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]
@@ -307,7 +307,7 @@ const SUBCOMMANDS = [
 const usage = () => {
   const w = Math.max(...SUBCOMMANDS.map(([n, a]) => `${n} ${a}`.trimEnd().length));
   const lines = SUBCOMMANDS.map(([n, a, d]) => `  ${`${n} ${a}`.trimEnd().padEnd(w)}  ${d}`);
-  lines.push(`  ${"-V, --version".padEnd(w)}  print the build and spec version (offline)`);
+  lines.push(`  ${"-V, --version".padEnd(w)}  print the installed version + upgrade line (offline)`);
   lines.push(`  ${"-h, --help".padEnd(w)}  show this help`);
   return `USAGE: candor-ts-query <command> [args]\n\n${lines.join("\n")}`;
 };
@@ -321,12 +321,54 @@ if (process.argv.includes("--version") || process.argv.includes("-V")) {
 }
 
 // -h / --help: a print-and-exit MODE, handled before the switch (so `-h`'s single dash is never
-// mistaken for a command). Banner + USAGE + the full described subcommand list + the github footer.
+// mistaken for a command). House-style page: identity + model paragraph + COMMON/ALL ACTIONS
+// (the action names derived from SUBCOMMANDS, so the list can never go stale) + OPTIONS + footer.
+// The exit-2 error path keeps the denser fully-described usage() above.
 if (process.argv.includes("-h") || process.argv.includes("--help")) {
-  console.log(`candor-ts-query ${PKG_VERSION} — read-only queries over a candor report (candor-spec ${SPEC_VERSION})
+  const names = SUBCOMMANDS.map(([n]) => n);
+  const allActions = [names.slice(0, 9), names.slice(9)].map((row) => `  ${row.join("  ")}`).join("\n");
+  console.log(`candor-ts-query — read-only queries over a candor report.
 
-${usage()}
+Answers come from the report candor-ts wrote — discovered by walking up from the
+cwd to a .candor/ dir (CANDOR_REPORT overrides; --report pins a locator). No
+re-scan, no network. Every engine speaks the same grammar, so these actions and
+flags match the rest of the family.
 
+USAGE
+  candor-ts-query <action> [args] [options]
+
+COMMON ACTIONS
+  where <Effect>            the functions that perform an effect
+  path <fn> <Effect>        the call path by which a function reaches an effect
+  callers <fn>              who calls a function, direct and transitive
+  tour [N]                  the N most surprising transitive reaches (default 10)
+  blindspots                the Unknown sources worth resolving, ranked by reach
+  gains <current> <base>    what a new version newly reaches (the supply-chain diff)
+  fix <fn> <Effect>         the boundary hoist that would clear a violation
+
+ALL ACTIONS
+${allActions}
+
+OPTIONS  (uniform across every engine)
+  --report <locator>        use this report instead of discovering .candor/
+  --policy <file>           evaluate a policy — exit 1 on a violation (whatif, fix, fix-gate,
+                            unverified; CANDOR_POLICY / a .candor/config \`policy\` key when absent)
+  --json                    machine-readable output
+  --include-unknown         callers: also list the unresolved-dispatch frontier
+  --strict                  unverified: exit 1 on an unverified hole (advisory otherwise)
+  -V, --version             print the installed version + upgrade line (offline)
+  -h, --help                show this help
+
+  diff and gains take two positional report locators: <current> <baseline>. Run
+  candor-ts-query with no action for the full per-action argument list.
+
+EXAMPLES
+  candor-ts-query where Db
+  candor-ts-query path app.orders.render Net
+  candor-ts-query gains new/.candor/report.json old/.candor/report.json
+  candor-ts-query fix-gate --policy candor.policy
+
+Docs: candor.poly.io   ·   Verify an install: candor doctor
 See https://github.com/tombaldwin/candor`);
   process.exit(0);
 }
@@ -354,6 +396,9 @@ switch (cmd) {
     // written; the paths silently vanished) and dropped Exec `cmds` entirely. Call the shared show so
     // the CLI and the MCP `candor_show` are one implementation that cannot diverge again.
     const { prefix, args: [q] } = resolveReportVerb(args, 1);
+    // A missing/empty <query> is a LOUD usage error (exit 2, like candor-java) — never a silently-empty
+    // `[]` at exit 0, which reads as an authoritative "no such function" over a question never asked.
+    if (!q) { console.error("usage: candor-ts-query show <query> [--report <locator>] [--json]"); process.exit(2); }
     emit(coreShow(loadReportOrDie(prefix), q));
     break;
   }
@@ -362,6 +407,9 @@ switch (cmd) {
     // Hand-copies of core functions in this file have drifted three times (show, callers, diff); the
     // fix each time was the same: delegate, keep query.mjs as arg-parsing + emit + exit codes only.
     const { prefix, args: [eff] } = resolveReportVerb(args, 1);
+    // A missing/empty <Effect> is a LOUD usage error (exit 2, like candor-java's missing-arg path) —
+    // never an authoritative-empty {directly:[],inherited:[]} at exit 0 (a false all-clear shape).
+    if (!eff) { console.error("usage: candor-ts-query where <Effect> [--report <locator>] [--json]"); process.exit(2); }
     emit(coreWhere(loadReportOrDie(prefix), eff));
     break;
   }
@@ -370,6 +418,9 @@ switch (cmd) {
     // it, the byte-for-byte {of,direct,transitive} shape is unchanged (cross-engine parity). Call the
     // shared query-core so the CLI and MCP compute one truth (the prior inline copy had drifted before).
     const { prefix, args: [q], includeUnknown } = resolveReportVerb(args, 1, { includeUnknown: true });
+    // A missing/empty <query> is a LOUD usage error (exit 2, like candor-java) — never an empty
+    // {of:[],direct:[],transitive:[]} at exit 0 (reads as "nothing reaches it" for a fn never named).
+    if (!q) { console.error("usage: candor-ts-query callers <query> [--include-unknown] [--report <locator>] [--json]"); process.exit(2); }
     const cg = loadCallgraph(prefix);
     if (includeUnknown) emit(callersFrontier(cg, loadReportOrDie(prefix), loadHierarchy(prefix), q));
     else emit(coreCallers(cg, q));
@@ -465,6 +516,9 @@ switch (cmd) {
     // blast radius (backward dual of reachable) — reuses the shared query-core, the same logic the
     // MCP server serves. SPEC §3.1: {fn, affectedCount, affected, entryPoints:[{fn,inferred}]}.
     const { prefix, args: [q] } = resolveReportVerb(args, 1);
+    // A missing/empty <query> is a LOUD usage error (exit 2, like candor-java) — never an
+    // affectedCount:0 blast radius at exit 0 for a function that was never named.
+    if (!q) { console.error("usage: candor-ts-query impact <query> [--report <locator>] [--json]"); process.exit(2); }
     emit(coreImpact(loadReportOrDie(prefix), loadCallgraph(prefix), q));
     break;
   }
@@ -571,7 +625,14 @@ switch (cmd) {
     // a MISSING sidecar loads {} and a corrupt (matched-but-unparseable) one is tagged `partial`
     // with its edges dropped-and-disclosed: either way "new" is unavailable and origin falls back
     // to "unknown" — the JSON itself discloses, never guessing "new" over a truncated graph.
-    emit({ baseline_version: gbv ?? "", engine_version: gv ?? "", ...coreGains(loadReportOrDie(curPrefix), loadReportOrDie(basePrefix), loadCallgraph(basePrefix)) });
+    // ⟨0.15 staged⟩ coverage disclosure (COVERAGE-DESIGN.md §3): the CURRENT report's `coverage`
+    // envelope rides along (a gained effect in an uncovered dep is invisible — "no gains" must not
+    // read as total), plus `coverageDelta` when the baseline names different blind packages. Both
+    // OMITTED when nothing applies, so a coverage-free comparison is byte-identical to ⟨0.14⟩.
+    // Shared with the MCP `candor_gains` tool (gainsCoverage — the parity rule).
+    emit({ baseline_version: gbv ?? "", engine_version: gv ?? "",
+           ...coreGains(loadReportOrDie(curPrefix), loadReportOrDie(basePrefix), loadCallgraph(basePrefix)),
+           ...gainsCoverage(curPrefix, basePrefix) });
     break;
   }
   case "path": {
@@ -580,6 +641,10 @@ switch (cmd) {
     // pinned JSON shape. parseCanonical otherwise swallows --json, so detect it explicitly (as `tour` does).
     const wantJson = args.includes("--json");
     const { prefix, args: [fn, eff] } = resolveReportVerb(args, 2);
+    // BOTH positionals are required (`path <fn> <Effect>`) — a missing/empty one is a LOUD usage error
+    // (exit 2, like candor-java). Before this gate, one arg slid through as `<fn> undefined` and printed
+    // "does not perform undefined" at exit 0 — a false all-clear over a question that was never posed.
+    if (!fn || !eff) { console.error("usage: candor-ts-query path <fn> <Effect> [--report <locator>] [--json]"); process.exit(2); }
     const fns = loadReportOrDie(prefix);
     const cg = loadCallgraph(prefix);
     if (wantJson) emit(corePath(fns, cg, fn, eff));           // conformance PART 5 shape — UNCHANGED

package/scan.mjs

@@ -41,7 +41,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.14";
+const SPEC_VERSION = "0.16";
 
 // --version: a print-and-exit MODE, handled before the main arg walk so it never depends on a target.
 // Fully OFFLINE — candor never phones home. Staying current is the AGENT's job: read the installed
@@ -55,25 +55,45 @@ if (process.argv.includes("--version") || process.argv.includes("-V")) {
 // -h / --help: a print-and-exit MODE (like --version), handled before the arg walk so `-h` (a single
 // dash) is never mistaken for the scan target by the positional fallthrough below.
 if (process.argv.includes("-h") || process.argv.includes("--help")) {
-  console.log(`candor-ts ${PKG_VERSION} — TypeScript/JavaScript effect scanner (candor-spec ${SPEC_VERSION})
+  console.log(`candor-ts — the TypeScript/JavaScript effect analyzer.
 
-USAGE: candor-ts <dir | file.ts | tsconfig.json> [--out <prefix>] [--json] [--policy <file>] [--gate-json <file>] [--allow-js] [--agents] [--version]
+Reads TS/JS source through the TypeScript compiler API — no build needed. Calls
+are resolved through the checker; a call that cannot be resolved reads Unknown,
+never silently pure. The report lands in .candor/, where candor-ts-query and the
+umbrella \`candor\` CLI discover it.
 
-  <target>          a dir, a .ts file, or a tsconfig.json to scan
-  --out <prefix>    write the report to <prefix>.json + <prefix>.callgraph.json
-  --json            print the report as JSON to stdout (instead of writing files)
-  --policy <file>   enforce a policy file (deny/pure/allow/forbid, candor-spec §6.2) — exit 1 on a
-                    violation, 2 if unreadable; honours $CANDOR_POLICY when the flag is absent
-  --gate-json <f>   write the structured gate verdict { spec, ok, violations } as JSON (candor-spec §3.3)
-  --allow-js        also scan plain JS/Node (.js/.mjs/.cjs), not just TypeScript
-  --agents          print the agent contract for this build (AGENTS.md)
-  -V, --version     print the build and spec version (offline)
-  -h, --help        show this help
+USAGE
+  candor-ts <dir | file.ts | tsconfig.json> [flags]
 
-CANDOR_BASELINE=<report.json> (or a .candor/config \`baseline\` key) runs the AS-EFF-005 regression
-guard against a saved same-build report: exit 1 when an existing function gained an effect, exit 2
-on an unparseable or different-build baseline (never evaluated), a stderr note when absent.
+  The target is a project directory, a single .ts file, or a tsconfig.json.
 
+OPTIONS
+  --out <prefix>            write the report to <prefix>.json + <prefix>.callgraph.json
+  --json                    print the report as JSON to stdout (instead of writing files)
+  --policy <file>           enforce a policy file (deny/pure/allow/forbid) — exit 1 on a
+                            violation, 2 if unreadable
+  --gate-json <file>        write the structured gate verdict { spec, ok, violations } as JSON
+  --allow-js                also scan plain JS/Node (.js/.mjs/.cjs), not just TypeScript
+  --agents                  print the agent contract for this build (AGENTS.md)
+  -V, --version             print the installed version + upgrade line (offline)
+  -h, --help                show this help
+
+ENVIRONMENT / CONFIG
+  CANDOR_POLICY=<file>           the policy when --policy is absent (a .candor/config
+                                 \`policy\` key works too)
+  CANDOR_BASELINE=<report.json>  (or a .candor/config \`baseline\` key) runs the AS-EFF-005
+                                 regression guard against a saved same-build report: exit 1
+                                 when an existing function gained an effect, exit 2 on an
+                                 unparseable or different-build baseline (never evaluated),
+                                 a stderr note when absent
+
+EXAMPLES
+  candor-ts .
+  candor-ts src --allow-js
+  candor-ts . --policy candor.policy --gate-json gate.json
+  candor-ts-query where Db          query the report this scan wrote
+
+Docs: candor.poly.io   ·   Verify an install: candor doctor
 See https://github.com/tombaldwin/candor`);
   process.exit(0);
 }
@@ -477,9 +497,122 @@ function programHeadLiteral(node) {
 // options in the other overloads) — so those two members read arg0-or-arg1. Only STRING-LITERAL positions
 // are considered; returns null when the URL slot is not a static string literal — the safe direction.
 const NET_URL_ARG1_MEMBERS = new Set(["connect", "createConnection"]);
+// CONST-STRING PROPAGATION (java constant-inlining parity): resolve a bare identifier that references a
+// `const NAME = "literal"` string to its literal value, and ONLY then. Returns the string, or null. The
+// soundness rule is strict: resolve ONLY when EVERY value-declaration of the symbol is an immutable
+// `const` (or a `readonly` field) whose initializer is a plain string literal. A `let`/`var` (reassignable),
+// a declaration with no string-literal initializer (runtime value, function result, env read, config field,
+// concatenation, another template), or a symbol with MORE than the string-literal decls we can see → null,
+// so the call stays bare/runtime as before. NEVER guess a value we cannot read off a `const` initializer.
+function constStringValue(expr) {
+  if (!ts.isIdentifier(expr)) return null;
+  const sym = checker.getSymbolAtLocation(expr);
+  const decls = sym?.declarations ?? [];
+  if (decls.length === 0) return null;
+  let resolved = null;
+  for (const d of decls) {
+    // A `const x = "..."` variable declaration, or a `readonly x = "..."` class/property field. Both are
+    // VariableDeclaration/PropertyDeclaration nodes with an initializer; the immutability gate differs.
+    if (ts.isVariableDeclaration(d)) {
+      // the enclosing VariableDeclarationList must be `const` — a `let`/`var` can be reassigned later.
+      const list = d.parent;
+      const isConst = list && ts.isVariableDeclarationList(list)
+        && (list.flags & ts.NodeFlags.Const) !== 0;
+      if (!isConst || !d.initializer || !ts.isStringLiteral(d.initializer)) return null;
+      if (resolved != null && resolved !== d.initializer.text) return null; // conflicting decls — bail
+      resolved = d.initializer.text;
+    } else if (ts.isPropertyDeclaration(d)) {
+      const isReadonly = (ts.getCombinedModifierFlags(d) & ts.ModifierFlags.Readonly) !== 0;
+      if (!isReadonly || !d.initializer || !ts.isStringLiteral(d.initializer)) return null;
+      if (resolved != null && resolved !== d.initializer.text) return null;
+      resolved = d.initializer.text;
+    } else {
+      return null; // any other declaration shape (function, param, import alias, …) → do not resolve
+    }
+  }
+  return resolved;
+}
+// Resolve a URL ARGUMENT EXPRESSION to a statically-known URL/host string when its HOST is anchored by a
+// `const NAME = "literal"` string (java constant-inlining parity). Three shapes, all requiring the host to
+// live at the HEAD of the value:
+//   • a bare const identifier            fetch(API_BASE)             → API_BASE's value
+//   • a template whose HEAD is a const   fetch(`${API_BASE}/chat`)   → value + the literal template tail
+//   • a concat whose LEFT is a const     fetch(API_BASE + "/chat")   → value + the right literal
+// The template tail / concat right are appended ONLY when they are themselves plain literals, so the
+// returned string is a real static URL prefix `hostLiteral` can parse (`https://host/…`). A template with a
+// literal host-bearing PREFIX before the interpolation (`\`https://${h}\``) has a non-empty template HEAD, so
+// its head is NOT a const identifier → not resolved here (and the literal prefix alone never named a full
+// host). Anything else (non-const identifier, interpolation of a runtime value, nested template) → null.
+function resolveConstUrlString(expr) {
+  if (expr == null) return null;
+  // bare identifier: fetch(API_BASE)
+  const bare = constStringValue(expr);
+  if (bare != null) return bare;
+  // template literal `${HEAD_CONST}<tail literal>`: the const value must sit at the HEAD (empty template
+  // head text), and we may only append a SINGLE trailing literal span — a second `${…}` interpolation is a
+  // runtime value we will not resolve, but it only follows the host, so the host prefix is still sound.
+  if (ts.isTemplateExpression(expr)) {
+    if (expr.head.text !== "") return null;              // literal prefix before the const → not const-anchored
+    const first = expr.templateSpans[0];
+    const head = first && constStringValue(first.expression);
+    if (head == null) return null;                       // first interpolation is not a const string
+    // append the literal text between the first interpolation and the next (or end) — the URL path segment.
+    return head + (first.literal.text ?? "");
+  }
+  // string concat `CONST + "…"`: left must be a const string; append the right ONLY if it is a plain literal.
+  if (ts.isBinaryExpression(expr) && expr.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    const left = constStringValue(expr.left);
+    if (left == null) return null;
+    const right = ts.isStringLiteralLike(expr.right) ? expr.right.text : "";
+    return left + right;
+  }
+  return null;
+}
+// Does a literal URL-head string already contain a COMPLETE authority — i.e. is there a `/` AFTER the
+// `://` still WITHIN the literal text? `https://api.openai.com/v1/` → yes (host fully present, only the
+// PATH follows); `https://api.` / `https://` / `https://api.openai.com:` → no (the authority is not yet
+// terminated, so an interpolation could still be part of the host/port). Requires a `scheme://` prefix;
+// a bare relative path never qualifies.
+function literalHeadCompletesAuthority(head) {
+  const m = head.match(/^[a-z][a-z0-9+.-]*:\/\//i);
+  if (!m) return false;                          // no scheme://… → authority not started in the literal
+  return head.indexOf("/", m[0].length) >= 0;    // a `/` after the `://` terminates the authority
+}
+// LITERAL-HEAD HOST EXTRACTION (java literal-inlining parity): a template `\`https://host/${path}\`` or a
+// concat `"https://host/" + path` whose FIRST STATIC segment (the text before the first interpolation /
+// the concat's left literal) ALREADY contains a complete `scheme://authority/…` carries a statically-known
+// host — the interpolation is only in the PATH. Return that literal head (a real URL prefix `hostLiteral`
+// parses to the authority). If the head does NOT terminate the authority with a `/` (`https://${h}/x`,
+// `https://api.${x}.com/y`, `https://host:${port}/y`, `https://api.openai${x}/v1`) the interpolation could
+// be part of the host/port → return null (safe under-report: stays bare Net). Distinct from
+// resolveConstUrlString, which anchors on a CONST identifier at the head; here the head is a plain LITERAL.
+function literalHeadHostUrl(expr) {
+  if (expr == null) return null;
+  // template `\`<head>${…}…\``: the literal head is expr.head.text (empty when the interpolation leads).
+  if (ts.isTemplateExpression(expr)) {
+    const head = expr.head.text;
+    return literalHeadCompletesAuthority(head) ? head : null;
+  }
+  // concat `"<left literal>" + <anything>`: only the LEFT operand's literal text is the static head; the
+  // right is a runtime value living in the path. (A nested `"a" + "b" + x` left is a BinaryExpression, not
+  // a string literal, so it is not read here — a safe under-report, not a fabrication.)
+  if (ts.isBinaryExpression(expr) && expr.operatorToken.kind === ts.SyntaxKind.PlusToken
+      && ts.isStringLiteralLike(expr.left)) {
+    const head = expr.left.text;
+    return literalHeadCompletesAuthority(head) ? head : null;
+  }
+  return null;
+}
 function urlArgLiteral(node, member) {
   const args = node.arguments ?? [];
-  const litAt = (i) => (args[i] && ts.isStringLiteralLike(args[i]) ? args[i].text : null);
+  const litAt = (i) => {
+    const a = args[i];
+    if (!a) return null;
+    if (ts.isStringLiteralLike(a)) return a.text;
+    // const-anchored host (fetch(API_BASE), `${API_BASE}/x`, API_BASE+"/x"), THEN literal-head extraction
+    // (`\`https://host/${p}\``, `"https://host/" + p`) when the literal head already completes the authority.
+    return resolveConstUrlString(a) ?? literalHeadHostUrl(a);
+  };
   if (member && NET_URL_ARG1_MEMBERS.has(member)) return litAt(0) ?? litAt(1); // (port, host) or (path)
   return litAt(0);
 }
@@ -1364,6 +1497,83 @@ const HOF_INVOKERS = new Set([
   "then", "catch", "finally", "nextTick",
 ]);
 
+// ---- process.env recognition: the direct dot access (`process.env.KEY`) is the JVM System.getenv twin,
+// but the same environment READ is spelled several other ways that all read silent-pure without help:
+// bracket access (`process.env[k]`), a local const-alias (`const env = process.env; env.KEY`),
+// destructuring (`const {KEY} = process.env`), and the `in` operator (`"KEY" in process.env`). Each of
+// these on process.env (or a confirmed direct alias of it) is Env. SOUNDNESS: only process.env and a
+// DIRECT `x = process.env` / `const {env} = process` binding trigger — a bracket/alias/destructure/`in`
+// on any OTHER object stays pure (no fabrication), and a reassigned alias local is cleared.
+//
+// `process` here must be Node's process object, NOT a project-local `const process = {…}` shadow
+// (mirrors the process.hrtime/send guard). It qualifies when it is the ambient GLOBAL (no project
+// declaration) OR a default-import of the `node:process` builtin (`import process from 'node:process'`,
+// as chalk's supports-color does) — the two are the same object.
+const declImportsNodeProcess = (decl) => {
+  // ImportClause default binding or a namespace/named import from 'node:process' | 'process'.
+  let spec = null;
+  if (ts.isImportClause(decl) && decl.parent && ts.isImportDeclaration(decl.parent)) spec = decl.parent.moduleSpecifier;
+  else if (ts.isImportSpecifier(decl)) spec = decl.parent?.parent?.parent?.moduleSpecifier;
+  else if (ts.isNamespaceImport(decl)) spec = decl.parent?.parent?.moduleSpecifier;
+  const text = spec && ts.isStringLiteral(spec) ? spec.text : null;
+  return text === "node:process" || text === "process";
+};
+const identIsGlobalProcess = (id) => {
+  if (!ts.isIdentifier(id) || id.text !== "process") return false;
+  const decls = checker.getSymbolAtLocation(id)?.declarations ?? [];
+  if (decls.some(declImportsNodeProcess)) return true;                       // `import process from 'node:process'`
+  return !decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName))); // else the ambient global
+};
+// `process.env` as an expression (PropertyAccess `process.env` where `process` is the global).
+const isProcessEnvExpr = (expr) =>
+  expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "env" && identIsGlobalProcess(expr.expression);
+
+// The set of local-binding SYMBOLS that alias process.env — collected below, one pre-pass over the
+// sources. A symbol lands here iff its ONLY initializer/assignment is `= process.env` (a reassignment
+// to anything else removes it → the alias is cleared, per the spec's reassignment rule).
+const envAliasSymbols = new Set();
+{
+  const aliasCandidates = new Set();   // symbol -> declared `= process.env`
+  const disqualified = new Set();      // symbol assigned to something that is NOT process.env
+  const noteBinding = (symbol, init) => {
+    if (!symbol) return;
+    if (init && isProcessEnvExpr(init)) aliasCandidates.add(symbol);
+    else disqualified.add(symbol);     // bound/assigned to a non-process.env value → not (or no longer) an alias
+  };
+  const collectAliases = (node) => {
+    // `const env = process.env` / `let`/`var` — a name-identifier binding with an initializer.
+    if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name)) {
+      noteBinding(checker.getSymbolAtLocation(node.name), node.initializer ?? null);
+    }
+    // `const { env } = process` — destructuring `env` off the global `process` makes `env` an alias too.
+    else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name)
+             && node.initializer && ts.isIdentifier(node.initializer) && identIsGlobalProcess(node.initializer)) {
+      for (const el of node.name.elements) {
+        // the property picked off `process` must be `env` (`{env}` or `{env: local}`); the bound name is the alias.
+        const propName = el.propertyName ? (ts.isIdentifier(el.propertyName) ? el.propertyName.text : null)
+                                         : (ts.isIdentifier(el.name) ? el.name.text : null);
+        if (propName === "env" && ts.isIdentifier(el.name)) aliasCandidates.add(checker.getSymbolAtLocation(el.name));
+      }
+    }
+    // `env = <expr>` reassignment — a `let`/`var` alias reassigned to a non-process.env value is cleared.
+    else if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken
+             && ts.isIdentifier(node.left)) {
+      noteBinding(checker.getSymbolAtLocation(node.left), node.right);
+    }
+    ts.forEachChild(node, collectAliases);
+  };
+  for (const sf of sources) collectAliases(sf);
+  for (const s of aliasCandidates) if (s && !disqualified.has(s)) envAliasSymbols.add(s);
+}
+// True when `id` is an identifier resolving to a confirmed process.env alias local.
+const identIsEnvAlias = (id) => {
+  if (!id || !ts.isIdentifier(id)) return false;
+  const sym = checker.getSymbolAtLocation(id);
+  return !!sym && envAliasSymbols.has(sym);
+};
+// The receiver expression READS process.env — it is either `process.env` itself or a confirmed alias.
+const readsProcessEnv = (expr) => isProcessEnvExpr(expr) || identIsEnvAlias(expr);
+
 // ---- pass 2: per call site, the (CLASSIFY)/(EDGE)/(UNKNOWN) resolution of SEMANTICS §4 ------------
 function visitCalls(node) {
   if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
@@ -1911,10 +2121,25 @@ function visitCalls(node) {
       }
     }
   }
-  // process.env.X — a property READ, not a call (the JVM's System.getenv twin) → Env
-  if (ts.isPropertyAccessExpression(node) && node.expression.getText() === "process.env") {
-    const owner = enclosing(node);
-    if (owner) fns.get(owner).direct.add("Env");
+  // Reading process.env — the JVM System.getenv twin → Env. All the common idioms count, not just the
+  // direct `process.env.KEY` dot access (see the process.env-recognition note above): dot/bracket access
+  // on process.env or a confirmed alias, destructuring a key off it, and the `in` membership test.
+  {
+    const markEnv = () => { const owner = enclosing(node); if (owner) fns.get(owner).direct.add("Env"); };
+    // `process.env.KEY` / `env.KEY` (dot) and `process.env["KEY"]` / `env[k]` (bracket, literal OR dynamic key).
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && readsProcessEnv(node.expression)) {
+      markEnv();
+    }
+    // `const {KEY} = process.env` / `const {KEY} = env` — the object-binding pattern's initializer reads env.
+    else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name)
+             && node.initializer && readsProcessEnv(node.initializer)) {
+      markEnv();
+    }
+    // `"KEY" in process.env` / `"KEY" in env` — the `in` operator's right operand reads env.
+    else if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.InKeyword
+             && readsProcessEnv(node.right)) {
+      markEnv();
+    }
   }
   // Runtime GLOBALS reached as CALLS with no import for the κ resolver to classify: `process.hrtime()`/
   // `.hrtime.bigint()` is a monotonic clock read (Clock); `process.send(...)` is the child↔parent IPC
@@ -2297,6 +2522,19 @@ for (const [name, rec] of fns) {
 // `functions` is empty (an all-pure package's report is its purity claim, SPEC §2 rule 3).
 const envelope = { candor: { version: ENGINE_VERSION, toolchain: `node-${process.versions.node}`, spec: SPEC_VERSION },
                    package: pkgName, functions };
+// ⟨0.15 staged⟩ the κ-coverage ledger as DATA (COVERAGE-DESIGN.md §1): ONE sorted form (count desc,
+// name asc — exactly the stderr line's order) feeds the envelope field, the stderr receipt below, and
+// the --gate-json advisory, so the three can never tell different stories.
+const uncoveredLedger = [...unlistedSeen.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+// ⟨0.15 staged⟩ `coverage` envelope field — the stderr disclosure travels WITH the artifact, so a
+// report-consuming verb can no longer read a partially-covered report as total. Same names/counts as
+// the stderr line. OMITTED entirely when nothing is uncovered (the `extensions`-field precedent): a
+// fully-covered report stays byte-identical to a ⟨0.14⟩ one, so the rung is wire-compatible. The
+// per-function posture is UNCHANGED: a resolvable-but-uncovered call keeps `invisible`, an
+// unresolvable one keeps the stronger `Unknown` (COVERAGE-DESIGN.md §2 blesses both).
+if (uncoveredLedger.length) {
+  envelope.coverage = { uncovered: uncoveredLedger.map(([name, calls]) => ({ name, calls })) };
+}
 const cg = {};
 for (const [name, rec] of fns) cg[name] = [...rec.edges].sort();
 // Write ATOMICALLY (temp + rename): a concurrent reader — the MCP server or another `query` while
@@ -2350,7 +2588,7 @@ if (!wantJson) {
   }
 }
 if (unlistedSeen.size > 0) {
-  const top = [...unlistedSeen.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+  const top = uncoveredLedger; // ⟨0.15 staged⟩ the shared sorted ledger — same names/counts as envelope `coverage`
   const shown = top.slice(0, 8).map(([p, n]) => `${p} (${n} call${n === 1 ? "" : "s"})`).join(", ");
   const more = top.length > 8 ? ` + ${top.length - 8} more` : "";
   console.error(`candor-ts: candor's classifier doesn't cover ${top.length} package${top.length === 1 ? "" : "s"} this code calls into — `
@@ -2398,6 +2636,20 @@ let gateViolations = [];
 //  · Valid + same build → per-fn compare: an EXISTING fn gaining an effect is an [AS-EFF-005]
 //    violation (exit 1, joins --gate-json); a fn absent from the baseline is NEW code, reviewed as
 //    such, not a regression. Baselines omit pure fns (spec §2), so absent-prior means no prior claim.
+//
+// ⟨0.16⟩ Callgraph-aware existence (SPEC §7 item 5). Reports OMIT pure functions, so a fn that
+// shipped PURE and now performs an effect is absent from the baseline report and reads as exempt "new
+// code" — the sharpest supply-chain shape escaping the guard. Fix: key existence on the baseline
+// CALLGRAPH sidecar (<baseline>.callgraph.json, §2.2 — it lists every project fn INCLUDING pure
+// leaves), exactly as `gains`'s `origin` existence test does (query-core.mjs `gains`: a fn is
+// "existing" if it is a baseline-callgraph node — a caller key or a callee):
+//  · sidecar PRESENT + loaded → a fn that is a baseline-callgraph node has baseline effect set ∅
+//    (pure → omitted from the report) and any effect now is a GAIN violation. pure→effectful is caught.
+//    A fn in NEITHER report nor callgraph genuinely did not exist → stays exempt "new".
+//  · sidecar ABSENT → degrade to report-only existence (pre-⟨0.16⟩: a formerly-pure fn reads as new;
+//    still catches an already-effectful fn WIDENING). One stderr note that the guard is weaker.
+//  · sidecar PRESENT-but-CORRUPT → fail closed (exit 2), like a corrupt baseline: a broken sidecar
+//    must not silently NARROW the guard back to report-only.
 if (baselinePath !== null) {
   const shownB = baselinePath === "" ? "(configured empty)" : baselinePath;
   if (baselinePath !== "" && !fs.existsSync(baselinePath)) {
@@ -2429,14 +2681,66 @@ if (baselinePath !== null) {
     for (const e of arr) {
       if (e && typeof e.fn === "string" && e.fn) base.set(e.fn, new Set(Array.isArray(e.inferred) ? e.inferred : []));
     }
+    // ⟨0.16⟩ Load the baseline callgraph sidecar next to the baseline report. The sidecar for a
+    // report at <stem>.json is <stem>.callgraph.json (scan.mjs writes exactly this pair). Three states:
+    //   loaded  — a parsed object → its node set (every key + every callee) keys existence, mirroring
+    //             the `gains` origin test (query-core.mjs). A baseline-callgraph node whose baseline
+    //             effects are ∅ (pure → omitted from the report) that now performs an effect is a GAIN.
+    //   absent  — no sidecar file → degrade to report-only existence + one stderr note (guard weaker).
+    //   corrupt — file present but not parseable / not a plain object → fail closed (exit 2). A broken
+    //             sidecar must not silently narrow the guard (SPEC §7 item 5).
+    // shownB may be "(configured empty)"; the real path is baselinePath here (non-null, exists).
+    const sidecarPath = baselinePath.replace(/\.json$/i, "") + ".callgraph.json";
+    let cgNodes = null;                                     // null = sidecar absent (report-only degrade)
+    if (fs.existsSync(sidecarPath)) {
+      let baseCg = null;
+      try { baseCg = JSON.parse(fs.readFileSync(sidecarPath, "utf8")); } catch { baseCg = undefined; }
+      // A non-object parse (null / array / number) is a corrupt sidecar: it cannot list nodes, and
+      // treating it as "absent" would silently narrow the guard — fail closed like a corrupt baseline.
+      if (baseCg === undefined || baseCg === null || typeof baseCg !== "object" || Array.isArray(baseCg)) {
+        console.error(`candor-ts: the baseline callgraph ${sidecarPath} is present but could not be parsed `
+          + `(corrupt/truncated?) — failing (exit 2); a broken sidecar must not silently narrow the guard to `
+          + `report-only. Regenerate the baseline with this build.`);
+        process.exit(2);
+      }
+      // The node set = every caller key + every callee (a pure leaf appears only as a callee), exactly
+      // as `gains` computes cgNodes. Non-array edge values are tolerated (skipped), matching loadCallgraph.
+      cgNodes = new Set(Object.entries(baseCg).flatMap(([k, vs]) => [k, ...(Array.isArray(vs) ? vs : [])]));
+    } else {
+      console.error(`candor-ts: no baseline callgraph sidecar at ${sidecarPath} — the AS-EFF-005 guard is `
+        + `WEAKER: existence falls back to the report, which omits pure functions, so a formerly-PURE fn `
+        + `turning effectful reads as new code and is NOT caught (only an already-effectful fn widening is). `
+        + `Regenerate the baseline with --out so the .callgraph.json is written alongside it.`);
+    }
+    const unknownOnly = [];   // ⟨0.16⟩ advisory: fns that gained ONLY Unknown vs the baseline
     for (const name of [...inferred.keys()].sort()) {
       const prior = base.get(name);
-      if (prior === undefined) continue;                    // new function — not a regression
-      const gained = [...inferred.get(name)].filter((x) => !prior.has(x)).sort();
-      if (gained.length) {
-        gateViolations.push({ rule: "AS-EFF-005", fn: name, effects: gained,
-          detail: `\`${name}\` gained effect { ${gained.join(", ")} } not present in the baseline` });
-      }
+      // ⟨0.16⟩ Existence ladder: in the baseline REPORT → its recorded inferred set is the prior;
+      // else a baseline-callgraph NODE (sidecar present) → it existed and was pure, so prior = ∅ (any
+      // effect now is a gain); else genuinely absent → new code, exempt. Without the sidecar (cgNodes
+      // null) only the report path decides, the pre-⟨0.16⟩ semantics.
+      const priorSet = prior !== undefined ? prior
+        : (cgNodes !== null && cgNodes.has(name)) ? new Set()   // baseline-pure node → ∅ prior
+        : null;                                                 // new function — not a regression
+      if (priorSet === null) continue;
+      const gained = [...inferred.get(name)].filter((x) => !priorSet.has(x)).sort();
+      if (!gained.length) continue;
+      // ⟨0.16⟩ the ratchet fires only on gaining a REAL boundary effect. An Unknown-ONLY gain is
+      // the §4 trust marker, not an effect (`pure` policies exclude it), and on version bumps it is
+      // dominated by resolution noise — DISCLOSE it (advisory), never fail the gate on it. Mirrors the
+      // reference engine (candor-scan gate.rs check_baseline).
+      const real = gained.filter((x) => x !== "Unknown");
+      if (!real.length) { unknownOnly.push(name); continue; }
+      gateViolations.push({ rule: "AS-EFF-005", fn: name, effects: real,
+        detail: `\`${name}\` gained effect { ${real.join(", ")} } not present in the baseline` });
+    }
+    if (unknownOnly.length) {
+      unknownOnly.sort();
+      const shown = unknownOnly.slice(0, 3).join(", ");
+      const more = unknownOnly.length > 3 ? ` (+${unknownOnly.length - 3} more)` : "";
+      console.error(`candor-ts: note — ${unknownOnly.length} function(s) gained an unresolved call `
+        + `(Unknown) vs the baseline but no real effect — advisory, NOT a regression (Unknown is the §4 `
+        + `trust marker, dominated by resolution noise on version bumps): ${shown}${more}`);
     }
   }
 }
@@ -2481,7 +2785,17 @@ for (const x of gateViolations) emitViolation(`[${x.rule}] ${x.detail}`);
 // the SAME gateViolations that set the exit code (so it can't disagree). Written whenever the flag is set —
 // ok:true,[] when no gate is configured. Must precede the exit(1) below.
 if (gateJsonPath) {
-  const verdict = JSON.stringify({ spec: SPEC_VERSION, ok: gateViolations.length === 0, violations: gateViolations }, null, 1);
+  const verdictObj = { spec: SPEC_VERSION, ok: gateViolations.length === 0, violations: gateViolations };
+  // ⟨0.15 staged⟩ coverage ADVISORY (COVERAGE-DESIGN.md §3): when the κ ledger is non-empty, the
+  // verdict discloses what the gate could NOT see — VERDICT-PRESERVING (the ⟨0.9⟩ provable-purity
+  // auto-disclosure precedent exactly): ok/violations/exit are computed above and untouched here. A
+  // gate does not fail on uncovered deps (nearly every real scan has some); the policy author sees
+  // the note and decides — `deny Unknown` remains the opt-in strict posture. OMITTED when fully
+  // covered, so a pre-0.15 consumer's verdict is byte-identical.
+  if (uncoveredLedger.length) {
+    verdictObj.coverage = { uncovered: uncoveredLedger.length, packages: uncoveredLedger.map(([p]) => p) };
+  }
+  const verdict = JSON.stringify(verdictObj, null, 1);
   if (gateJsonPath === "-") console.log(verdict);
   else {
     // The verdict is a SURFACING side-output: an unwritable path must be one stderr line, never a raw
@@ -2493,6 +2807,10 @@ if (gateJsonPath) {
 // gateViolations is non-empty only when a gate surface (policy / baseline) was active and fired.
 if (gateViolations.length) {
   console.error(`candor-ts: ${gateViolations.length} policy violation(s)`);
+  // FAILURE-only pointer at the engine's own remedy verb (append-only, same stream as the summary; a
+  // zero-violation run is byte-identical — the exit code, violation lines and summary text are pinned
+  // by the conformance suite and stay untouched).
+  console.error("→ candor-ts-query fix-gate names the remedy for each");
   process.exit(1);
 }
 if (policyPath !== null) console.error("candor-ts: policy ✓");