candor-ts 0.26.0 → 0.28.0

package/scan.mjs

@@ -28,11 +28,11 @@ import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
 import { execFileSync } from "node:child_process";
 import { parsePolicy, evaluatePolicy, scopeMatches, parseUnknownAliases, parseNetPartners, discoverConfigText,
-         reasonClass, discoverConfigPath, policyVocabularyAnchor, policyErrorText, policyErrorUnevaluated, policyUnreadable, fatalPolicyErrors, refusalVerdict,
+         reasonClass, discoverConfigPath, policyVocabularyAnchor, policyErrorText, policyRefusalUnevaluated, policyUnreadable, policyZeroRules, fatalPolicyErrors, refusalVerdict,
          netClassResolver, resolveReasonClasses } from "./policy.mjs";
 import { unverifiedHoleRule, ruleUpgrade, byCodePoint, claimsToHaveJudgedNothing, reportCorruptKeys, entryCorruptKeys } from "./query-core.mjs";
 import { printAgents } from "./contract.mjs";
-import { isTestPath, kappa, kappaKnows, commandHeadEffects, hostLiteral, tablesInSql,
+import { isTestPath, kappa, kappaKnows, fsKind, commandHeadEffects, hostLiteral, tablesInSql,
          modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
@@ -44,7 +44,18 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.26";
+const SPEC_VERSION = "0.28";
+/** The `deps` / `CANDOR_DEPS` separator set — ASCII whitespace plus `:` and `,`.
+ *
+ * ONE CONSTANT BECAUSE TWO SPELLINGS WERE A SILENT GREEN. The §3.3.1 sink-over-input guard and the
+ * dep-chain loader each carried their own regex; they disagreed on `\n`, so a newline-separated
+ * `CANDOR_DEPS` was one unresolvable token to the guard and two real paths to the loader. A
+ * `--gate-json` naming one of those reports was therefore unguarded: arming overwrote it, the scan
+ * finished, and the operator's dep report ended up holding this run's `{"ok": true}` at exit 0.
+ *
+ * NOT JS `\s`, which includes U+00A0: these are PATHS, and a non-breaking space inside one is part of
+ * the path, not a separator — java, rust and swift all treat it that way. */
+const DEP_SEPARATORS = /[ \t\n\r:,]+/;
 
 // --version: a print-and-exit MODE, handled before the main arg walk so it never depends on a target.
 // Fully OFFLINE — candor never phones home. Staying current is the AGENT's job: read the installed
@@ -119,6 +130,765 @@ See https://github.com/tombaldwin/candor`);
 // value-consuming skip handles, nor produce a "lying unknown flag" error for a real flag given first.
 const usage = "usage: candor-ts <dir | file.ts | tsconfig.json> [--out <prefix>] [--json] [--policy <file>] [--gate-json <file>] [--allow-js] [--workspace] [--agents] [--version] [--help]";
 const argv = process.argv.slice(2);
+// Declared HERE, above the sink guard, because the guard calls `loadCandorConfig` and that reads
+// these: left below, they were in the temporal dead zone, the call threw, and the `catch` around it
+// swallowed the throw — so the config channel the guard exists to enumerate was silently empty and a
+// config-declared policy was destroyed at exit 0 again. A `catch` that hides a programming error is a
+// fail-open with a reason attached.
+const CONFIG_KEYS = new Set(["policy", "baseline", "strict", "no-ambient", "closed-world", "taint", "deps", "unknown-alias", "net-partner", "unknown-ratchet", "engine"]);
+const CONFIG_KEYS_IMPLEMENTED = new Set(["policy", "baseline", "deps", "unknown-ratchet", "engine"]);
+
+// ── SPEC §3.3.1 ⟨0.27⟩ ARM FIRST, AND NEVER OVER AN INPUT.
+//
+// This pre-pass learns the sink and this run's inputs with NO side effects, before the parse loop
+// below, for two reasons the loop cannot serve:
+//
+//  (1) the loop's own `unknown flag` exit(2) runs BEFORE the arming did, so `--frobnicate --gate-json G`
+//      exited leaving the PREVIOUS run's green document at G. §3.3 names an unknown flag as a
+//      broken-gate-config exit-2 cause, which MUST leave a refusal — the contract cannot depend on
+//      argv order, and it did.
+//  (2) arming WRITES, so a sink that names the policy DESTROYS it. Measured: `--policy P --gate-json P`
+//      on violating code exited 0 with `ok: true` — the armed JSON replaced P, every line of it parsed
+//      as an unknown rule, and the gate ran over zero rules. A machine-readable all-clear produced by
+//      deleting the question.
+const preScan = (av) => {
+  let gate = null, policy = null, target = null, out = null, refused = false;
+  for (let i = 0; i < av.length; i++) {
+    const a = av[i], v = av[i + 1];
+    if (a === "--gate-json" || a === "--policy" || a === "--out") {
+      // ⟨0.28⟩ A MISSING/FLAG-SHAPED VALUE IS WHERE THE PARSE LOOP EXITS 2 — and this pre-pass used to
+      // disagree about what happens NEXT. The loop refuses `--policy --out X` at `--policy` and never
+      // parses another token; this pre-pass skipped on and read `--out X` as a fresh flag, so X was
+      // ARMED on an argv the loop never accepts — SPEC §3.3.1 (1)'s precondition ("`--out` has been
+      // parsed and accepted") was false, and X's previous reports became permanent placeholders.
+      // So report-set arming honours only an `--out` consumed BEFORE the first token the loop refuses
+      // at (`--out p --zzz` still arms p: the loop accepted that pair before it died). `gate`, `policy`
+      // and `target` keep collecting past the breakage, each for its own reason: the gate sink must be
+      // armed with the refusal whatever the argv order (⟨0.27⟩ (1)) and arming it writes a refusal, not
+      // a placeholder over a report set; policy/target only feed the input GUARDS, where over-collection
+      // can only protect a file more — and the run is exiting 2 regardless.
+      if (v === undefined || (v !== "-" && v.startsWith("--"))) { refused = true; continue; }
+      // ⟨0.28⟩ THE LAST `--out` WINS, BECAUSE THAT IS WHAT THE PARSE LOOP HONOURS — every assignment here
+      // overwrites, deliberately. candor-swift's arm of this rung caught the reference engine returning
+      // the FIRST: measured on `--out p1 --out p2 --zzz-not-a-flag`, p1 was armed and p2 — the prefix the
+      // run would actually have written — stayed STALE, so the rung did nothing for that argv while
+      // neutralising a set nobody was going to replace. A pre-pass that disagrees with the loop it exists
+      // to run ahead of arms the wrong thing.
+      if (a === "--gate-json") gate = v; else if (a === "--policy") policy = v; else if (!refused) out = v;
+      i++;
+      continue;
+    }
+    // The scan TARGET, needed to discover the `.candor/config` whose `policy` key may name an input
+    // this sink must not overwrite.
+    if (!a.startsWith("-") && target === null) target = a;
+  }
+  return { gate, policy, target, out };
+};
+
+// SPEC §3.3.1 ⟨0.28⟩ — every `--gate-json` this argv names. `preScan` keeps only the last, which is what
+// the parse loop honours and exactly the behaviour this rung refuses: measured, three engines wrote the
+// verdict to the LAST path and left the first holding a previous run's `{"ok": true}` while the gate
+// fired — the ⟨0.27⟩ stale green, reached by a spelling nobody had considered.
+const allGateSinks = (av) => {
+  const out = [];
+  for (let i = 0; i < av.length; i++) {
+    if (av[i] !== "--gate-json") continue;
+    const v = av[i + 1];
+    if (v === undefined || (v !== "-" && v.startsWith("--"))) continue;
+    out.push(v); i++;
+  }
+  return out;
+};
+
+// Every path this run READS, whatever channel it arrived through (SPEC §3.3.1 ⟨0.27⟩).
+//
+// THE FIRST VERSION OF THIS GUARD KEYED ON THE FLAG. With the policy declared by `.candor/config` — the
+// checked-in form, i.e. the one a CI job actually has — `--gate-json <that policy>` destroyed it and
+// exited 0 with `"ok": true` in ALL FOUR ENGINES. A policy does not change what it is according to how
+// the operator handed it over. The config is read LENIENTLY (no exit, no diagnostic): this runs before
+// the real config load and must not pre-empt its refusal.
+// Artifact identity, not string identity: `--policy /w/P --gate-json ./P` from /w is one file, and the
+// engine that already had this guard compared path spellings and lost to exactly that. realpath resolves
+// `.`, `..` and symlinks; for a sink that does not exist yet its parent is resolved instead.
+const sameArtifact = (a, b) => {
+  if (!a || !b || a === "-" || b === "-") return false;
+  // ⟨0.28⟩ DEVICE+INODE FIRST. Path equality alone called two HARDLINKS to one inode two sinks and
+  // refused a legal command — the mirror of the stale green. And a symlink whose target does not exist
+  // YET still names that target, which `realpathSync` cannot resolve, so resolve it explicitly.
+  try {
+    const sa = fs.statSync(a), sb = fs.statSync(b);
+    if (sa.dev === sb.dev && sa.ino === sb.ino) return true;
+  } catch { /* one of them is not there yet — fall through */ }
+  try {
+    const ra = resolveSinkArtifact(a), rb = resolveSinkArtifact(b);
+    if (ra !== a || rb !== b) {
+      if (path.resolve(ra) === path.resolve(rb)) return true;
+    }
+  } catch { /* fall through to the path forms below */ }
+  const resolve = (p) => {
+    try { return fs.realpathSync(p); } catch { /* not there yet — resolve the parent */ }
+    try { return path.join(fs.realpathSync(path.dirname(path.resolve(p))), path.basename(p)); } catch { return null; }
+  };
+  const x = resolve(a);
+  return x !== null && x === resolve(b);
+};
+
+// ⟨0.28⟩ SPEC §3.3.1 — EVERY `--out` THIS ARGV NAMES, in order, duplicates kept. `preScan` keeps only the
+// LAST (what the parse loop honours); this is the same walk, and it exists because **a repeated `--out`
+// is the same rule as a repeated `--gate-json`** — the question the rung that settled the verdict sink
+// filed as "deferred" for the report sink, on no stated ground except which sink was in front of the
+// author.
+//
+// ONE WALK, not a second parser. The value rules are `preScan`'s exactly, including the `refused` latch:
+// a `--out` named after the first token the parse loop will refuse at was never accepted, so it is not a
+// sink. Two walks with two value rules is how the repeated form and the single form come to disagree
+// about which tokens are prefixes at all — and candor-swift's arm of this rung caught the reference
+// engine arming the FIRST prefix while the run wrote the LAST.
+const allOutPrefixes = (av) => {
+  const out = [];
+  let refused = false;
+  for (let i = 0; i < av.length; i++) {
+    const a = av[i], v = av[i + 1];
+    if (a !== "--gate-json" && a !== "--policy" && a !== "--out") continue;
+    if (v === undefined || (v !== "-" && v.startsWith("--"))) { refused = true; continue; }
+    if (a === "--out" && !refused) out.push(v);
+    i++;
+  }
+  return out;
+};
+// Two spellings of ONE prefix are ONE report set — the §3.3.1 artifact rule applied to the prefix. A
+// prefix is not itself a file, but `sameArtifact` resolves the PARENT of a path that does not exist, so
+// `p` and `./p` from p's own directory collapse. Order-preserving, first spelling kept; `--out` never
+// accepts `-`, so the stream arm of that helper is inert here.
+const distinctOutPrefixes = (all) => {
+  const out = [];
+  for (const p of all) if (!out.some((k) => k === p || sameArtifact(k, p))) out.push(p);
+  return out;
+};
+
+// ⟨0.28⟩ SPEC §3.3.1 — **A SINK THAT LIES UNDER THE SCAN TARGET AND BEARS AN EXTENSION THIS ENGINE
+// PARSES IS REFUSED.** This is the residual the exact-artifact ruling deliberately left: registering
+// the target in `runInputs` catches `--gate-json <the target>` and cannot catch `--gate-json
+// src/main.ts` while scanning `tsconfig.json` or `.`, because the file set the run will parse is not
+// known at the moment arming happens (arming precedes the file walk, and deferring it would uncover
+// the argv-error exits the arming rule exists for).
+//
+// MEASURED HERE BEFORE THIS FIX, and this engine had the worst artifact of the four:
+//
+//   $ node scan.mjs tsconfig.json --gate-json src/main.ts
+//     candor-ts: 1 source file(s) failed to parse — NOT analyzed …
+//     candor-ts: wrote 0 effectful functions (1 analyzed, 1 files) to .candor/report.json   exit 0
+//   $ cat src/main.ts
+//     { "spec": "0.28", "ok": false, … }          ← the operator's SOURCE, unrecoverably replaced
+//
+// Unrecoverable loss of the operator's own code, reported as SUCCESS — the run destroyed the file,
+// then dutifully disclosed the parse failure it had itself caused.
+//
+// NOT CONTAINMENT IN GENERAL, and that control is the whole difference between this and the fix the
+// ruling explicitly rejects. `<dir>/.candor/report.json` is under the target and is not a source
+// file, so the recommended layout stays permitted; a general containment rule was tried in this repo
+// for the dep-directory case and "took 33 tests with it" (see `runInputs`). Extension is the whole of
+// the predicate, and an engine knows its own source extensions before it knows its file list — which
+// is exactly what makes this checkable at the instant arming happens.
+//
+// THE JS FAMILY IS IN THE SET UNCONDITIONALLY, not gated on `--allow-js`. `--allow-js` is only one of
+// the two ways a `.js` reaches the parse set: a tsconfig carrying `allowJs` puts them in
+// `parsed.fileNames`, and the tsconfig is not read at parse time either. Erring here costs a sink
+// spelled `verdict.mjs`; erring the other way costs the operator's source.
+// "UNDER THE TARGET" IS UNDER THE TARGET'S ROOT DIR, AND THAT IS NOT THE SAME STRING. The measured
+// reproduction is `--gate-json src/main.ts` while scanning **`tsconfig.json`** — a FILE target, whose
+// parsed set is everything the config names and therefore lives under its DIRECTORY, not under the
+// token. A first version of this predicate compared against the target path itself and the defect
+// reproduced unchanged (measured, same fixture, source still destroyed at exit 0). So the containment
+// root is computed by the SAME three-way test the run below roots itself with (search `usedTsconfig`):
+// a tsconfig-shaped file roots at its directory, any other single file is exactly itself (and is
+// already covered by the exact-artifact registration in `runInputs`), a directory is itself.
+//
+// Over-approximate on the tsconfig arm, deliberately: the config's `include` may not name every `.ts`
+// under that directory, so a sink spelled `<dir>/excluded/verdict.ts` is refused though the run would
+// not have parsed it. The cost is a verdict path that has to be renamed; the cost of the other
+// direction is the operator's source.
+const PARSED_SOURCE_EXT = /\.[mc]?[tj]sx?$/i;
+const targetContainmentRoot = (target) => {
+  let t;
+  try { t = fs.realpathSync(target); } catch { return null; }   // a missing target refuses on its own terms
+  try {
+    if (fs.statSync(t).isFile()) return /tsconfig.*\.json$/i.test(path.basename(t)) ? path.dirname(t) : t;
+  } catch { return null; }
+  return t;
+};
+const sinkIsParsedSourceUnderTarget = (sink, target) => {
+  if (!sink || sink === "-" || !target) return false;
+  if (!PARSED_SOURCE_EXT.test(path.basename(sink))) return false;
+  const t = targetContainmentRoot(target);
+  if (t === null) return false;
+  // The sink may not exist yet — resolve its parent and re-append the name, the shape `sameArtifact` uses.
+  let s;
+  try { s = fs.realpathSync(sink); }
+  catch {
+    try { s = path.join(fs.realpathSync(path.dirname(path.resolve(sink))), path.basename(sink)); }
+    catch { return false; }
+  }
+  return s === t || s.startsWith(t.endsWith(path.sep) ? t : t + path.sep);
+};
+
+const runInputs = (target, policyFlag) => {
+  const out = [];
+  // ⟨0.28⟩ THE SCAN TARGET ITSELF — SPEC §3.3.1 (3) lists "the target's own source tree" among the
+  // inputs arming must not touch, and this list did not: `--gate-json app.ts` on the file being scanned
+  // armed the refusal verdict OVER the operator's source, the run then parsed the wreckage it had just
+  // made ("1 source file(s) failed to parse"), and exited 0. Silent destruction of the one file the run
+  // exists to describe, reported as success. Measured live, and the same gap was in all four engines.
+  //
+  // EXACT ARTIFACT, NEVER CONTAINMENT. Registering the target as one more `[path, label]` pair means
+  // `sameArtifact` refuses only a sink that IS the target — a report or verdict written into `.candor/`
+  // INSIDE a directory target is ordinary usage and still permitted. Making `sameArtifact`
+  // directory-aware was tried for the dep-directory case below and rejected (it refused the ordinary
+  // in-tree layout and took 33 tests with it); the same reasoning holds here.
+  if (target) out.push([target, "the scan target"]);
+  if (policyFlag) out.push([policyFlag, "--policy"]);
+  for (const [v, label] of [["CANDOR_POLICY", "CANDOR_POLICY"], ["CANDOR_BASELINE", "CANDOR_BASELINE"],
+                            ["CANDOR_CONFIG", "CANDOR_CONFIG"]]) {
+    if (process.env[v]) out.push([process.env[v], label]);
+  }
+  // ONE DEFINITION, shared with the loader — see DEP_SEPARATORS. This comment used to claim it was
+  // "the separator set the dep loader accepts" while spelling a DIFFERENT set one screen away, and the
+  // gap between the two was a silent green: a newline-separated `CANDOR_DEPS` registered here as one
+  // unresolvable token, so the guard protected nothing, while the loader split it into real paths.
+  // `--gate-json` naming one of those reports then DESTROYED it and the run exited 0 with `ok: true`
+  // written over the operator's input — §3.3.1's own words, "a machine-readable all-clear produced by
+  // deleting the question". Measured live before this change.
+  for (const d of (process.env.CANDOR_DEPS ?? "").split(DEP_SEPARATORS).filter(Boolean)) {
+    out.push([d, "a CANDOR_DEPS report"]);
+    // A DIRECTORY DEP IS EVERY REPORT INSIDE IT. `deps` accepts a directory — `--workspace` writes
+    // `.candor/deps/` and hands that back, so it is the common spelling — and the loader then walks it
+    // and reads each `*.json`. Registering only the DIRECTORY left those files unnamed, so
+    // `--gate-json <depdir>/lib.json` was unguarded: arming destroyed the operator's dep report, the
+    // run chained the wreckage and exited 0 with `ok: true` over it. Measured in all four engines.
+    //
+    // EXPANDED HERE, not by making `sameArtifact` directory-aware. That was tried and is far too
+    // broad: the scan TARGET is an input too, and a verdict written into the tree being scanned is
+    // ordinary usage — the general rule refused it and took 33 tests with it. Only a DEP directory has
+    // its CONTENTS read, so only a dep directory expands.
+    try {
+      if (fs.statSync(d).isDirectory()) {
+        for (const f of fs.readdirSync(d)) {
+          if (f.endsWith(".json") && !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json")
+              && !f.endsWith(".locs.json")) {
+            out.push([path.join(d, f), "a CANDOR_DEPS report"]);
+          }
+        }
+      }
+    } catch { /* not a directory, or unreadable — the token itself is still registered above */ }
+  }
+  // …AND THE CONFIG'S OWN KEYS, THROUGH THE ENGINE'S OWN LOADER AND ITS OWN DISCOVERY. This used to
+  // re-derive both, and a review took it apart: the home directory was computed as parent-of-parent
+  // unconditionally where the loader only steps out of a trailing `.candor/` segment, so an out-of-tree
+  // CANDOR_CONFIG had its relative values anchored one level too high and the guard protected a path
+  // the run never reads. A second parser is a second set of holes; `loadCandorConfig` is called inside a
+  // try so it can still refuse for real a moment later.
+  const cfgFile = discoverConfigFile(target ?? ".");
+  if (cfgFile) {
+    out.push([cfgFile, "the discovered .candor/config"]);
+    try {
+      const cfg = loadCandorConfig(target ?? ".", { lenient: true });
+      for (const key of ["policy", "baseline"]) {
+        if (cfg[key]) out.push([cfg[key], `the config's \`${key}\``]);
+      }
+      for (const one of (cfg.deps ?? "").split(":").filter(Boolean)) {
+        out.push([one, "the config's `deps`"]);
+      }
+    } catch { /* lenient: the real load refuses on its own terms */ }
+  }
+  return out;
+};
+
+// ⟨0.27⟩ THE STREAM SINK'S ANALOG OF ARMING — SPEC §3.1's stream-sink clause. `--gate-json -` cannot be
+// armed (a stream has no stale previous document, and a placeholder would put TWO documents in a
+// consumer's pipe), but the document-on-every-exit rule applies in full: an exit-2 cause that fires
+// before the gate tail — an unknown flag, a valueless gate-adjacent flag, a missing target — must still
+// leave the fail-closed refusal as the stream's only content. Measured: an unhonourable policy wrote the
+// refusal to stdout while an unknown flag exited 2 leaving stdout EMPTY — the same operator mistake,
+// answered or not according to which early exit fired, and an empty stream throws the consumer back to
+// scraping stderr. File sinks need nothing here: the arming above already left a refusal in place.
+// DECLARED HERE, above the pre-arg-loop `{ … }` block: those guards can themselves exit 2, and the
+// helper has to exist BEFORE its first caller — a `const` doesn't hoist, so left below where it used to
+// live (before the arg loop but after this block) it was in the temporal dead zone at every gate-input
+// refusal, and stdout stayed empty on every one of them. Measured while writing this move.
+const preGateSink = preScan(argv).gate;
+// ⟨0.28⟩ SPEC §3.3.1 (4) — THE SAME RULE ONE HOP UPSTREAM, FOR THE REPORT STREAM. `--json` is the
+// stdout REPORT sink; on any exit-2 the fail-closed ⟨0.21⟩ Row-1 report is written to stdout as the
+// stream's only content. Measured 2026-08-10 across all four engines: `--json --zzz-not-a-flag` exited
+// 2 with stdout ZERO BYTES, so a downstream JSON consumer parsing stdout throws and is thrown back to
+// scraping stderr — the same defect ⟨0.27⟩ closed on the verdict stream, arriving through the report
+// sink because that rule was written for the verdict sink and no engine extended it. Detected here
+// pre-arg-loop by `argv.includes("--json")`: this flag is stdout-only, and the value-consuming flags
+// exit 2 rather than swallow it as their value, so a `--json` token in argv IS the request.
+const preWantJson = argv.includes("--json");
+// `reportStreamWritten` latch: mirrors the rust reference's `REPORT_STREAM_WRITTEN` OnceLock. Set
+// once, at the successful `wantJson` print further down the file (search for this comment tag), so a
+// later exit-2 site does not put a SECOND JSON document on the stream — two documents on one pipe
+// parses as neither.
+let reportStreamWritten = false;
+// The ⟨0.21⟩ Row-1 manifest-carrying empty: `functions: []` + `analyzed.count: 0` + `unanalyzed`
+// naming the cause. A ⟨0.24⟩ consumer already reads this as *nothing was judged, no purity licence*
+// and a `gate --report` records the file `invisible` — no new reader logic. The version/toolchain
+// match the ordinary envelope so a consumer's provenance check reads the same.
+// ONE BUILDER FOR BOTH SINKS: the stream form below and the ⟨0.28⟩ `--out` file armer emit the SAME
+// bytes for the same reason string. Two spellings of one document is how a consumer ends up with two
+// shapes to recognise, and the file form is the one a `gate --report` parses.
+const failClosedReportDoc = (reason) => {
+  const esc = (s) => String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/[\n\r]/g, " ");
+  return `{\n "candor": {\n  "version": "candor-ts-${PKG_VERSION}",\n  "toolchain": "node-${process.versions.node}",\n  "spec": "${SPEC_VERSION}"\n },\n "functions": [],\n "analyzed": { "count": 0 },\n "unanalyzed": [\n  { "path": "<run>", "reason": "${esc(reason)}" }\n ]\n}`;
+};
+const refuseEarlyToStream = (why) => {
+  if (preGateSink === "-") console.log(JSON.stringify(refusalVerdict(SPEC_VERSION, why, null), null, 1));
+  else if (preWantJson && !reportStreamWritten) {
+    // Skipped when stdout is already claimed by `--gate-json -` (the two-stream case is refused
+    // earlier with a verdict on stdout).
+    console.log(failClosedReportDoc(`refused: ${why}`));
+    reportStreamWritten = true;
+  }
+};
+
+// ── SPEC §3.3.1 ⟨0.28⟩ — ARM THE `--out <prefix>` REPORT SET, AND HAND BACK WHAT THE RUN DID NOT OWN.
+//
+// The verdict sink arms by writing to a path the run is about to own. A report PREFIX cannot: at parse
+// time the run does not know which files it will write (this engine writes `<prefix>.json`, a workspace
+// engine fans out to one per member), so the set it DOES know is the one the PREVIOUS run left on disk —
+// and that is exactly the set at risk of being read as current after this run fails. Measured on this
+// engine: `node scan.mjs <target> --out p --zzz-not-a-flag` exited 2 with `p.json` byte-identical to the
+// previous good run, and a downstream `gate --report p.json` then reads a green report the failed run
+// never produced.
+//
+// Armed from the pre-pass, before the arg loop's own unknown-flag exit — the exit this rung is most
+// often reached through. Each report the run does write overwrites its placeholder a moment later.
+//
+// ⟨0.28⟩ AND THE §2.2 SIDECARS GO WITH THE REPORT — DELETED, NOT EMPTIED. That question is no longer
+// open: an armed report beside a LIVE sidecar is a pair that contradicts itself, and §2.2 gives the
+// sidecar no provenance of its own to arbitrate with. See `removeArmedReportSidecars` below.
+const OUT_ARM_DOC = failClosedReportDoc(
+  "armed: this report was written when the run STARTED and was never replaced, so the run failed, "
+  + "crashed or was killed before it could describe this package. It is NOT a claim about any code; "
+  + "see the run's stderr for the cause.") + "\n";
+/** `[path, bytes-before-arming]` for every report armed under the out prefix. */
+const outArmed = [];
+/** `[reportPath, sidecarPath, bytes-before-deletion]` for every §2.2 sidecar deleted while arming. */
+const outArmedSidecars = [];
+
+// ⟨0.28⟩ THIS REPORT'S §2.2 SIDECARS, DELETED WITH IT.
+//
+// `callers`/`whatif`/`rewire` are answered FROM THE SIDECAR, not from the report: a currently-pure
+// function is absent from the report by §2 rule 3, so only `<stem>.callgraph.json` records it. Leaving
+// the sidecar live beside an armed report is therefore not an untidy pair, it is the cardinal sin one
+// file over. MEASURED ON THIS ENGINE — baseline `f` pure, reached by `g`; the new version gives `f` an
+// `fs.readFileSync` and adds a second caller `h`; the run exits 2 on an unknown flag with the report
+// armed to the ⟨0.21⟩ Row-1 empty:
+//
+//   callers f  ->  exit 0, direct: ["src.app.g"], transitive: ["src.app.g", "src.app.main"]
+//
+// Confident, exit 0, and WRONG: `h` calls `f` too, and an agent reads that as safe-to-edit. After this
+// change the same query has no graph to answer from, and a recovering run answers `g` AND `h`.
+//
+// THE CONSUMER HALF IS NOW IMPLEMENTED TOO, and this paragraph used to record that it was not — which is
+// exactly how a limitation written as a comment reads as handled and stops being measured. Deleting the
+// sidecar removes the confidently WRONG answer; it does not by itself produce an honest one. The absence
+// arm here was an EMPTY caller set at exit 0 — human-fine, machine-silent, the split that makes a defect
+// a cardinal sin. `callers` (query.mjs) now emits an `unanswerable` key AND exits 2 over a pair with no
+// §2.2 sidecar; conformance PART 37 row (e) pins it. `impact` and `path` FOLLOWED — the sibling-route
+// habit caught early for once, and the line that separates them from the list below is not "graph verb"
+// but WHERE THE TARGET RESOLVES: both resolve theirs over the §2.2 call graph, so with no sidecar every
+// answer is vacuous, and each vacuum spells itself as the reassurance the verb exists to give
+// (`affectedCount: 0` = safe to change; `path: []` = it does not reach that effect). rust and java exit 2
+// on both. STILL OPEN, named so it stays measured: the report-only DESCRIPTIVE verbs
+// (`map`/`show`/`blindspots`/`where`/`reachable`/`containment`/`tour`) answer flat at exit 0 over an
+// armed report. That is a rung of its own — it wants the ⟨0.21⟩ manifest forwarded into descriptive-verb
+// JSON — not a patch to this one.
+//
+// DELETED RATHER THAN `{}`, and NOT by reading the report's own anti-deletion rule (§3.3.1) across. That
+// rule exists because a consumer treating a missing REPORT as "nothing to report" fails open. No sidecar
+// consumer has that failure mode: §2.2 makes the sidecar OPTIONAL, so every consumer was forced to define
+// an absence arm from the start and every specified arm is safe (over-listing §3.1, `origin: "unknown"`,
+// refusal on a corrupt one). And ⟨0.24⟩ has already RULED empty ≡ absent ≡ unparseable for the hierarchy.
+// `{}` is a file this family has declared meaningless.
+//
+// THE GUESS RUNS OPPOSITE TO THE ARMER'S, deliberately. The armer above identifies its own report
+// POSITIVELY by content, because there a miss leaves a stale report and an over-reach destroys a file.
+// Here a miss merely leaves a sidecar behind — the pre-rung state, and the ⟨0.28⟩ pairing rule catches it
+// consumer-side — while an over-reach deletes something that is not ours. So this one goes by the §2.2
+// reserved segment NAMES scoped to the report's own stem. Both directions chosen so the WRONG guess costs
+// least; neither is a template for the other.
+//
+// `gate` AND `encountered-*` ARE NOT TAKEN, though §2.2 reserves them in the same family-wide list. A
+// gate verdict is the VERDICT sink's document — separately armed, separately named by the operator — and
+// destroying it from the report sink is precisely the cross-sink harm §3.3.1 measures, failing OPEN in
+// the way `armGateJsonFailClosed` refuses to. `encountered-*` is a prefix family rather than a segment
+// and belongs to no report's pair. Exclusion by argument, not by a shorter list.
+const REPORT_SIDECAR_SEGMENTS = ["callgraph", "hierarchy", "locs", "calibrated", "layerreach"];
+const removeArmedReportSidecars = (report, prefix, inputs) => {
+  const stem = report.replace(/\.json$/i, "");
+  for (const seg of REPORT_SIDECAR_SEGMENTS) {
+    const side = `${stem}.${seg}.json`;
+    // lstat, not existsSync: existsSync FOLLOWS a symlink, so a DANGLING link read as "absent" and was
+    // skipped without the symlink disclosure below — but it is still the operator's link, and the
+    // symlink arm must see it. A path with nothing there at all falls out through the catch.
+    let lst;
+    try { lst = fs.lstatSync(side); } catch { continue; }
+    // THE INPUT EXEMPTION COVERS THE SIDECARS, asked of the same `runInputs`/`sameArtifact` the report
+    // and verdict sink guards use — "do not touch what this run READS" does not stop at the report half.
+    // A `--policy`, a chained `CANDOR_DEPS` report or the discovered config can perfectly well be named
+    // `<stem>.locs.json`, and deleting it silently would be worse than the pair it repairs.
+    const hit = inputs.find(([other]) => sameArtifact(side, other));
+    if (hit) {
+      console.error(`candor-ts: --out ${prefix} armed the report ${report}, but its \`${seg}\` sidecar `
+        + `${side} is what this run READS as ${hit[1]} — leaving it in place. That report and that `
+        + `sidecar are now a MISMATCHED PAIR: read the sidecar as unanswerable until a run completes.`);
+      continue;
+    }
+    // A SYMLINKED SIDECAR IS LEFT ALONE, AND SAID SO — the ruling the rust reference pinned in 8094169,
+    // raised by candor-swift's arm of this rung. This engine used to resolve the link and delete its
+    // TARGET, arguing the stale bytes live there; measured, a failing run (`--out out --zzz`) deleted
+    // `../shared/callgraph.json` — a file OUTSIDE this prefix, the canonical copy in a shared-artifact
+    // CI layout — unrecoverably, because a failed run never restores and every other link to it now
+    // dangles. And even the SUCCESS path cannot make this honest: the disarm hands bytes back with
+    // `writeSinkAtomic`, so a delete-then-restore cycle converts the operator's LINK into a regular
+    // file — a third state neither the pre-run tree nor the armed tree ever had. The link is not ours
+    // to consume. Leaving it is the cheap side of the trade: the ⟨0.28⟩ pairing rule already makes a
+    // sidecar beside an armed report unanswerable consumer-side, whereas a severed link (or a destroyed
+    // shared target) is not recoverable at all.
+    if (lst.isSymbolicLink()) {
+      console.error(`candor-ts: ${side} is a §2.2 sidecar of the armed report ${report} but is a SYMLINK `
+        + `— leaving it, because removing it would sever the operator's layout (and a restore would hand `
+        + `back a regular file where a link was). Its report is armed, so treat the pair as unanswerable `
+        + `until a run completes (SPEC §3.3.1 ⟨0.28⟩).`);
+      continue;
+    }
+    // Remember the bytes first, so a report the run turns out not to own can hand its sidecars back too.
+    let prev;
+    try { prev = fs.readFileSync(side); } catch { prev = null; }
+    try { fs.rmSync(side, { force: true }); if (prev !== null) outArmedSidecars.push([report, side, prev]); }
+    catch (e) {
+      console.error(`candor-ts: could not remove ${side} beside the armed report ${report} (${e.message}) `
+        + `— it is a STALE half-pair: any callers/whatif answer computed from it describes the last run `
+        + `that completed, not this tree.`);
+    }
+  }
+};
+
+const armOutPrefixFailClosed = (prefix, inputs) => {
+  if (!prefix) return;
+  const abs = path.resolve(prefix);
+  const dir = path.dirname(abs), stem = path.basename(abs);
+  if (!stem) return;
+  let names;
+  try { names = fs.readdirSync(dir); } catch { return; }   // no previous run under this prefix: nothing to arm
+  for (const name of names.sort()) {
+    if (!name.startsWith(`${stem}.`) || !name.endsWith(".json")) continue;
+    const full = path.join(dir, name);
+    try { if (!fs.statSync(full).isFile()) continue; } catch { continue; }
+    // THE ⟨0.27⟩ (2) INPUT EXEMPTION APPLIES TO THIS WRITER TOO, AND IT IS ASKED FIRST. Arming happens
+    // before the run knows its answer, so a prefix whose expansion collides with something this run READS
+    // would destroy it — the same hazard that made `--policy P --gate-json P` a machine-readable
+    // all-clear. A policy or a chained dep report can perfectly well be named `<prefix>.something.json`.
+    // Same resolver as every other sink guard (`sameArtifact`: device+inode, then the resolved path).
+    //
+    // ORDER MATTERS, and identification-first had it backwards (candor-swift's arm of this rung caught
+    // it). A `--policy <prefix>.policy.json` holding ordinary rule lines is not JSON, so it fails
+    // identification and gets skipped SILENTLY — the operator never learns their policy sat in the arming
+    // path, and losing a disclosure is the thing this project does not do. The exemption also has to
+    // OUTRANK identification for the case where the colliding input IS a valid report (a chained
+    // `CANDOR_DEPS` dep report under the same prefix): "do not touch what this run reads" is the stronger
+    // claim, whatever the file turns out to be.
+    const hit = inputs.find(([other]) => sameArtifact(full, other));
+    if (hit) {
+      console.error(`candor-ts: --out ${prefix} would arm over ${full}, which this run READS as ${hit[1]} `
+        + `— leaving it untouched. Give the report set its own prefix.`);
+      continue;
+    }
+    // …AND THEN ONLY FILES POSITIVELY IDENTIFIED AS THIS ENGINE'S OWN §2 REPORT — never a name denylist.
+    //
+    // The first version excluded `.callgraph`/`.hierarchy`/`.locs` by suffix and armed everything else
+    // under the prefix. SPEC §2.2 ⟨0.24⟩ (the "reserved set, family-wide" paragraph) lists SEVEN reserved
+    // trailing segments — `callgraph`, `hierarchy`, `calibrated`, `layerreach`, `locs`, `gate` and the
+    // `encountered-*` family — and records that the engines were already drifting on it, one carving out
+    // six and another two. This carved out three. Measured on the rust reference: the armer overwrote
+    // `<prefix>.calibrated.json`, `.layerreach.json`, `.encountered-hosts.json` and — worst —
+    // `<prefix>.gate.json`, a GATE VERDICT, each replaced by a report-shaped placeholder. A run whose
+    // report sink is armed was silently destroying the verdict sink's document beside it.
+    //
+    // THE MECHANISM WAS WRONG, NOT JUST THE LIST. This project's denylist-over-allowlist rule is about
+    // CLASSIFYING, where over-approximating is the safe direction. For a WRITER it inverts:
+    // over-approximating destroys a file. §2.2 can call an incomplete denylist "loud" because an
+    // unregistered suffix there merely falls back into a candidate set and gets disclosed; in an armer it
+    // is silent and destructive. So this writes only what it recognises as its own report — a JSON object
+    // carrying both a `candor` envelope and `functions` — which needs no list and cannot drift as the
+    // reserved family grows. (The placeholder itself carries both, so an already-armed file re-arms.)
+    let doc;
+    try { doc = JSON.parse(fs.readFileSync(full, "utf8")); } catch { continue; }
+    if (!doc || typeof doc !== "object" || Array.isArray(doc) || doc.candor === undefined || doc.functions === undefined) continue;
+    // Remember the bytes BEFORE overwriting, so a run that completes can hand back anything it turned
+    // out not to own (see disarmUnwrittenOutReports).
+    let prev;
+    try { prev = fs.readFileSync(full); } catch { continue; }
+    // THE SIDECARS FOLLOW ONLY IF THE REPORT ACTUALLY ARMED (raised on candor-java's arm of this rung;
+    // the rust reference deleted them unconditionally in f23a993 and was corrected by ff8cc09). A write that
+    // FAILS leaves the PREVIOUS run's report on disk; removing its sidecars there would produce a
+    // stale-report/no-callgraph pair no run has ever written — strictly worse than the pre-rung state,
+    // because the half that survives is the one a gate reads while the half that made `callers`
+    // answerable is gone. A pair degrades together or not at all.
+    let armed = false;
+    try { writeSinkAtomic(full, OUT_ARM_DOC); outArmed.push([full, prev]); armed = true; }
+    catch (e) {
+      console.error(`candor-ts: could not arm the report ${full} fail-closed (${e.message}) — leaving it `
+        + `AND its §2.2 sidecars exactly as they are; if this run does not complete, that path may still `
+        + `hold a PREVIOUS run's report`);
+    }
+    if (armed) removeArmedReportSidecars(full, prefix, inputs);
+  }
+};
+
+// HAND BACK WHAT THIS RUN TURNED OUT NOT TO OWN. Arming cannot know at parse time which files the run
+// will write, so it arms the whole previous set. Once the run has finished writing, a file STILL holding
+// the placeholder is one the run never claimed — a leftover from a package that is no longer in the scan.
+//
+// THAT IS NOT AN INCOMPLETE ANALYSIS, AND LEAVING THE PLACEHOLDER THERE ASSERTS ONE. The rust reference's
+// first version kept them and described it as closing the orphaned-report defect for free; it did not. A
+// placeholder's non-empty `unanalyzed` is the ⟨0.21⟩ incomplete-analysis trigger, so a COMPLETE scan
+// began refusing with exit 2 and went on refusing until someone deleted the leftover by hand. The run did
+// not fail to analyze that package; the package is not there. Claiming an incompleteness the run never
+// experienced is the mirror of the staleness this rung exists to close.
+//
+// So the previous bytes go back and THE ORPHAN IS LEFT EXACTLY AS FOUND — still an open defect (a report
+// for code that is gone still reaches a gate over the prefix), deliberately: it is pre-existing, it has
+// its own wire question (delete it? mark it not-in-scan? a prefix can legitimately be shared), and
+// resolving it inside a staleness fix would be deciding it by accident. Deleting the placeholder instead
+// of restoring is rejected for §3.3.1's own reason: a consumer treating a missing file as "nothing to
+// report" fails open by another route.
+const disarmUnwrittenOutReports = () => {
+  const armed = Buffer.from(OUT_ARM_DOC);
+  for (const [file, prev] of outArmed) {
+    let now;
+    try { now = fs.readFileSync(file); } catch { continue; }
+    if (!now.equals(armed)) continue;                      // this run rewrote it — a real report
+    try { writeSinkAtomic(file, prev); }
+    catch (e) {
+      console.error(`candor-ts: could not restore ${file}, which this run armed but did not write `
+        + `(${e.message}) — it still holds the fail-closed placeholder`);
+      continue;
+    }
+    // ⟨0.28⟩ …AND THIS REPORT'S SIDECARS COME BACK WITH IT. A report the run turned out not to own is an
+    // ORPHAN, left exactly as found — and "as found" included its sidecars. Handing back the report while
+    // leaving them deleted is a THIRD state neither the pre-run tree nor the armed tree ever had: it
+    // degrades every `callers`/`whatif` answer over that package to the absence arm with nothing on disk
+    // saying why. This engine really does reach here (unlike candor-java, which arms exactly the one path
+    // the operator named): the armer arms the whole PREVIOUS set under the prefix, and this run writes
+    // only `<prefix>.json`, so any other report the previous run left there is armed and handed back.
+    for (const [owner, side, sprev] of outArmedSidecars) {
+      if (owner !== file || fs.existsSync(side)) continue;  // not this report's, or the run rewrote it
+      try { writeSinkAtomic(side, sprev); }
+      catch (e) {
+        console.error(`candor-ts: could not restore ${side}, the §2.2 sidecar of ${file}, which this run `
+          + `armed but did not write (${e.message}) — that report is now missing a sidecar it had before `
+          + `this run started`);
+      }
+    }
+  }
+};
+
+{
+  const { gate, policy, target: preTarget, out: preOut } = preScan(argv);
+  // ⟨0.28⟩ The DUPLICATE case is decided below, and the single-sink guards here must not pre-empt it:
+  // they act on `gate` alone — the LAST sink — so `--gate-json - --gate-json <the policy>` exited on the
+  // policy before the STREAM could be told anything (measured: exit 2, stdout zero bytes).
+  const _named0 = allGateSinks(argv);
+  const _distinct0 = [];
+  for (const g of _named0) {
+    if (!_distinct0.some((k) => k === g || (k !== "-" && g !== "-" && sameArtifact(k, g)))) _distinct0.push(g);
+  }
+  const singleSink = _distinct0.length < 2;
+  // ⟨0.28⟩ `--json` BESIDE `--gate-json -`: a report and a verdict cannot share one stream. Decided here,
+  // in the pre-pass, so the refusal is stdout's ONLY content — refusing after the report has gone out is
+  // the defect, not the fix. On this engine `--json` is stdout-only, so the sink alone decides it.
+  if (gate === "-" && argv.includes("--json")) {
+    console.error("candor-ts: --json and --gate-json - both name STDOUT — refusing (exit 2). `--json` "
+      + "writes the REPORT there and `--gate-json -` the VERDICT, so this would put two JSON documents on "
+      + "one stream and a consumer parsing it gets neither. Send one to a file, or run the scan twice.");
+    console.log(JSON.stringify(refusalVerdict(SPEC_VERSION,
+      "--json and --gate-json - both name stdout — a report and a verdict cannot share one stream", null), null, 1));
+    process.exit(2);
+  }
+  for (const [other, flag] of (gate && singleSink ? runInputs(preTarget, policy) : [])) {
+    if (gate && sameArtifact(gate, other)) {
+      console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as ${flag} ${other} — refusing `
+        + `(exit 2). The verdict is armed before the policy is read, so this would overwrite your policy `
+        + `and then gate on the wreckage. Nothing was written; give the verdict its own path.`);
+      refuseEarlyToStream(`--gate-json ${gate} names the same file as ${flag} ${other}`);
+      process.exit(2);
+    }
+  }
+  // ⟨0.28⟩ …AND THE TARGET EXPANDS TO THE FILES THE RUN WILL PARSE (see `sinkIsParsedSourceUnderTarget`).
+  if (gate && singleSink && sinkIsParsedSourceUnderTarget(gate, preTarget)) {
+    console.error(`candor-ts: --gate-json ${gate} lies UNDER the scan target ${preTarget} and bears an `
+      + `extension this engine parses — refusing (exit 2). Nothing was written there. The verdict is `
+      + `armed at parse time, BEFORE the file walk, so this would replace a source file this run is `
+      + `about to read and then scan the wreckage. A non-source sink under the target `
+      + `(${path.join(targetContainmentRoot(preTarget) ?? ".", ".candor", "verdict.json")}, say) is the `
+      + `recommended layout and stays permitted.`);
+    refuseEarlyToStream(`--gate-json ${gate} is a source file under the scan target ${preTarget}`);
+    process.exit(2);
+  }
+  // `.candor/config` is never a verdict sink, wherever it is. The per-input checks above can only name
+  // inputs the run was TOLD about; the config is DISCOVERED by walking up from the target, so by the
+  // time its path is known the arming has already destroyed it. A check on the SHAPE needs no
+  // discovery, so it runs before the first write and covers a config found anywhere up the tree.
+  if (gate && singleSink && gate !== "-") {
+    const abs = path.resolve(gate);
+    if (path.basename(abs) === "config" && path.basename(path.dirname(abs)) === ".candor") {
+      console.error(`candor-ts: --gate-json ${gate} is a .candor/config — refusing (exit 2). The verdict `
+        + `is armed before the config is read, so this would destroy the config that configures this `
+        + `run. Nothing was written; give the verdict its own path.`);
+      refuseEarlyToStream(`--gate-json ${gate} is a .candor/config`);   // ⟨0.28⟩ report stream too
+      process.exit(2);
+    }
+  }
+  if (gate && singleSink && sameArtifact(gate, process.env.CANDOR_CONFIG)) {
+    console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as CANDOR_CONFIG — refusing (exit 2).`);
+    refuseEarlyToStream(`--gate-json ${gate} names the same file as CANDOR_CONFIG`);   // ⟨0.28⟩
+    process.exit(2);
+  }
+  // ⟨0.28⟩ A REPEATED `--gate-json` IS REFUSED, AND EVERY PATH NAMED GETS THE REFUSAL. Placed after the
+  // input-collision guards above and before arming: a sink that is an INPUT is refused having written
+  // nothing, and that exemption outranks this one — this write must not be the thing that destroys a
+  // policy. Two spellings of one path are ONE sink (the same artifact rule), so `--gate-json P
+  // --gate-json ./P` from P's own directory is not a duplicate.
+  const named = allGateSinks(argv);
+  const distinct = [];
+  for (const g of named) {
+    if (!distinct.some((k) => k === g || (k !== "-" && g !== "-" && sameArtifact(k, g)))) distinct.push(g);
+  }
+  // EVERY named sink gets the input checks, not just the one the parse honours. The first draft checked
+  // only `gate` (the last), so with `--policy P --gate-json P --gate-json B` the guard never saw P and
+  // this refusal DESTROYED the policy — measured against the other three engines, which kept it. The
+  // input exemption outranks this refusal: a sink that is an input is refused having written nothing.
+  // ⟨0.28⟩ THE INPUT EXEMPTION COVERS THE PATH, NOT THE RUN. Refusing the whole run on the first
+  // offending sink left the OTHER named sink holding whatever it held — measured: exit 2, the policy
+  // correctly intact, and an innocent sink still publishing a previous run's `{"ok": true}` to its
+  // reader. The offending path gets nothing; every other one gets the refusal.
+  const offending = new Set();
+  if (distinct.length > 1) {
+    for (const g of distinct) {
+      let bad = false;
+      for (const [other, flag] of runInputs(preTarget, policy)) {
+        if (sameArtifact(g, other)) {
+          console.error(`candor-ts: --gate-json ${g} names the SAME FILE as ${flag} ${other} — refusing `
+            + `(exit 2). Nothing was written there.`);
+          bad = true;
+        }
+      }
+      if (g !== "-") {
+        const abs = path.resolve(g);
+        if (path.basename(abs) === "config" && path.basename(path.dirname(abs)) === ".candor") {
+          console.error(`candor-ts: --gate-json ${g} is a .candor/config — refusing (exit 2). Nothing was written there.`);
+          bad = true;
+        }
+      }
+      if (sameArtifact(g, process.env.CANDOR_CONFIG)) {
+        console.error(`candor-ts: --gate-json ${g} names the SAME FILE as CANDOR_CONFIG — refusing (exit 2).`);
+        bad = true;
+      }
+      // ⟨0.28⟩ THE SAME PREDICATE ON THE DUPLICATE ROUTE. Asked here as well as above so a SECOND
+      // `--gate-json` cannot smuggle the duplicate-refusal document over source the single-sink route
+      // refuses to touch — this rung has paid six times for one rule with two spellings. The path is
+      // exempt (nothing written there); every innocent sibling sink still gets the refusal.
+      if (sinkIsParsedSourceUnderTarget(g, preTarget)) {
+        console.error(`candor-ts: --gate-json ${g} lies UNDER the scan target ${preTarget} and bears an `
+          + `extension this engine parses — refusing (exit 2). Nothing was written there.`);
+        bad = true;
+      }
+      if (bad) offending.add(g);
+    }
+    if (offending.size === distinct.length) {
+      refuseEarlyToStream(`every named --gate-json path collides with an input`);   // ⟨0.28⟩ report stream
+      process.exit(2);
+    }
+  }
+  if (distinct.length > 1) {
+    const list = distinct.join(", ");
+    console.error(`candor-ts: --gate-json given more than once (${list}) — refusing (exit 2). A gate `
+      + `publishes ONE verdict. Naming two sinks says where it goes twice, and the reader of the path `
+      + `that loses cannot tell it lost. Name one, or run the gate twice.`);
+    const doc = JSON.stringify(refusalVerdict(SPEC_VERSION,
+      `--gate-json was given more than once (${list}) — a run publishes one verdict to one sink`, null), null, 1);
+    for (const g of distinct) {
+      if (offending.has(g)) continue;                 // the exemption is scoped to this path
+      if (g === "-") console.log(doc);
+      else try { writeSinkAtomic(g, doc + "\n"); }
+      catch (e) { console.error(`candor-ts: could not write the refusal to --gate-json ${g} (${e.message})`); }
+    }
+    // ⟨0.28⟩ report stream: only fire the helper when stdout wasn't ALREADY claimed by a `--gate-json -`
+    // verdict written in the loop above — the helper would otherwise write a second document to stdout
+    // (its verdict arm keys on `preGateSink === "-"` and doesn't know one was just printed). When `-`
+    // isn't in the list, refuseEarlyToStream's report arm handles the `--json` case; when it is, the
+    // verdict is already there and `--json` was refused earlier (line 333), so nothing more is owed.
+    if (!distinct.includes("-")) refuseEarlyToStream(`--gate-json was given more than once (${list})`);
+    process.exit(2);
+  }
+  if (gate && gate !== "-") armGateJsonFailClosed(gate);
+  // ⟨0.28⟩ …AND ARM THE REPORT SET, still before the arg loop below can exit on an unknown flag.
+  //
+  // **ONLY AN EXPLICITLY NAMED `--out`, NEVER THE DEFAULT PREFIX.** The first version of this armed the
+  // default `<target>/.candor/report` too, reasoning that an operator who passes no `--out` still has
+  // yesterday's report there to go stale. That is right about staleness and wrong about OWNERSHIP, and
+  // the difference DESTROYS DATA: measured, `scan.mjs <repo> --zzz-not-a-flag` overwrote a COMMITTED
+  // `.candor/report.json` with the placeholder — and committed reports and baselines are the pattern
+  // this project recommends and ships in CI. A run that dies in argv parsing was never going to write
+  // there, and it had not been told it owned that path. (It bit for real: this engine's first version
+  // left candor-rust's committed report dirty while running a conformance probe.)
+  //
+  // ⟨0.27⟩'s arming rule never had to face this because `--gate-json` has no default — every verdict
+  // sink is NAMED. So "arm at the instant the sink is known" presumes a sink the operator named, and
+  // that presumption is explicit here: with `--out p` the operator has declared p is this run's output
+  // and arming is right even when p is checked in; with no flag there is no such declaration. The legacy
+  // positional prefix (`scan.mjs f.ts out`) is left alone for the same reason it was never armed here.
+  //
+  // `--json` publishes the report to STDOUT and writes no files at all, so there is no file sink to arm
+  // in that form — it is the stream rule above, and arming under it would rewrite files this run is
+  // never going to touch.
+  //
+  // ⟨0.28⟩ **AND A REPEATED `--out` IS THE SAME RULE — refused at exit 2, with the fail-closed report
+  // written to EVERY prefix named.** `--out A --out B` says where the reports go, twice; the two
+  // statements cannot both be honoured. MEASURED here 2026-08-12 before this: last-wins at exit 0, with
+  // `A.json` byte-identical to the previous good run — a stale green whose reader has no way to learn it
+  // lost, and a `gate --report A` over it answers from a scan that never ran.
+  //
+  // "The fail-closed report written to every prefix named" means, under THIS sink's own arming rules,
+  // ARMING each prefix: the set at risk is the one the PREVIOUS run left there, which is what
+  // `armOutPrefixFailClosed` rewrites to the ⟨0.21⟩ Row-1 no-claim shape (asking the input exemption
+  // first, per file, and taking the §2.2 sidecars with each report). The run exits before scanning, so
+  // `disarmUnwrittenOutReports` never runs and the placeholders STAND — which is the fail-closed reading
+  // a run that scanned nothing is entitled to.
+  //
+  // AFTER the gate-sink arming above, so a `--gate-json` file sink already holds its armed document and
+  // `refuseEarlyToStream` covers the `-` and `--json` streams. And skipped under `--json` for the same
+  // reason the single-prefix arm below is: that form writes no files at all, so arming would rewrite
+  // files this run was never going to touch — the refusal itself still fires.
+  const namedOuts = distinctOutPrefixes(allOutPrefixes(argv));
+  if (namedOuts.length > 1) {
+    const list = namedOuts.join(", ");
+    console.error(`candor-ts: --out given more than once (${list}) — refusing (exit 2). A run writes ONE `
+      + `report set to ONE prefix. Naming two says where the reports go twice, and the reader of the `
+      + `prefix that loses cannot tell it lost — it goes on holding a previous run's reports as if they `
+      + `were current${preWantJson ? "" : ", so every prefix named now holds the fail-closed empty in "
+      + "place of them"}. Name one, or run the scan twice.`);
+    if (!preWantJson) {
+      const inputs = runInputs(preTarget, policy);
+      for (const p of namedOuts) armOutPrefixFailClosed(p, inputs);
+    }
+    refuseEarlyToStream(`--out was given more than once (${list}) — a run writes one report set to one prefix`);
+    process.exit(2);
+  }
+  if (preOut && !preWantJson) armOutPrefixFailClosed(preOut, runInputs(preTarget, policy));
+}
 let target = null, outPrefix = null, policyPath = process.env.CANDOR_POLICY ?? null, gateJsonPath = null, allowJs = false, wantAgents = false, wantJson = false, wantWorkspace = false, wantDepInits = false;
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
@@ -132,7 +902,11 @@ for (let i = 0; i < argv.length; i++) {
   else if (a === "--dep-inits") wantDepInits = true;
   else if (a === "--out" || a === "--policy" || a === "--gate-json") {
     const v = argv[i + 1];
-    if (v === undefined || v.startsWith("--")) { console.error(`candor-ts: ${a} requires a value (${usage})`); process.exit(2); }
+    if (v === undefined || v.startsWith("--")) {
+      console.error(`candor-ts: ${a} requires a value (${usage})`);
+      refuseEarlyToStream(`${a} requires a value`);
+      process.exit(2);
+    }
     if (a === "--out") outPrefix = v; else if (a === "--policy") policyPath = v; else gateJsonPath = v;
     i++;
   }
@@ -140,13 +914,27 @@ for (let i = 0; i < argv.length; i++) {
   // (SPEC §6.2/§7). `-h`/`-V`/`--help`/`--version` are print-and-exit modes consumed above, so by here
   // a single-dash token (`-x`, the typo `-policy`) can only be a mistake; treating it as the scan
   // target would silently scan the wrong thing.
-  else if (a.startsWith("-")) { console.error(`candor-ts: unknown flag ${a} (${usage})`); process.exit(2); }
+  else if (a.startsWith("-")) {
+    console.error(`candor-ts: unknown flag ${a} (${usage})`);
+    // ⟨0.27⟩ §3.3 names an unknown flag as a broken-gate-config exit-2 cause; the stream sink gets the
+    // refusal document too (see refuseEarlyToStream — the file sink is already armed).
+    refuseEarlyToStream(`unknown flag ${a}`);
+    process.exit(2);
+  }
   else if (target === null) target = a;
   else if (outPrefix === null) outPrefix = a; // legacy positional prefix
-  else { console.error(`candor-ts: unexpected extra argument ${a} (${usage})`); process.exit(2); }
+  else {
+    console.error(`candor-ts: unexpected extra argument ${a} (${usage})`);
+    refuseEarlyToStream(`unexpected extra argument ${a}`);
+    process.exit(2);
+  }
 }
 if (wantAgents) { printAgents(); process.exit(0); }
-if (target === null) { console.error(usage); process.exit(2); }
+if (target === null) {
+  console.error(usage);
+  refuseEarlyToStream("no scan target");
+  process.exit(2);
+}
 
 // ---- .candor/config (candor-spec §config; the checked-in alternative to the CANDOR_* env vars) -----
 // Discovery is anchored to the SCAN TARGET (walk up from the target dir to the repo root's
@@ -156,14 +944,15 @@ if (target === null) { console.error(usage); process.exit(2); }
 // never vanish silently (the §6.2 unreadable-policy posture). Only genuine absence is an empty config.
 // Keys are the shared FAMILY vocabulary; a key OUTSIDE it warns (typo protection: a misspelt `policy`
 // must not silently drop the gate).
-const CONFIG_KEYS = new Set(["policy", "baseline", "strict", "no-ambient", "closed-world", "taint", "deps", "unknown-alias", "net-partner", "unknown-ratchet"]);
+// ⟨0.27⟩ `engine` (SPEC §3.4) is RECOGNIZED and IMPLEMENTED here — see enforceEnginePin. It must be in
+// BOTH sets: missing from the vocabulary it is reported as unknown, and missing from IMPLEMENTED it is
+// disclosed as inert — both tell an operator their pin was ignored while the engine is enforcing it.
 // The subset this engine actually wires to a mode — `policy` (the gate), `baseline` (AS-EFF-005),
 // `deps` (the cross-package report chain) and `unknown-ratchet` (the baseline guard's opt-in). The rest
 // of the vocabulary is spec-inert HERE: it drives other engines' gates. But a checked-in enforcement key
 // that silently does nothing is a DECLARED-GATE-SILENTLY-OFF — the reader believes the gate is on — so
 // an inert recognized key DISCLOSES loudly (stderr only; verdict/report/exit code untouched) instead of
 // staying mute. Same posture + message shape as candor-scan's CONFIG_KEYS_IMPLEMENTED.
-const CONFIG_KEYS_IMPLEMENTED = new Set(["policy", "baseline", "deps", "unknown-ratchet"]);
 // The ANCHOR a config file's RELATIVE path values (policy/deps) resolve against: the repo the config
 // belongs to — the parent of its `.candor/` directory (the standard layout; candor-init scaffolds
 // `policy arch.policy` meaning the repo root's), else the config file's own directory. NEVER the
@@ -174,28 +963,139 @@ function configAnchor(file) {
   const dir = path.dirname(path.resolve(file));
   return path.basename(dir) === ".candor" ? path.dirname(dir) : dir;
 }
-function loadCandorConfig(targetPath) {
+// ⟨0.27⟩ SPEC §3.4 `engine` — THE ENGINE↔BASELINE COUPLING, enforced instead of hoped for.
+//
+// The committed baseline is a snapshot of what ONE engine build reported, and an engine swap is
+// baseline-invalidating. What a PIN adds over the provenance checks already in place is that it is
+// DECLARATIVE — a build id is a hash nobody can write down, so the intended version lived in CI config,
+// decoupled from the baseline it is married to. It also tells tooling which engine to FETCH, and it
+// reaches a run with NO baseline configured at all.
+//
+// TWO OF THE FIVE VERDICTS MUST NOT CHANGE THE EXIT CODE: an ABSENT pin (the key is opt-in by
+// construction) and an UNDETERMINED one, where §3.1's unanswerable-condition rule applies — disclosed,
+// never scored, INCLUDING as satisfied. Exit 2 on a mismatch, never 1: unevaluable, not violating.
+//
+// A pin qualified for another implementation is not ours to check — one config serves the whole family,
+// and the family versions as a LADDER, so a bare version in a polyglot repo would fail whichever engine
+// had not yet caught up.
+const ENGINE_IMPLS = new Set(["java", "rust", "ts", "swift", "agents"]);
+function enginePinFor(text, implName) {
+  let wild = null, qual = null, bad = false;
+  for (const rawLine of (text ?? "").split("\n")) {
+    const line = rawLine.split("#")[0].trim();
+    if (!line) continue;
+    const parts = line.split(/\s+/);
+    if (parts[0].toLowerCase() !== "engine") continue;
+    const rest = parts.slice(1);
+    // Two lines that DISAGREE about the same key are kept BOTH, so they cannot parse as a version and
+    // surface as malformed. One silently discarding the other is the failure this key exists to stop.
+    const slot = (cur, v) => (cur !== null && cur !== v ? `${cur} / ${v}` : v);
+    // A KNOWN QUALIFIER DECIDES OWNERSHIP BEFORE ARITY. Checking the one-token case first made `engine swift` a WILDCARD pin whose version is the literal "swift" -> MALFORMED -> exit 2 in every engine, so one operator forgetting a version on a qualified line killed the whole family. SPEC 3.4 says the skip is whole-line 'whatever follows it' -- and nothing following it is a case of that too.
+    if (rest.length && ENGINE_IMPLS.has(rest[0].toLowerCase())) {
+      if (rest[0].toLowerCase() === implName) { if (rest.length === 2) qual = slot(qual, rest[1]); else bad = true; }
+      continue;                                    // another impl's line, whatever follows it
+    }
+    if (rest.length === 0) bad = true;
+    else if (rest.length === 1) wild = slot(wild, rest[0]);
+    else bad = true;
+  }
+  if (bad) return "<unreadable>";
+  // AN UNREADABLE UNQUALIFIED LINE IS NOT HIDDEN BY A QUALIFIED PIN. `qual ?? wild` returned the qualifi
+  // ed value, so `engine garbage` beside a good qualified line passed SILENTLY here while candor-java exited 
+  // 2 — the exact mirror of the bug just fixed in java, four engines the other way. Unreadability is a property of the LINE; precedence only decides which VERSION applies.
+  if (wild !== null && normalizePinVersion(wild) === null) return wild;
+  return qual ?? wild;
+}
+function normalizePinVersion(raw) {
+  const s = String(raw ?? "").trim().replace(/^[vV]/, "");
+  if (!/^\d+\.\d+(\.\d+)?$/.test(s)) return null;
+  return s.split(".").length === 2 ? `${s}.0` : s;
+}
+function enforceEnginePin(targetPath) {
+  const pin = enginePinFor(discoverConfigText(targetPath), "ts");
+  if (pin === null || pin === undefined) return;                       // ABSENT
+  const want = normalizePinVersion(pin);
+  if (want === null) {
+    console.error(`candor-ts: .candor/config has an \`engine\` line that is not an engine version.`);
+    console.error(`        want \`engine <version>\` (e.g. \`engine v${PKG_VERSION}\`) or \`engine <impl> <version>\``);
+    console.error(`        (e.g. \`engine ts v${PKG_VERSION}\`) for a repo scanned by more than one engine.`);
+    console.error(`        Failing (exit 2) rather than ignoring it: a pin that cannot be read is a`);
+    console.error(`        guard the operator believes is on.`);
+    process.exit(2);
+  }
+  const running = normalizePinVersion(PKG_VERSION) ?? String(PKG_VERSION ?? "").trim();
+  if (!running || running === "unknown") {                             // UNDETERMINED — disclose, never score
+    console.error(`candor-ts: .candor/config pins engine ${pin}, and this build does not know its own release,`);
+    console.error(`        so the pin CANNOT be checked. Disclosed, not scored — neither passed nor failed.`);
+    return;
+  }
+  if (want === running) return;                                        // MATCH
+  console.error(`candor-ts: .candor/config pins engine ${pin} but this build is candor-ts ${PKG_VERSION}.`);
+  console.error(`        The pin and the committed baseline move together — a newer engine resolves more`);
+  console.error(`        dispatch, so its report is not comparable with a baseline the pinned engine wrote.`);
+  console.error(`        Either run the pinned engine, or update the pin and regenerate the baseline in the`);
+  console.error(`        same change. Exit 2 (unevaluable), not 1 — this is not a policy violation.`);
+  // ONE call, not two: an insertion script matched both pin branches to this single exit, and the
+  // duplicate put TWO documents on the stream — which parses as neither. The other branch (a build that
+  // cannot determine its own release) RETURNS rather than exiting: disclosed, not scored, so no refusal
+  // belongs there.
+  refuseEarlyToStream(`.candor/config pins engine ${pin}, which this build does not satisfy`);
+  process.exit(2);
+}
+
+// WHICH config file this run reads, with NO side effects (SPEC §3.4). Extracted so the §3.3.1 sink
+// guard asks the same question the loader answers instead of re-deriving the walk — a review took the
+// guard's own copy apart on exactly that divergence.
+function discoverConfigFile(targetPath) {
+  const env = process.env.CANDOR_CONFIG;
+  if (env) {
+    try { return fs.statSync(env).isFile() ? env : null; } catch { return null; }
+  }
+  let dir = path.resolve(targetPath ?? ".");
+  try { if (!fs.statSync(dir).isDirectory()) dir = path.dirname(dir); } catch { dir = path.dirname(dir); }
+  for (let d = dir; ; d = path.dirname(d)) {
+    const cand = path.join(d, ".candor", "config");
+    if (fs.existsSync(cand)) return cand;
+    if (path.dirname(d) === d) break;                         // filesystem root
+  }
+  return fs.existsSync(".candor/config") ? ".candor/config" : null;
+}
+
+/// `lenient: true` THROWS where this would otherwise `process.exit(2)`.
+///
+/// The collision pre-pass needs the config's DECLARED input paths before the sink is armed, and it
+/// wrapped this call in a try under the comment "the real load refuses on its own terms" — which
+/// assumes the failure arrives as an exception. It does not: `process.exit` is not catchable, so an
+/// unreadable config killed the run INSIDE that try, before arming, leaving a pre-seeded green verdict
+/// intact at the file sink. SPEC §3.3's own words for that: "a refusal that writes nothing leaves the
+/// previous run's green document on disk." java answers the same input with `refused: true`.
+///
+/// Nothing is lost by leniency here. If the config cannot be read it declares no inputs anyone can
+/// name, so the collision check over them is vacuous; arming then proceeds and the REAL load refuses a
+/// moment later — now with the sink armed, so the refusal reaches it. A second parser was the
+/// alternative, and a second parser is a second set of holes.
+function loadCandorConfig(targetPath, { lenient = false } = {}) {
   let file = process.env.CANDOR_CONFIG ?? null;
   if (file !== null) {
     if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
+      if (lenient) throw new Error(`CANDOR_CONFIG set but ${file} is not a readable file`);
       console.error(`candor-ts: CANDOR_CONFIG set but ${file} is not a readable file — failing (exit 2)`);
+      // The config is the EARLIEST exit-2 cause, and the one the stream sink is least likely to be
+      // armed for — which is exactly why it was the last one still leaving stdout empty. Found by
+      // PART 36 (b11), a row written before this line was.
+      refuseEarlyToStream(`CANDOR_CONFIG set but ${file} is not a readable file`);
       process.exit(2);
     }
   } else {
-    let dir = path.resolve(targetPath);
-    try { if (!fs.statSync(dir).isDirectory()) dir = path.dirname(dir); } catch { dir = path.dirname(dir); }
-    for (let d = dir; ; d = path.dirname(d)) {
-      const cand = path.join(d, ".candor", "config");
-      if (fs.existsSync(cand)) { file = cand; break; }
-      if (path.dirname(d) === d) break;                       // filesystem root
-    }
-    if (file === null && fs.existsSync(".candor/config")) file = ".candor/config";
+    file = discoverConfigFile(targetPath);
     if (file === null) return {};
   }
   let text;
   try { text = fs.readFileSync(file, "utf8"); }
   catch (e) {
+    if (lenient) throw new Error(`config ${file} exists but could not be read (${e.message})`);
     console.error(`candor-ts: config ${file} exists but could not be read (${e.message}) — failing (exit 2)`);
+    refuseEarlyToStream(`config ${file} exists but could not be read`);
     process.exit(2);
   }
   const cfg = {};
@@ -230,10 +1130,78 @@ function loadCandorConfig(targetPath) {
   const anchor = configAnchor(file);
   if (cfg.policy) cfg.policy = path.resolve(anchor, cfg.policy);
   if (cfg.baseline) cfg.baseline = path.resolve(anchor, cfg.baseline);
-  if (cfg.deps) cfg.deps = cfg.deps.split(/[\s:,]+/).filter(Boolean).map((t) => path.resolve(anchor, t)).join(":");
+  // ASCII whitespace ONLY, like java and swift: these are PATHS, and JS `\s` includes U+00A0, so a dep
+  // path containing a non-breaking space split into two halves that were then both "skipped" — a green
+  // run with the dep silently unchained, where java and rust loaded it.
+  if (cfg.deps) cfg.deps = cfg.deps.split(/[ \t:,]+/).filter(Boolean).map((t) => path.resolve(anchor, t)).join(":");
   return cfg;
 }
+// ⟨0.24⟩/⟨0.27⟩ ARM THE VERDICT FAIL-CLOSED. Every exit path then leaves a refusal behind unless the run
+// got far enough to replace it with a real verdict. A review found the pin refusal leaving the PREVIOUS
+// run's document on disk — a CI wrapper reading the artifact instead of the exit code then reports a pass
+// over a run that refused. candor-java's `armGateJson` is the model; the wording is about the RUN, not
+// about the code.
+//
+// A `function` declaration, not a `const`: it is CALLED from the pre-pass above the arg loop, and only a
+// hoisted declaration can be. The write is inlined rather than calling `writeAtomic` for the same reason
+// in reverse — that helper is a `const` declared ~4700 lines below, so calling it would be a
+// temporal-dead-zone throw.
+// ⟨0.28⟩ RESOLVE THE SINK TO ITS FINAL ARTIFACT BEFORE WRITING, and preserve the operator's layout.
+// `renameSync` REPLACES a symlink rather than following it, so an `artifacts/verdict.json` linked into a
+// shared directory kept a previous run's `{"ok": true}` while this run's document landed on the link — a
+// stale green with a single `--gate-json` and no operator mistake. And rename gives the destination a NEW
+// inode, so a multiply-linked target strands its other name with the previous document; there the write
+// goes in place, trading the atomicity window for not publishing a stale verdict at a name the operator
+// wired up. SPEC §3.3.1 states identity about ARTIFACTS; this family had it in the comparison only.
+function resolveSinkArtifact(p) {
+  let cur = p;
+  for (let i = 0; i < 32; i++) {
+    let st;
+    try { st = fs.lstatSync(cur); } catch { return cur; }
+    if (!st.isSymbolicLink()) return cur;
+    let t;
+    try { t = fs.readlinkSync(cur); } catch { return cur; }
+    cur = path.isAbsolute(t) ? t : path.join(path.dirname(cur), t);
+  }
+  return cur;
+}
+
+function writeSinkAtomic(p, text) {
+  const target = resolveSinkArtifact(p);
+  try {
+    if (fs.statSync(target).nlink > 1) { fs.writeFileSync(target, text); return; }
+  } catch { /* not there yet — the ordinary temp+rename path is right */ }
+  const tmp = `${target}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, text);
+  fs.renameSync(tmp, target);
+}
+
+function armGateJsonFailClosed(p) {
+  try {
+    writeSinkAtomic(p, JSON.stringify({
+      spec: SPEC_VERSION, ok: false, refused: true,
+      reason: "the gate did not complete — this document was written when the run STARTED and was never "
+        + "replaced by a verdict, so the run failed, crashed or was killed before it could decide. It is "
+        + "NOT a verdict about the code; see the run's stderr for the cause.",
+    }, null, 1) + "\n");
+  } catch (e) {
+    console.error(`candor-ts: could not arm --gate-json ${p} fail-closed (${e.message}) — if this run `
+      + `does not complete, that path may still hold a PREVIOUS run's verdict`);
+  }
+}
+// MOVED ABOVE THE CONFIG LOAD. `loadCandorConfig` is ITSELF an exit-2 cause (an unusable
+// CANDOR_CONFIG, or a committed `.candor/config` that cannot be read), and arming after it left a
+// config refusal exiting 2 with the PREVIOUS run's green still on disk — while the comment below
+// said "BEFORE ANYTHING THAT CAN EXIT". The rule only holds if the arming really is first.
+// ⟨0.24⟩ ARM THE VERDICT FAIL-CLOSED BEFORE ANYTHING THAT CAN EXIT. A review found the pin refusal
+// leaving the PREVIOUS run's `--gate-json` document on disk — a CI wrapper reading the artifact instead
+// of the exit code then reports a pass over a run that refused. Arming at the START makes this a CLASS
+// fix: every exit path leaves a refusal unless the run got far enough to replace it. candor-java's
+// `armGateJson` is the model, and the wording is about the RUN, not about the code.
+// (armed by the pre-pass above, before the arg loop — see SPEC §3.3.1 ⟨0.27⟩. Arming HERE was still
+// after the loop's unknown-flag exit, so the contract depended on argv order.)
 const candorConfig = loadCandorConfig(target);
+enforceEnginePin(target);   // ⟨0.27⟩ §3.4 — AFTER the arming, so its exit 2 cannot leave a stale verdict
 // precedence: the --policy flag / CANDOR_POLICY env already populated policyPath; the config is the floor.
 // A BARE `policy` line ("" value) means configured-with-empty → the unreadable-policy path fails loud.
 if (policyPath === null && candorConfig.policy !== undefined) policyPath = candorConfig.policy;
@@ -241,7 +1209,12 @@ if (policyPath === null && candorConfig.policy !== undefined) policyPath = cando
 // (path-valued keys are already resolved against the config's anchor above). No CLI flag — matching
 // candor-java, the reference engine (env/config only). A BARE `baseline` line ("") fails loud below.
 let baselinePath = process.env.CANDOR_BASELINE ?? null;
-if (baselinePath === null && candorConfig.baseline !== undefined) baselinePath = candorConfig.baseline;
+// WHICH SOURCE supplied it decides what a MISSING file means: `CANDOR_BASELINE` is set unconditionally
+// by the adopt workflow, so an absent path there is "the ratchet is not adopted yet"; a checked-in
+// `baseline` line DECLARES this repo has one, so an absent path there was deleted or never committed —
+// and the guard passing green over it is a gate that silently stopped gating.
+let baselineFromConfig = false;
+if (baselinePath === null && candorConfig.baseline !== undefined) { baselinePath = candorConfig.baseline; baselineFromConfig = true; }
 // ⟨unknown-ratchet⟩ OPT-IN (config `unknown-ratchet` / CANDOR_UNKNOWN_RATCHET, default OFF): flip an
 // Unknown-ONLY gain vs the baseline from advisory to an AS-EFF-005 failure (exit 1). Env-override truthy
 // semantics mirror candor-java's Config.flag exactly — env var PRESENCE means on (env can't express off);
@@ -290,9 +1263,20 @@ function fromTsconfig(cfgPath, baseDir) {
   return names.filter((f) => !isTestPath(path.relative(baseDir, f)));
 }
 const stat = fs.existsSync(target) ? fs.statSync(target) : null;
-if (!stat) { console.error(`candor-ts: no such path: ${target}`); process.exit(2); }
+if (!stat) {
+  console.error(`candor-ts: no such path: ${target}`);
+  // The SAME two lines as every other early exit in this file. `refuseEarlyToStream` WRITES AND
+  // RETURNS — it is not a `Never`, and calling it INSTEAD of the exit lets the run continue past its
+  // own refusal (measured, while getting this wrong: an unreadable dep wrote its refusal and then
+  // exited 0). rust's equivalent is typed `-> !`, which is why the same slip could not happen there.
+  refuseEarlyToStream(`no such path: ${target}`);
+  process.exit(2);
+}
+let usedTsconfig = null;   // the tsconfig this run actually read, so a later disclosure can name the
+                           // cause that APPLIES rather than the one that usually does.
 if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.dirname(path.resolve(target));
+  usedTsconfig = path.resolve(target);
   fileNames = fromTsconfig(path.resolve(target), rootDir);
 } else if (stat.isFile()) {
   rootDir = path.dirname(path.resolve(target));
@@ -301,6 +1285,7 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.resolve(target);
   const tsconfig = path.join(rootDir, "tsconfig.json");
   if (fs.existsSync(tsconfig) && !allowJs) {
+    usedTsconfig = tsconfig;
     fileNames = fromTsconfig(tsconfig, rootDir);
   } else {
     fileNames = [];
@@ -315,7 +1300,13 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
     })(rootDir);
   }
 }
-if (fileNames.length === 0) { console.error(`candor-ts: no TypeScript sources under ${target}`); process.exit(2); }
+if (fileNames.length === 0) {
+  console.error(`candor-ts: no TypeScript sources under ${target}`);
+  // An empty scan is an exit-2 cause like any other: a consumer reading the stream after it must not
+  // get nothing. §3.1 exempts no cause, and this one is easy to hit in CI (a path that moved).
+  refuseEarlyToStream(`no TypeScript sources under ${target}`);
+  process.exit(2);
+}
 // Builtin typings FALLBACK: the engine ships @types/node as its own dependency, so a target that
 // hasn't installed it still resolves node:fs/node:net/… (found by the first npx-distribution
 // probe: a bare fixture read Unknown for fs.readFileSync because nothing supplied the builtin
@@ -331,6 +1322,29 @@ if (!compilerOptions.typeRoots) {
   compilerOptions.typeRoots = roots;
 }
 if (!outPrefix) outPrefix = path.join(rootDir, ".candor", "report");
+// ⟨0.28⟩ THE REPORT SET REACHES ITS SINK BY A SECOND ROUTE, AND THE INPUT RULE MUST COVER BOTH. The armer
+// asks the input exemption of every file it arms, so `--out tsconfig` over a `tsconfig.json` TARGET was
+// correctly left unarmed — and then the FINAL `writeAtomic(`${outPrefix}.json`)` destroyed it anyway, at
+// exit 0, on a run that had already scanned it: "wrote 0 effectful functions … to tsconfig.json" over the
+// operator's own tsconfig. Measured while verifying the target registration covered both sinks; it covered
+// the arm and not the write. Asked HERE, where every route to the report set converges (`--out`, the
+// legacy positional prefix, and the default), of the same `runInputs`/`sameArtifact` every other sink
+// guard uses, over the exact file set this engine writes. Refused, not skipped: silently withholding one
+// file of a four-file report set would be a pair no run has ever written.
+if (!wantJson) {
+  for (const suffix of ["", ".callgraph", ".locs", ".hierarchy"]) {
+    const w = `${outPrefix}${suffix}.json`;
+    for (const [other, label] of runInputs(target, policyPath)) {
+      if (sameArtifact(w, other)) {
+        console.error(`candor-ts: the report set at --out ${outPrefix} includes ${w}, which is the SAME `
+          + `FILE as ${label} ${other} — refusing (exit 2). Writing the report there would destroy an `
+          + `input of this run. Nothing was scanned; give the report set its own prefix.`);
+        refuseEarlyToStream(`the report set at ${outPrefix} would overwrite ${label} ${other}`);
+        process.exit(2);
+      }
+    }
+  }
+}
 // --json prints the report to stdout and writes NOTHING, so skip creating the (otherwise default) .candor/ dir.
 // The scanned package's name — the first half of the cross-package join key (SPEC §2 `hash`).
 let pkgName = path.basename(rootDir);
@@ -798,16 +1812,69 @@ const corruptDepPkgs = new Set();
   // --workspace's auto-scanned deps dir is prepended to the explicit CANDOR_DEPS/config spec (both chain).
   const spec = [workspaceDepsDir, depInitsDir, process.env.CANDOR_DEPS ?? candorConfig.deps ?? ""].filter(Boolean).join(":");
   const files = [];
-  for (const tok of spec.split(/[\s:,]+/).filter(Boolean)) {
+  // ASCII WHITESPACE ONLY, the same rule as the config loader above and as java, rust and swift. JS
+  // `\s` includes U+00A0, so a dep path holding a non-breaking space split into two halves — and since
+  // ⟨0.27⟩ made an unresolvable dep token FATAL, that turned a path the other three engines load into a
+  // hard exit 2 naming a truncated path the operator never wrote. The config loader was fixed and this
+  // one, which every config-declared dep is also routed through, was not: one rule, two spellings.
+  for (const tok of spec.split(DEP_SEPARATORS).filter(Boolean)) {
     try {
       if (fs.statSync(tok).isDirectory())
         for (const f of fs.readdirSync(tok)) if (f.endsWith(".json") && !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.endsWith(".locs.json")) files.push(path.join(tok, f));
       if (fs.statSync(tok).isFile()) files.push(tok);
-    } catch { console.error(`candor-ts: CANDOR_DEPS entry unreadable, skipped: ${tok}`); }
+    } catch {
+      // ⟨0.27⟩ SPEC §2: A CONFIGURED DEP THAT CANNOT BE READ IS UNEVALUABLE, NOT REDUCED COVERAGE.
+      // Skipping it continued the run, and the caller of that dep then serialised `inferred: []` — a
+      // ⟨0.21⟩ purity claim, published in the REPORT, about a function whose dependency the operator
+      // configured precisely so it would not be one. This engine's note said only "skipped", so the
+      // omission was not even qualified in the channel a human reads, let alone the artifact a chained
+      // consumer reads. java and swift already refused; this engine and rust continued.
+      console.error(`candor-ts: CANDOR_DEPS names ${tok} but it is not a readable file or directory — `
+        + `failing (exit 2, unevaluable). A configured dep that is not there is not reduced coverage: `
+        + `its callers would serialise \`inferred: []\`, which is a purity claim about code this scan `
+        + `never saw. Scan that dependency, or remove it from the \`deps\` config / CANDOR_DEPS.`);
+      // The TOKEN arm needed this too. The read and parse arms below were routed to the stream and this
+      // one was not — three exits for one rule, two of them answered on the machine channel and one
+      // silent, which a conformance row (PART 36 b8) caught immediately once the cause was posed at all.
+      refuseEarlyToStream(`configured dependency ${tok} is not a readable file or directory`);
+      process.exit(2);
+    }
   }
   for (const f of files) {
+    // ⟨0.27⟩ READ AND PARSE OUTSIDE THE TRY, because SPEC §2 binds them and the try was swallowing them.
+    // The rule is one sentence — a configured dep path that "does not exist OR CANNOT BE READ MUST exit
+    // 2, naming it" — and the 0.27 work implemented only the first half, at the token check above. A path
+    // that resolved to a file which then failed to open, or held malformed JSON, was SKIPPED at exit 0,
+    // and the caller of that dep serialised `inferred: []`: the ⟨0.21⟩ purity claim the token check
+    // exists to prevent, reached by a different door.
+    //
+    // Found by the 0.27 go/no-go panel, which tested this engine's own changelog claim instead of
+    // believing it. java and swift refused on both halves already; this and rust made the family 2-v-2
+    // on a MUST. The surviving `catch` below still guards the PROCESSING of a well-formed document,
+    // which is a different failure and stays a skip.
+    let raw;
     try {
-      const d = JSON.parse(fs.readFileSync(f, "utf8"));
+      raw = fs.readFileSync(f, "utf8");
+    } catch {
+      console.error(`candor-ts: CANDOR_DEPS report ${f} could not be read —`);
+      console.error(`        failing (exit 2, unevaluable). A configured dep this scan cannot read is not`);
+      console.error(`        reduced coverage: its callers would serialise \`inferred: []\`, a purity claim`);
+      console.error(`        about code this scan never saw.`);
+      refuseEarlyToStream(`configured dependency report ${f} could not be read`);
+      process.exit(2);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      console.error(`candor-ts: CANDOR_DEPS report ${f} is not valid JSON —`);
+      console.error(`        failing (exit 2, unevaluable). Same reason as an unreadable one: a report`);
+      console.error(`        that cannot be parsed makes no claim, and continuing would publish one.`);
+      refuseEarlyToStream(`configured dependency report ${f} is not valid JSON`);
+      process.exit(2);
+    }
+    try {
+      const d = parsed;
       // A report whose version can't be VERIFIED is not trusted (§2.1) — a missing header is as
       // untrustworthy as a mismatched one (the Rust engine's rule; the engines split on this).
       const stale = d.candor?.version !== ENGINE_VERSION;
@@ -928,7 +1995,7 @@ const corruptDepPkgs = new Set();
         if (!stale && strs(e.netClass).includes("unknown-host")) cell.netIncomplete = true;
         crossDeps.set(e.hash, cell);
       }
-    } catch { console.error(`candor-ts: CANDOR_DEPS report unparsable, skipped: ${f}`); }
+    } catch { console.error(`candor-ts: CANDOR_DEPS report could not be processed, skipped: ${f}`); }
   }
   // A package chained TWICE — once fresh, once stale — is covered by the fresh report, so it is not a
   // stale-only package and must not pick up the disclosure below on top of a real answer.
@@ -1361,6 +2428,9 @@ function ollamaFromUrlArg(urlLit) {
 }
 // qualifies by the file's basename (`Cases.union_a`).
 const fns = new Map();           // qualified name -> { direct, edges, hosts, tables, cmds, paths, loc }
+// Units minted for a declaration with NO BODY (ambient `declare`, `.d.ts` member, `abstract` member).
+// Drained by the §3 body-less-declaration disclosure pass, after the class-CHA index is built.
+const bodylessDecls = new Map(); // qual -> {node, mod, abstract, owner, member}
 const unlistedSeen = new Map();  // the κ-coverage ledger: unlisted npm package -> call-site count
 const nodeName = new WeakMap();  // declaration node -> qualified name
 // ORM table declarations: `@Entity("user")` on a class maps that class to its table — the JVM's
@@ -1729,7 +2799,7 @@ for (const sf of sources) {
       const ctorQual = `${mod}.${namespacePrefixOf(node)}${node.name.text}.constructor`;
       if (!fns.has(ctorQual)) {
         const { line, character } = sf.getLineAndCharacterOfPosition(node.getStart());
-        fns.set(ctorQual, { local: `${node.name.text}.constructor`, direct: new Set(), edges: new Set(),
+        fns.set(ctorQual, { local: `${node.name.text}.constructor`, direct: new Set(), fsKinds: new Set(), edges: new Set(),
                             hosts: new Set(), tables: new Set(), cmds: new Set(), paths: new Set(),
                             blind: new Set(), incomplete: new Set(), why: new Set(), entry: false,
                             loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}`,
@@ -1753,11 +2823,30 @@ for (const sf of sources) {
       // producer's namespace nesting, so widening the hash would break report chaining.
       const nsp = namespacePrefixOf(node);
       const qual = isFunctionScoped(node) ? `${mod}.${nsp}${n}#${line + 1}:${character + 1}` : `${mod}.${nsp}${n}`;
-      fns.set(qual, { local: n, direct: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
+      fns.set(qual, { local: n, direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
                       cmds: new Set(), paths: new Set(), blind: new Set(), incomplete: new Set(), why: new Set(), entry: false, isCjsExport,
                       loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}`,
                       endLine: sf.getLineAndCharacterOfPosition(node.getEnd()).line + 1 });
       nodeName.set(node, qual);
+      // Record a unit minted for a declaration with NO BODY, for the §3 disclosure pass below (see it
+      // for the argument). MIRROR `fns.set`'s last-write-wins EXACTLY — `.delete` on the bodied write is
+      // load-bearing, not tidiness: an overload set is N body-less signatures followed by the
+      // implementation under the SAME qual, so a plain `.add` would mark every real overloaded function
+      // in the project unanalysable and charge its callers Unknown. That is the over-charge half of the
+      // fix, and it is pinned by a fixture (`over`/`callsOver`, still `Fs` after this pass).
+      {
+        const hasBodySlot = ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)
+          || ts.isConstructorDeclaration(node) || ts.isGetAccessorDeclaration(node)
+          || ts.isSetAccessorDeclaration(node);
+        if (hasBodySlot && !node.body)
+          bodylessDecls.set(qual, {
+            node, mod,
+            abstract: !!(ts.getCombinedModifierFlags(node) & ts.ModifierFlags.Abstract),
+            owner: node.parent?.name?.getText?.(),
+            member: node.name?.getText?.(),
+          });
+        else bodylessDecls.delete(qual);
+      }
       if ((ts.isVariableDeclaration(node) || ts.isPropertyDeclaration(node)) && node.initializer)
         nodeName.set(node.initializer, qual);
       // Index a `Object.defineProperty` descriptor accessor by its target SYMBOL + key, so a forcing
@@ -2054,7 +3143,7 @@ function moduleUnit(sf) {
   const qual = `${mod}.<module>`;
   let rec = fns.get(qual);
   if (!rec) {
-    rec = { local: qual, direct: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
+    rec = { local: qual, direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
             cmds: new Set(), paths: new Set(), blind: new Set(), incomplete: new Set(), why: new Set(),
             entry: false, unitKind: "initializer",
             loc: `${path.relative(rootDir, sf.fileName)}:1:1`,
@@ -2077,7 +3166,7 @@ function staticBlockUnit(node) {
   const qual = `${mod}.${cname}.<static-init>`;
   let rec = fns.get(qual);
   if (!rec) {
-    rec = { local: "<static-init>", direct: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
+    rec = { local: "<static-init>", direct: new Set(), fsKinds: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
             cmds: new Set(), paths: new Set(), blind: new Set(), incomplete: new Set(), why: new Set(),
             entry: false, unitKind: "initializer",
             loc: `${path.relative(rootDir, sf.fileName)}:${sf.getLineAndCharacterOfPosition(node.getStart()).line + 1}:1`,
@@ -3403,6 +4492,17 @@ function visitCalls(node) {
             eff = null;
           if (eff) {
             rec.direct.add(eff);
+            // SPEC §2 `fs` — refine an Fs we just PROVED with the direction its verb implies. DIRECT only
+            // (never propagated over edges): a caller reaching one writer and one undetermined callee would
+            // otherwise inherit ["write"] and thereby claim "writes but never reads" — the partial claim §2
+            // forbids. An unrecognised verb adds nothing, so the field stays absent rather than half-true.
+            if (eff === "Fs") {
+              // A verb revealing no direction records the POISON marker "?" rather than nothing. Abstaining
+              // would let a caller inherit a neighbour's ["write"] and claim "writes but never reads" over a
+              // reach whose kind was never determined — the partial claim §2 forbids. Suppressed at emit.
+              const ks = fsKind(mod, member);
+              if (ks.length === 0) rec.fsKinds.add("?"); else for (const k of ks) rec.fsKinds.add(k);
+            }
             // a κ rule that resolves to the Unknown trust-marker (node:vm code execution) is a direct
             // Unknown SOURCE — SPEC §4 requires a why on it, like eval's `reflect:eval`. (The rest of
             // the κ table is concrete effects, which carry no why.)
@@ -4309,6 +5409,53 @@ function resolveDepEntryKey(pkg, subpath) {
   }
 }
 
+// ---- THE BODY-LESS LOCAL DECLARATION (SPEC §3 honesty invariant; §4 `native:`/`dispatch:`) ---------
+// A declaration the scan can SEE but whose BODY is not in the analyzed set — an ambient `declare
+// function`, any member of a `.d.ts`, an `abstract` member no local subclass overrides. `localName`
+// mints a unit for each (it keys on the declaration, not on the presence of a body), the call site
+// edges the caller to it, and the unit is EMPTY — so the caller unioned nothing and read PURE. That is
+// the cardinal sin: a purity claim over code the engine never saw.
+//
+// FOUND ON REAL CODE, and the corpus is why: candor-ts's whole report for `axios` is 54 `index.d.ts`
+// declarations while its 61 `.js` implementation files are never analyzed, so `deny Unknown` — the gate
+// whose entire purpose is "fail if candor cannot see what this reaches" — exited **0** where rust, java
+// and swift all exit 1 on the same shape. candor-ts was the four-way outlier:
+//
+//   rust   `extern "C" { fn ambient(…) }`      caller -> Unknown[native:extern fn]
+//   java   `public static native int ambient`  DECL   -> Unknown[native:ambient], caller inherits
+//   swift  protocol req., no local conformer   caller -> Unknown[dispatch:Ambient.ping]
+//   ts     `declare function ambient(…)`       caller -> PURE                        <-- this
+//
+// We take java's shape (charge the DECLARATION, let the existing fixpoint carry it caller-ward) rather
+// than rust/swift's (charge at the edge), for one reason: ts already mints the unit and already forms
+// the edge, so mint-side is ONE place. Charging at the edge would mean touching every call and desugar
+// site — and that is the exact drift this file has been bitten by twice (`discloseUnanswerableKey` is
+// one function today because it was two, and the ⟨0.19⟩ reason class was added to neither).
+//
+// PRECISION HALF, and it is not optional — a fix that over-charges is how a fabrication gets introduced
+// while closing an under-report. A base member with a local bodied override is ALREADY resolved: the
+// class-CHA at the dispatch site edges the caller to the overrides and runs its own `allResolved` gate.
+// Charging the empty base too would manufacture uncertainty over code the engine can in fact see.
+// MEASURED on the corpus: hono's `EventProcessor` has six abstracts with three local subclasses and
+// zod's `ZodType._parse` one — excluding them takes zod's delta to +0 and hono's from +18 to +9, and
+// every one of the nine that remain is a true positive (`Deno.mkdir`/`writeFile` are Fs, `Deno.
+// upgradeWebSocket` and `FetcherLike.fetch` are Net, all declared in local `.d.ts` shims with no body).
+const answeredByLocalBody = (node) => (classOverrides.get(node) ?? []).some((om) => !!om.body);
+for (const [qual, meta] of bodylessDecls) {
+  const rec = fns.get(qual);
+  if (!rec || answeredByLocalBody(meta.node)) continue;
+  rec.direct.add("Unknown");
+  // §4's dividing line, same as everywhere else in this file. An `abstract` member IS an unresolved
+  // DISPATCH — owner type and member are both nameable, which is what `dispatch:` reserves itself for,
+  // and it is the spelling swift gives the same shape. Everything else (ambient/`declare`/`.d.ts`) is a
+  // boundary to code we cannot analyse, which is §4's definition of `native:` verbatim; java spells it
+  // `native:<method>` and rust `native:extern fn`. §4 makes the CLASS per-language and best-effort, so
+  // ts emitting `native:` where its language model produces one is exactly the licensed use.
+  rec.why.add(meta.abstract
+    ? dispatchWhy(meta.owner ? `${meta.mod}.${meta.owner}` : null, meta.member)
+    : `native:${rec.local}`);
+}
+
 // ---- pass 3: the least fixpoint (SEMANTICS §5a), effects + the literal surfaces -------------------
 // WORKLIST least-fixpoint. The old `while (changed) { for [,rec] of fns }` swept every function on every
 // pass, so its pass count equalled the longest back-to-front call chain — O(V²) on deep whole-project
@@ -4339,7 +5486,10 @@ const inferred = new Map([...fns.keys()].map((k) => [k, new Set(fns.get(k).direc
         if (!queued.has(c)) { queued.add(c); queue.push(c); }
   }
 }
-for (const m of ["hosts", "tables", "cmds", "paths", "blind", "incomplete"]) {
+// `fsKinds` joins the propagated surfaces: kinds TRAVEL the call graph (a caller that transitively only
+// writes IS a writer), and the "?" poison travels with them so a caller of an undetermined-kind function
+// inherits the SUPPRESSION rather than a half-answer. Pinned by conformance PART 31.
+for (const m of ["hosts", "tables", "cmds", "paths", "blind", "incomplete", "fsKinds"]) {
   const queue = [...fns.keys()];
   const queued = new Set(queue);
   for (let head = 0; head < queue.length; head++) {
@@ -4393,6 +5543,14 @@ for (const [name, rec] of fns) {
   if (inf.includes("Db") && rec.tables.size) entry.tables = [...rec.tables].sort();
   if (inf.includes("Exec") && rec.cmds.size) entry.cmds = [...rec.cmds].sort();
   if (inf.includes("Fs") && rec.paths.size) entry.paths = [...rec.paths].sort();
+  // SPEC §2 `fs` — the read/write kinds this fn's OWN Fs calls revealed. Gated on `inferred` carrying Fs
+  // (the spec: "applies only when `inferred` contains `Fs`") and omitted when empty.
+  //
+  // Kinds TRAVEL (see the propagation loop); the "?" poison is what stops a PARTIAL answer travelling with
+  // them. Present ⇒ some contributing Fs had no determined kind ⇒ suppress the whole field, because
+  // ["write"] there would claim "writes but never reads" about a function that may do both.
+  if (inf.includes("Fs") && rec.fsKinds.size && !rec.fsKinds.has("?"))
+    entry.fs = [...rec.fsKinds].sort();
   // ⟨0.6⟩ unknownWhy — REQUIRED on a DIRECT Unknown SOURCE (this fn's own body has the unresolvable call,
   // so `rec.direct` carries Unknown), absent on a purely-transitive Unknown. The rich per-site reasons
   // (rec.why: callback:/dispatch:/dynamic-key:) when recorded, else a generic fallback so a source is
@@ -4808,6 +5966,10 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
       + `NO report written (a consumer cannot detect this from the outside):`);
     for (const c of contradictions.slice(0, 20)) console.error(`  ${c}`);
     if (contradictions.length > 20) console.error(`  … and ${contradictions.length - 20} more`);
+    // ⟨0.28⟩ report stream: this exit-2 fires BEFORE the envelope is printed, so a `--json` run would
+    // otherwise leave stdout empty for the whole class of trust-marker contradictions. The latch is
+    // still unset at this point; the helper writes the fail-closed doc as stdout's only content.
+    refuseEarlyToStream(`${contradictions.length} report entr${contradictions.length === 1 ? "y contradicts its" : "ies contradict their"} own trust markers`);
     process.exit(2);
   }
 }
@@ -4834,8 +5996,13 @@ function fnv1aHex(sortedQuals) {
 
 // `package` names what this report COVERS — a consumer chaining it registers coverage even when
 // `functions` is empty (an all-pure package's report is its purity claim, SPEC §2 rule 3).
+// ⟨0.27⟩ SPEC §2.1 `resolves`: the OPTIONAL refinement surfaces this producer computes. Without it the
+// absence of such a field is overloaded between "does not compute this" and "computed and could not
+// determine it", and a consumer cannot read the omission at all. candor-ts resolves `fs` read/write kinds,
+// so it says so. A producer MUST NOT list a surface it does not compute — that turns "unimplemented" into a
+// false "undetermined", which is the inversion the field exists to prevent.
 const envelope = { candor: { version: ENGINE_VERSION, toolchain: `node-${process.versions.node}`, spec: SPEC_VERSION },
-                   package: pkgName, functions };
+                   resolves: ["fs"], package: pkgName, functions };
 // ⟨0.15 staged⟩ the κ-coverage ledger as DATA (COVERAGE-DESIGN.md §1): ONE sorted form (count desc,
 // name asc — exactly the stderr line's order) feeds the envelope field, the stderr receipt below, and
 // the --gate-json advisory, so the three can never tell different stories.
@@ -4874,10 +6041,18 @@ for (const [name, rec] of fns) cg[name] = [...rec.edges].sort();
 // `candor-ts-watch` re-scans (the recommended agent setup runs both) — must never observe a
 // half-written report. An in-place writeFileSync leaves a truncation window where JSON.parse throws;
 // rename(2) is atomic within a filesystem, so a reader sees either the old report or the new one whole.
-const writeAtomic = (file, text) => { const tmp = `${file}.${process.pid}.tmp`; fs.writeFileSync(tmp, text); fs.renameSync(tmp, file); };
+// ⟨0.28⟩ …and through `writeSinkAtomic`, so a symlinked or multiply-linked destination is written where
+// the operator points rather than replaced. Reports have the same layout exposure as verdicts.
+const writeAtomic = (file, text) => writeSinkAtomic(file, text);
 // --json: print the §2 envelope to STDOUT instead of writing the report files (matches candor-scan/Rust).
 if (wantJson) {
   console.log(JSON.stringify(envelope, null, 1));
+  // ⟨0.28⟩ REPORT STREAM LATCH — a successful envelope went to stdout, so a later exit-2 site (baseline
+  // corrupt, policy refusal, gate NOT certified over unanalyzed) MUST NOT also write a fail-closed
+  // placeholder there. Two documents on one stream parses as neither — the same shape the two-stream
+  // refusal exists to prevent, arriving through a different door. The rust reference sets the mirror
+  // `REPORT_STREAM_WRITTEN` OnceLock at the analog site (crates/candor-scan/src/scan.rs).
+  reportStreamWritten = true;
 } else {
   writeAtomic(`${outPrefix}.json`, JSON.stringify(envelope, null, 1));
   writeAtomic(`${outPrefix}.callgraph.json`, JSON.stringify(cg, null, 1));
@@ -4928,6 +6103,12 @@ if (!wantJson) {
   writeAtomic(`${outPrefix}.hierarchy.json`, JSON.stringify(hierarchy, null, 1));
   console.error(`candor-ts: wrote ${functions.length} effectful functions (${fns.size} analyzed, ${sources.length} files) to ${outPrefix}.json`);
 }
+// ⟨0.28⟩ The run has finished writing its report set: hand back any file it armed and turned out not to
+// own (see disarmUnwrittenOutReports). Placed HERE rather than at the exit sites because everything
+// below — the policy gate, the baseline ratchet, the unanalyzed certification — can exit 1 or 2 having
+// already published a complete report, and a leftover placeholder past this point is a claim of
+// incompleteness this run did not experience.
+disarmUnwrittenOutReports();
 {
   // Effect breakdown — make the result visible at a glance, not just a count + a file path.
   const counts = {};
@@ -5014,7 +6195,17 @@ if (!wantJson) {
   // A qual is test code iff its recorded loc (file:line[:col]) lies on a test path — the same predicate
   // the scan already uses to keep test files out of the report.
   const isTestQual = (q) => { const l = locMap.get(q); return l ? isTestPath(l) : false; };
-  emitSurface(inferred, directMap, callsMap, locMap, isTestQual);
+  // The cause this run can actually stand behind, in the order the evidence supports: packages the
+  // classifier does not cover (already enumerated above) beats a tsconfig guess, and a tsconfig this run
+  // READ rules the tsconfig guess out entirely.
+  const unresolvedCause = unlistedSeen.size > 0
+    ? `the ${uncoveredLedger.length} package${uncoveredLedger.length === 1 ? "" : "s"} named above are not `
+      + `covered by the classifier, so calls into them resolve to Unknown`
+    : (usedTsconfig
+        ? `this scan read ${path.relative(rootDir, usedTsconfig) || path.basename(usedTsconfig)}, so the `
+          + `cause is unresolvable imports rather than a missing tsconfig`
+        : `no tsconfig.json was found for this target, so imports resolve poorly — point candor at one`);
+  emitSurface(inferred, directMap, callsMap, locMap, isTestQual, console.error, unresolvedCause);
 }
 
 // ---- the gate surfaces: the AS-EFF-005 baseline guard + the standing §6.2 policy gate --------------
@@ -5023,6 +6214,14 @@ if (!wantJson) {
 // a `… | jq` / `… | candor-sarif` pipe never breaks.
 const emitViolation = (wantJson || gateJsonPath === "-") ? (l) => console.error(l) : (l) => console.log(l);
 let gateViolations = [];
+// ⟨0.27⟩ SPEC §4 `zeroMatch` — the raw text of every rule whose SCOPE bound no function, captured off the
+// gate evaluation and emitted onto the verdict document. The stderr lines alone left a machine consumer
+// unable to see that a rule bound nothing — the typo'd-scope silent green, one channel over. Disclosure
+// only: `ok` and the exit code never consult it.
+let gateZeroMatch = [];
+// ⟨0.28⟩ SPEC §6.2 `ignored` — the policy lines the parse DROPPED, for the verdict document. Declared
+// beside `gateZeroMatch` and for the same reason: the verdict is assembled long after the policy block.
+let gateIgnored = [];
 // ⟨0.24⟩ the `.candor/config` that supplied POLICY VOCABULARY this verdict actually used — named on the
 // document (SPEC §3.1 `99eb4e9`), null when no alias was referenced so the verdict stays byte-identical.
 let policyVocabulary = null;
@@ -5075,7 +6274,20 @@ const writeRefusal = (reason, unevaluated = null) => {
 //    must not silently NARROW the guard back to report-only.
 if (baselinePath !== null) {
   const shownB = baselinePath === "" ? "(configured empty)" : baselinePath;
-  if (baselinePath !== "" && !fs.existsSync(baselinePath)) {
+  if (baselinePath !== "" && !fs.existsSync(baselinePath) && baselineFromConfig) {
+    // A CHECKED-IN DECLARATION IS NOT THE SAME ABSENCE — see baselineFromConfig above. Exit 2: the
+    // gateless-green class, and an adopter review measured this as the second-likeliest first-commit
+    // mistake (`.candor/` committed, the baseline not).
+    console.error(`candor-ts: .candor/config declares \`baseline ${baselinePath}\` but that file is not `
+      + `there — failing (exit 2). A checked-in declaration says this repo HAS a baseline, so an absent `
+      + `one was deleted or never committed. Commit it, or record one: candor-ts <target> --out <prefix>.`);
+    // WRITE THE REFUSAL DOCUMENT BEFORE EXITING. Without this the `--gate-json` file keeps whatever the
+    // LAST run left there — so a CI wrapper that reads the artifact instead of the exit code sees the
+    // previous run's `ok: true` and reports a pass, which is the stale-artifact false green this format
+    // exists to refuse. java, rust and swift all overwrite on this branch; ts alone did not.
+    writeRefusal(`.candor/config declares \`baseline ${baselinePath}\` but that file is not there`);
+    process.exit(2);
+  } else if (baselinePath !== "" && !fs.existsSync(baselinePath)) {
     console.error(`candor-ts: CANDOR_BASELINE ${baselinePath} does not exist — the regression guard is `
       + `not active (record one: candor-ts <target> --out <prefix>, then point at the report .json).`);
   } else {
@@ -5085,6 +6297,10 @@ if (baselinePath !== null) {
     if (!Array.isArray(arr)) {
       console.error(`candor-ts: baseline ${shownB} exists but could not be parsed (corrupt/truncated?) — `
         + `failing (exit 2); the guard must not silently pass on an unreadable baseline. Regenerate it with this build.`);
+      // ⟨0.27⟩ the refusal document has no exempt cause AND no exempt sink (SPEC §3.1): a file sink holds
+      // the armed placeholder, but `--gate-json -` is not armed, so without this write the stream carried
+      // NOTHING on this cause. Writing here also replaces the placeholder with the specific reason.
+      writeRefusal(`baseline ${shownB} exists but could not be parsed — guard NOT evaluated`);
       process.exit(2);
     }
     const baseVersion = !Array.isArray(root) && root.candor && typeof root.candor === "object"
@@ -5092,12 +6308,14 @@ if (baselinePath !== null) {
     if (baseVersion === null) {
       console.error(`candor-ts: the baseline ${shownB} has no provenance header (a legacy/bare-array report) — `
         + `a baseline is comparable only to its producing build (§2.1). Failing (exit 2); regenerate it with this build.`);
+      writeRefusal(`baseline ${shownB} has no provenance header — guard NOT evaluated`);   // ⟨0.27⟩ see above
       process.exit(2);
     }
     if (baseVersion !== ENGINE_VERSION) {
       console.error(`candor-ts: the baseline ${shownB} was produced by engine build ${baseVersion} but this is `
         + `build ${ENGINE_VERSION} — an engine swap is baseline-invalidating and the gate cannot evaluate `
         + `(exit 2; never a silent skip, never a bogus AS-EFF-005 wave). Regenerate deliberately with this build.`);
+      writeRefusal(`baseline ${shownB} was produced by engine build ${baseVersion}, not this build — guard NOT evaluated`);   // ⟨0.27⟩ see above
       process.exit(2);
     }
     const base = new Map();
@@ -5124,6 +6342,7 @@ if (baselinePath !== null) {
         console.error(`candor-ts: the baseline callgraph ${sidecarPath} is present but could not be parsed `
           + `(corrupt/truncated?) — failing (exit 2); a broken sidecar must not silently narrow the guard to `
           + `report-only. Regenerate the baseline with this build.`);
+        writeRefusal(`baseline callgraph ${sidecarPath} could not be parsed — guard NOT evaluated`);   // ⟨0.27⟩ see above
         process.exit(2);
       }
       // The node set = every caller key + every callee (a pure leaf appears only as a callee), exactly
@@ -5220,6 +6439,11 @@ if (policyPath !== null) {
     const unknownAliases = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyPath, target)), parseErrs);
     const gatePolicy = parsePolicy(text, unknownAliases);
     parseErrs.push(...gatePolicy.errors);
+    // ⟨0.28⟩ SPEC §6.2 — the LINES THE PARSE DROPPED, for the verdict document below. Non-fatal by
+    // construction (`parsePolicy` excludes the fatal kinds: a policy ERROR refuses the whole run and a
+    // refused run has no verdict for a dropped line to have shrunk). Captured here because the verdict
+    // is assembled far below and `gatePolicy` is scoped to this block.
+    gateIgnored = gatePolicy.ignored ?? [];
     // ⟨0.24⟩ only the UNRECOGNISED VALUE TOKENS refuse. `errors` now also carries every LINE this parser
     // dropped whole (SPEC §3.1 `195d45a`), which is additive to the `parsepolicy` witness and deliberately
     // silent about the gate — refusing there would be a grammar change, not a token change.
@@ -5231,9 +6455,49 @@ if (policyPath !== null) {
     if (policyErrs.length) {
       const why = policyErrorText(policyPath, policyErrs);
       console.error(why);
-      // ⟨0.24⟩ ONE `unevaluated` ENTRY PER POLICY LINE THAT COULD NOT BE HONOURED — the SHARED builder, so
-      // this document and `gate --report`'s stay byte-equal (§3.1's acceptance test for the two routes).
-      policyRefusal = { why, unevaluated: policyErrorUnevaluated(policyErrs) };
+      // ⟨0.27⟩ ONE `unevaluated` ENTRY PER RULE OF THE POLICY — not only the unhonourable lines (SPEC
+      // §3.1's composed-document clause). Measured: listing only the bad token's line let a consumer read
+      // `deny Fs`, absent from the exit-1 document's list, as evaluated-and-passed. The SHARED builder,
+      // so this document and `gate --report`'s stay byte-equal (§3.1's acceptance test for the routes).
+      policyRefusal = { why, unevaluated: policyRefusalUnevaluated(text, policyErrs) };
+    } else if (!gatePolicy.deny.length && !gatePolicy.allow.length && !gatePolicy.forbid.length) {
+      // ⟨0.28⟩ A CONFIGURED POLICY THAT YIELDED ZERO RULES IS A BROKEN GATE CONFIG (SPEC §6.2) — the same
+      // refusal posture as the two branches above, and for the reason §6.2 already gives for an unreadable
+      // FILE: "a typo'd policy path that runs green is a gate that silently passes everything". MEASURED
+      // four-way 2026-08-10: `--policy <a README>` wrote `{"ok":true,"violations":[]}` and exited 0 on
+      // every engine — byte-identical to a gate that ran and found nothing, AND byte-identical to the
+      // no-gate-configured verdict (§3.3), so the one consumer this format exists for cannot tell "your
+      // code is clean" from "your gate had no rules". The per-line `ignoring policy rule` warnings above
+      // go to stderr, which is not the machine channel.
+      //
+      // The line-level ignore-with-a-warning leniency is UNTOUCHED and still right: silent reinterpretation
+      // is the one thing a security gate must not do, and an engine meeting a rule kind from a newer rung
+      // must not refuse the whole file over it. This rung is about what that leniency COMPOSES TO — a file
+      // in which EVERY line was ignored is a gate that asked nothing.
+      //
+      // THE CONTROL, which is what makes this a rule and not a blanket: reaching here at all means a policy
+      // was CONFIGURED (`--policy`, CANDOR_POLICY, or the `.candor/config` `policy` key — all three land in
+      // `policyPath`). A run that configured no gate never enters this block and stays exit 0; that is the
+      // honest way to say "I am not gating", and it is exactly why a configured zero-rule policy is never a
+      // legitimate expression of that intent.
+      //
+      // EVERY RULE VECTOR, and rust's first draft of this check read only its `rules`. `parsePolicy` splits
+      // the four kinds across THREE arrays — `deny` (both `deny` and `pure`), `allow` and `forbid` — so
+      // keying on one made an allow-only policy (`allow Net api.stripe.com`, an ordinary allowlist gate) or
+      // a forbid-only layer policy refuse as if it had no rules at all. A zero-rule test that inspects a
+      // subset of the rule kinds is the same false-answer shape this rung exists to close, pointed the
+      // other way.
+      const { why, unevaluated } = policyZeroRules(policyPath);
+      console.error(`candor-ts: ${why} — refusing (exit 2, gate NOT enforced). Every line was ignored (see `
+        + `the \`ignoring policy rule\` warnings above), the file is empty, or it holds only comments. A `
+        + `gate with no rules cannot have caught anything, and reporting \`ok: true\` here would be `
+        + `indistinguishable from a gate that ran and found nothing. If you did not mean to gate this run, `
+        + `remove the \`policy\` setting rather than pointing it at a file with no rules in it.`);
+      // …RECORDED, NOT EXECUTED, so it takes the SAME precedence as both branches above (SPEC §3.1
+      // `4c79958`): a certain violation dominates a refusal. No POLICY violation can exist with zero rules,
+      // but an AS-EFF-005 baseline regression is a finding from evidence this run already carries, and it
+      // rides exit 1 with this refusal disclosed beside it under `unevaluated`.
+      policyRefusal = { why, unevaluated };
     } else {
       // ⟨0.24⟩ the config file that supplied vocabulary the verdict USED, so an ambient `.candor/config` — the
       // walk goes up through every parent, and CANDOR_CONFIG overrides it outright — cannot move a verdict while
@@ -5242,7 +6506,20 @@ if (policyPath !== null) {
         const p = discoverConfigPath(policyVocabularyAnchor(policyPath, target));
         if (p) policyVocabulary = { config: p, aliases: gatePolicy.aliasesUsed };
       }
-      gateViolations = gateViolations.concat(evaluatePolicy(gatePolicy, functions, cg, incompleteMap, netPartners));
+      const gateOut = evaluatePolicy(gatePolicy, functions, cg, incompleteMap, netPartners);
+      // ⟨0.27⟩ SPEC §4 — a rule that bound NO function is disclosed, never scored as satisfied. The exit
+      // code is deliberately untouched: a zero-match rule is legitimate when one policy is shared across
+      // repositories and a layer exists in only some of them, so refusal would make a shared policy
+      // unusable. Printed before the violations so a typo'd layer name is visible above the verdict.
+      for (const raw of gateOut.zeroMatch ?? []) {
+        console.error(`candor: policy rule matched NO function — \`${raw}\`. It was evaluated and bound `
+          + `nothing, so it cannot have caught anything. Legitimate when one policy is shared across `
+          + `repos; a typo'd layer name otherwise.`);
+      }
+      // ⟨0.27⟩ captured BEFORE the concat below — `concat` returns a plain array, so the `zeroMatch`
+      // property riding `gateOut` would be silently lost with it (see the gateZeroMatch declaration).
+      gateZeroMatch = gateOut.zeroMatch ?? [];
+      gateViolations = gateViolations.concat(gateOut);
       // Provable-purity DISCLOSURE (advisory — NEVER a violation, so the exit/verdict are untouched): functions
       // in a pure/deny scope that PASS but are Unknown (the Unknown could hide the forbidden effect — a
       // fn/closure-injected port). Surfaces the gap automatically (eval/fixloop/DISPATCH-NOTE.md).
@@ -5317,6 +6594,20 @@ if (gateJsonPath) {
   // consumer reading exit 1 must be able to see that the POLICY half of the gate never ran — the same
   // `unevaluated` key, in the same position, that `gate --report` uses for its answerability refusals.
   if (policyRefusal) verdictObj.unevaluated = policyRefusal.unevaluated;
+  // ⟨0.27⟩ SPEC §4 `zeroMatch` — the same list the stderr lines carry, in the machine channel. Omitted
+  // when empty so a fully-binding verdict is byte-identical; never consulted for `ok` or the exit code.
+  if (gateZeroMatch.length) verdictObj.zeroMatch = gateZeroMatch;
+  // ⟨0.28⟩ SPEC §6.2 `ignored: [{line, text, reason}]` — the policy lines the parse DROPPED, so a machine
+  // consumer can see that the gate it is reading is SMALLER than the gate that was written. MEASURED
+  // four-way: all four engines warn per ignored line on stderr while the verdict document stays silent,
+  // and the zero-rule refusal fires only at ZERO survivors — so 1-of-10 rules parsing wrote
+  // `{"ok": true, "violations": []}` at exit 0 with nothing said about the nine gates never asked.
+  //
+  // DISTINCT FROM `unevaluated`, and the distinction is load-bearing: `unevaluated` carries rules that
+  // PARSED and could not be answered, `ignored` carries text that never became a rule at all. Omitted
+  // when nothing was dropped, so a clean policy's verdict stays byte-identical. Never consulted for `ok`
+  // or the exit code — the line-level leniency is UNCHANGED, only disclosed.
+  if (gateIgnored.length) verdictObj.ignored = gateIgnored;
   // ⟨0.21⟩ (Gap 2) the machine-legible incompleteness: the units candor couldn't analyze, so a CI/agent
   // reading the JSON learns WHY the gate can't certify (the stderr warning alone used to hide this from a
   // machine). `incomplete:true` + the list; the run exits 2 (could-not-fully-evaluate) below. ok:false +