candor-ts 0.29.1 → 0.31.0

package/AGENTS.md

@@ -21,7 +21,7 @@ the TypeScript-specific production + query surface.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.29)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.31)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >
@@ -292,3 +292,12 @@ far as candor could see, but it could not see through these" (a LOWER bound), no
 dependency can opt out of that blind spot by declaring `"candorEffects": ["Net", …]` in its
 `package.json` (the §5.1 effect manifest, read declared-not-verified) — its calls then classify to
 the declared set instead of contributing nothing.
+
+- **⟨0.30⟩ A GREEN GATE CAN NOW EXIT 2 — read `outOfScope` before you trust a pass.** When a policy is
+  configured, candor also reads the files the scan EXCLUDED (test files, build scripts, archives under the
+  root, files outside the build's program) and reports any that perform an effect the policy DENIES, under
+  the report's `outOfScope` key. A non-empty block makes the verdict `ok:false`, `incomplete:true`, exit 2
+  — *"I could not see enough of this tree to certify it"*, which is NOT the same as "your code violates":
+  those functions are never in `violations`, because the gate did not judge them. Branch on `incomplete`
+  to tell the two apart. An absent key means the producer was never asked (no policy at scan time), and an
+  empty one means asked-and-clear.

package/README.md

@@ -192,7 +192,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.29" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.31" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -210,7 +210,7 @@ read the Rust source".
 
 ## Status
 
-0.28.0, speaking candor-spec 0.29: the analysis core, the gate (`--policy` / `--gate-json` /
+0.30.0, speaking candor-spec 0.31: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.29.1",
-  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.29)",
+  "version": "0.31.0",
+  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.31)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",
@@ -66,6 +66,7 @@
     "verify-emit.mjs",
     "verify-loader.mjs",
     "verify-syscall.mjs",
+    "scratch.mjs",
     "sensitivity.mjs",
     "transitive-recall.mjs"
   ],

package/query-core.mjs

@@ -557,7 +557,16 @@ export function reportCompleteness(prefix) {
   // want different repairs and because `judgedNothing` is PINNED to "reports declaring `analyzed.count:
   // 0`", which a row-3 report is not.
   return { unanalyzed: reportUnanalyzed(prefix), judgedNothing: reportJudgedNothingFiles(prefix),
-           noManifest: reportNoManifestFiles(prefix), unreadable: reportUnreadableFiles(prefix) };
+           noManifest: reportNoManifestFiles(prefix),
+           // ⟨0.30⟩ the peek's findings, so an advisory verb keying `--strict` on this object is at least
+           // as pessimistic as the gate over the same bytes (the ⟨0.24⟩ MUST).
+           ...(() => {
+             const o = reportOutOfScope(prefix);
+             // A corrupt key rides `unreadable`, which is ALREADY an arm of the strict exit — so the
+             // fail-closed path is the one the ⟨0.24⟩ rule established, not a new one beside it.
+             return { outOfScope: o.findings,
+                      unreadable: [...reportUnreadableFiles(prefix), ...o.corrupt] };
+           })() };
 }
 
 /**
@@ -574,7 +583,38 @@ export function reportCompleteness(prefix) {
  * exit code; see `advisoryAnswer`, whose exit-bearing callers key `--strict` on manifest + unreadable.
  */
 export const mustHedge = (c) => !!(c && (c.unanalyzed?.length || c.judgedNothing?.length
-                                         || c.noManifest?.length || c.unreadable?.length));
+                                         || c.noManifest?.length || c.unreadable?.length
+                                         || c.outOfScope?.length));
+
+/** ⟨0.30⟩ The peek's findings across the reports under a locator. Read leniently HERE (a malformed key is
+ *  the gate's refusal to make, and this feeds a disclosure) but non-emptiness raises the same hedge the
+ *  gate raises, which is what keeps the advisory verbs bound to it. */
+export function reportOutOfScope(prefix) {
+  const out = [];
+  // ACCEPT A FULL PATH AS WELL AS A PREFIX. `reportFilesAt` appends `.json`, so a locator that already
+  // ends in `.json` — which is exactly what `--report <file>` gives — expanded to nothing and this
+  // returned `[]`. The hedge then never fired and `unverified --strict` certified a report the gate
+  // refuses. `loadGateReport` tolerates both spellings, so the two disagreed about the same locator.
+  const files = (prefix.endsWith(".json") && fs.existsSync(prefix)) ? [prefix] : reportFilesAt(prefix);
+  const corrupt = [];
+  for (const f of files) {
+    try {
+      const d = JSON.parse(fs.readFileSync(f, "utf8"));
+      // PRESENT-BUT-NOT-A-LIST IS CORRUPT, and it must reach the ADVISORY verbs too. Read leniently here,
+      // the key vanished and `--strict` certified a report `gate --report` refuses at exit 2 — the ⟨0.24⟩
+      // relation broken one shape over from where it was closed. The gate already refuses this; an
+      // advisory verb that does not is LESS pessimistic than the gate over the same bytes.
+      if (d?.outOfScope !== undefined && !Array.isArray(d.outOfScope)) { corrupt.push(f); continue; }
+      if (Array.isArray(d?.outOfScope)) {
+        for (const e of d.outOfScope) {
+          if (e && typeof e === "object") out.push(e);
+          else { corrupt.push(f); break; }
+        }
+      }
+    } catch { /* unparseable TEXT is `unreadable`'s business, not this key's */ }
+  }
+  return { findings: out, corrupt };
+}
 
 /**
  * ⟨0.28⟩ The disclosure KEYS, defined ONCE, for spreading into a verb's answer document — `{}` when there
@@ -740,7 +780,7 @@ export function loadReport(prefix) {
  */
 export function loadGateReport(prefix) {
   const files = reportFilesAt(prefix);
-  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [];
+  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [], netPartners = [];
   let hardFail = false, analyzed = 0;
   // ⟨0.24⟩ did the report handed to the gate judge ANYTHING? Per FILE, then ANDed across the multi-report
   // siblings, because the union of several reports has judged something as soon as ONE of them has — the
@@ -799,6 +839,38 @@ export function loadGateReport(prefix) {
         else unanalyzed.push({ path: typeof u.path === "string" ? u.path : "", reason: typeof u.reason === "string" ? u.reason : "" });
       }
     }
+    // ⟨0.30⟩ THE PEEK'S FINDINGS, off the report rather than recomputed — this route CANNOT peek (it has
+    // no target, only a document), and that is exactly why the field rides the report. Concatenated across
+    // siblings like `functions` and `unanalyzed` above. ABSENT stays absent: ⟨0.26⟩ makes an absent key
+    // "this producer cannot answer", and a report produced with no policy was never asked, so it must not
+    // trigger the ⟨0.30⟩ verdict. Only well-formed entries count — a malformed one is corrupt input, and
+    // silently dropping it is how a fail-closed rung turns back into a green one.
+    const oos = parsed.outOfScope;
+    // PRESENT-BUT-NOT-A-LIST IS CORRUPT, NOT ABSENT. This had no `else` on the Array.isArray guard, so
+    // `"outOfScope": "oops"` was silently coerced to nothing and `gate --report` answered exit 0,
+    // `ok:true`, "no violations" over a report whose peek had found a denied effect — the exact
+    // fail-open coercion the strict read exists to prevent, in the commit that claims to prevent it.
+    // rust, java and swift all refuse this shape; only this route did not. (Found by review, MEASURED.)
+    if (oos !== undefined && !Array.isArray(oos))
+      corrupt.push(`${f}: \`outOfScope\` is present and is not a list`);
+    else if (Array.isArray(oos))
+      for (const e of oos)
+        if (e && typeof e === "object" && Array.isArray(e.effects) && e.effects.length)
+          outOfScope.push(e);
+        else corrupt.push(`${f}: \`outOfScope\` (an element is not an object carrying a non-empty \`effects\`)`);
+    // ⟨0.31⟩ the producer's PARTNER PROVENANCE, carried through verbatim and never recomputed — this
+    // route has no target to anchor `net-partner` at, and re-classifying through the consumer's own
+    // config is the re-derivation §3.1 forbids. A prefix can match several reports (a workspace writes
+    // one per member), each anchoring its own config, so this is collected as a LIST even though a
+    // single report carries a single record. Shape-checked like every other key read off the wire: a
+    // malformed one is corruption, not something to quietly drop.
+    const nps = parsed.netPartners;
+    if (nps !== undefined) {
+      if (nps && typeof nps === "object" && !Array.isArray(nps)
+          && typeof nps.config === "string" && Array.isArray(nps.hosts))
+        netPartners.push({ config: nps.config, hosts: nps.hosts.map(String) });
+      else corrupt.push(`${f}: \`netPartners\` is present and is not { config: string, hosts: [string] }`);
+    }
     // ⟨0.15⟩ the κ ledger. Merged + re-sorted the PRODUCER's way (count desc, name asc by code point —
     // reportCoverage's rule, and scan.mjs's), so a single-report prefix reproduces the emitted order exactly.
     const unc = parsed.coverage?.uncovered;
@@ -811,7 +883,7 @@ export function loadGateReport(prefix) {
   }
   const coverage = [...cov.entries()].sort((a, b) => b[1] - a[1] || byCodePoint(a[0], b[0]))
     .map(([name, calls]) => ({ name, calls }));
-  return { functions, analyzed, unanalyzed, coverage, judgedNothing, hardFail: hardFail || corrupt.length > 0, corrupt };
+  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, netPartners, hardFail: hardFail || corrupt.length > 0, corrupt };
 }
 // The returned graph carries a non-enumerable `partial` flag (the loadReport `hardFail` precedent):
 // true iff a sidecar file was MATCHED but failed to read/parse — its edges were DROPPED (disclosed on

package/query.mjs

@@ -509,7 +509,7 @@ function renderPathHuman(fns, cg, fnQ, eff) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.29";
+const SPEC_VERSION = "0.31";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]
@@ -1852,7 +1852,12 @@ switch (cmd) {
     // --report` REFUSES over a corrupt member — measured, exit 2 — so exiting 0/1 here claimed this verb
     // got FURTHER than the gate on identical bytes. The unreadable note above already SAID the exit was
     // bounded by the gate's while this line did not read the field — a documented limitation, unmeasured.
-    process.exit(fgUnan.length || fgComp.unreadable.length || fgr.unevaluated?.length ? (strict ? 2 : 0) : (strict && !fgr.ok ? 1 : 0));
+    // ⟨0.30⟩ …and the peek's findings, because ⟨0.24⟩ binds this verb to the GATE's pessimism: "AN
+    // ADVISORY VERB MUST NEVER BE LESS SENSITIVE TO INCOMPLETENESS THAN THE GATE OVER THE SAME BYTES",
+    // and "THE SAME RULE BINDS EVERY ADVISORY VERB THAT ANSWERS `ok` — `unverified`, `fix-gate`, and any
+    // later sibling". ⟨0.30⟩ moved the gate to exit 2 on this cause and left these verbs certifying:
+    // MEASURED, `gate --report` exited 2 while this printed a clean answer at exit 0 over the same bytes.
+    process.exit(fgUnan.length || fgComp.unreadable.length || fgComp.outOfScope?.length || fgr.unevaluated?.length ? (strict ? 2 : 0) : (strict && !fgr.ok ? 1 : 0));
     break; // unreachable
   }
   case "unverified": {
@@ -1917,7 +1922,8 @@ switch (cmd) {
     // ⟨0.28⟩ `unreadable` joins the `--strict` exit-2 trigger — see fix-gate above. Measured on this verb
     // before the fix: over one good report plus one unparsable sibling, `gate --report` exited 2 and
     // `unverified --strict` exited 0 — and `--strict` is how CI consumes it.
-    process.exit(uUnan.length || uComp.unreadable.length || r.unevaluated?.length ? (strict ? 2 : 0) : (strict && !r.ok ? 1 : 0));
+    // ⟨0.30⟩ the peek's findings too — see the fix-gate exit above for the ⟨0.24⟩ MUST this satisfies.
+    process.exit(uUnan.length || uComp.unreadable.length || uComp.outOfScope?.length || r.unevaluated?.length ? (strict ? 2 : 0) : (strict && !r.ok ? 1 : 0));
     break; // unreachable
   }
   case "gate": {
@@ -2146,7 +2152,11 @@ switch (cmd) {
     // ⟨0.21⟩ COMPLETENESS MANIFEST: a gate cannot be green over code candor never analyzed. The scan path
     // exits 2 on its OWN `unanalyzed`; here the same manifest travels ON the report, so the same verdict
     // follows from it. A real violation (exit 1) dominates, as it does there.
-    const gincomplete = g.unanalyzed.length > 0;
+    // ⟨0.30⟩ the SECOND cause, read off the report because this route cannot peek — the report carries the
+    // peek's findings, which is what makes §3.1 byte-equality hold here by construction rather than by two
+    // authors agreeing. ABSENT is not empty: a report produced with no policy was never asked.
+    const gscope = g.outOfScope ?? [];
+    const gincomplete = g.unanalyzed.length > 0 || gscope.length > 0;
     // The verdict document — the SAME builder shape scan.mjs writes, field for field and in the same key
     // order, because §3.1 ⟨0.24⟩ makes byte-equality with `scan --policy`'s `--gate-json` the acceptance
     // test. `analyzed.count`, `incomplete`/`unanalyzed` and the ⟨0.15⟩ coverage advisory all come off the
@@ -2160,6 +2170,14 @@ switch (cmd) {
     const gverdictObj = { spec: SPEC_VERSION, ok: gviol.length === 0 && !gincomplete,
                           analyzed: { count: g.analyzed } };
     if (gvocab) gverdictObj.policyVocabulary = gvocab;
+    // ⟨0.31⟩ the partner declaration that moved the producer's classification, READ OFF THE REPORT —
+    // never recomputed here. This route has no target to anchor `net-partner` at, and the note above
+    // says why recomputing would be wrong anyway: `netClass` is read verbatim off the wire, so
+    // re-classifying through THIS machine's config is the re-derivation §3.1 forbids and would make the
+    // verdict depend on the consumer's CWD. The producer recorded which of its declared partners
+    // actually participated; both routes copy that one record, and byte-equality holds by construction.
+    // Same position as the scan route puts it, for the same reason as `policyVocabulary` above.
+    if (g.netPartners?.length) gverdictObj.netPartners = g.netPartners;
     gverdictObj.violations = gviol;
     if (gunevaluated.length) gverdictObj.unevaluated = gunevaluated;
     // ⟨0.27⟩ SPEC §4 `zeroMatch` — the same list the stderr lines above carry, in the machine channel,
@@ -2172,7 +2190,12 @@ switch (cmd) {
     // not be answered, this carries text that never became a rule at all. Omitted when empty; `ok` and
     // the exit do not consult it (the line-level leniency is unchanged, only disclosed).
     if (gpol.ignored?.length) gverdictObj.ignored = gpol.ignored;
-    if (gincomplete) { gverdictObj.incomplete = true; gverdictObj.unanalyzed = g.unanalyzed; }
+    if (gincomplete) {
+      gverdictObj.incomplete = true;
+      if (g.unanalyzed.length) gverdictObj.unanalyzed = g.unanalyzed;
+    }
+    // ⟨0.30⟩ same key, same position as the scan route's — §3.1's byte-equality is the acceptance test.
+    if (gscope.length) gverdictObj.outOfScope = gscope;
     if (g.coverage.length)
       gverdictObj.coverage = { uncovered: g.coverage.length, packages: g.coverage.map((c) => c.name) };
     if (gviol.length) {
@@ -2186,7 +2209,12 @@ switch (cmd) {
     if (gunevaluated.length)
       grefuse(`${gunevaluated.length} policy rule(s) could not be evaluated against this report`, gunevaluated);
     if (gincomplete) {
-      const why = `gate NOT certified — the report declares ${g.unanalyzed.length} unit(s) candor could not analyze; a gate cannot be green over unanalyzed code`;
+      // ⟨0.30⟩ NAME THE CAUSE THAT ACTUALLY FIRED. Two causes reach this exit now, and a message that
+      // always says "could not analyze" would report the wrong repair for the scope one — the operator
+      // would go looking for a parse failure that is not there.
+      const why = g.unanalyzed.length
+        ? `gate NOT certified — the report declares ${g.unanalyzed.length} unit(s) candor could not analyze; a gate cannot be green over unanalyzed code`
+        : `gate NOT certified — the report names ${gscope.length} function(s) OUTSIDE the scan's scope performing an effect this policy denies; the gate did not judge them, so the verdict is incomplete rather than a pass`;
       console.error(`candor-ts: ${why}`);
       // The INCOMPLETE verdict is a JUDGEMENT, not a refusal: it names what was analyzed and what was not,
       // and §3.1 makes byte-equality with `scan --policy`'s document the acceptance test for exactly it.

package/scan-core.mjs

@@ -404,11 +404,26 @@ export function isTelemetryHost(hostLiteral) { return hostInSet(hostLiteral, TEL
 // Literals.netDestClass.
 export function netDestClass(hostLiteral, partners) {
   if (isTelemetryHost(hostLiteral)) return "known-telemetry";
-  const host = normHost(hostLiteral);
-  const partnerMatch = partners && (partners.has(host) || [...partners].some((p) => host.endsWith("." + p)));
-  if (partnerMatch || isModelHost(hostLiteral)) return "known-partner";
+  if (partnerFor(hostLiteral, partners) !== null || isModelHost(hostLiteral)) return "known-partner";
   return "unknown-host";
 }
+/**
+ * ⟨0.31⟩ WHICH declared partner a host matched, or null — the SAME match `netDestClass` decides on,
+ * extracted so the DISCLOSURE and the DECISION cannot use different rules.
+ *
+ * That is not a stylistic preference. The first attempt at the `net-partner` disclosure re-implemented
+ * this match and normalised differently from the classifier — `partner.example:443` never equalled the
+ * declared `partner.example` — so the disclosure came back SILENTLY EMPTY on every real run while the
+ * verdict it was reporting on had flipped. A disclosure normalised differently from the decision it
+ * reports can only be wrong, and the way to make that impossible is one function with two callers.
+ */
+export function partnerFor(hostLiteral, partners) {
+  if (!partners || !partners.size) return null;
+  const host = normHost(hostLiteral);
+  if (partners.has(host)) return host;
+  for (const p of partners) if (host.endsWith("." + p)) return p;
+  return null;
+}
 // ⟨0.20⟩ The closed `Net` destination-class vocabulary, for the `deny Net[<dest…>]` policy filter.
 export const NET_DEST_CLASSES = ["known-telemetry", "known-partner", "unknown-host"];
 // ⟨0.20⟩ The `Net` destination classes an fn reaches — the SINGLE derivation shared by the report's

package/scan.mjs

@@ -34,7 +34,7 @@ import { parsePolicy, evaluatePolicy, scopeMatches, parseUnknownAliases, parseNe
 import { unverifiedHoleRule, ruleUpgrade, byCodePoint, claimsToHaveJudgedNothing, reportCorruptKeys, entryCorruptKeys } from "./query-core.mjs";
 import { printAgents, writeStdoutSync } from "./contract.mjs";
 import { isTestPath, kappa, kappaKnows, fsKind, commandHeadEffects, hostLiteral, tablesInSql,
-         modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf } from "./scan-core.mjs";
+         modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf, partnerFor } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -45,7 +45,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.29";
+const SPEC_VERSION = "0.31";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -489,7 +489,30 @@ const failClosedReportDoc = (reason) => {
   const esc = (s) => String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/[\n\r]/g, " ");
   return `{\n "candor": {\n  "version": "candor-ts-${PKG_VERSION}",\n  "toolchain": "node-${process.versions.node}",\n  "spec": "${SPEC_VERSION}"\n },\n "functions": [],\n "analyzed": { "count": 0 },\n "unanalyzed": [\n  { "path": "<run>", "reason": "${esc(reason)}" }\n ]\n}`;
 };
-const refuseEarlyToStream = (why) => {
+// ⟨0.31⟩ The gate sink this run ARMED, and the ONLY path `refuseEarly` may overwrite.
+//
+// The first version of that helper wrote straight to `preGateSink`, which broke the ⟨0.28⟩ rule it sits
+// beside: a `--gate-json` naming a source file under the scan target is REFUSED and nothing is written
+// there, precisely so arming cannot destroy the source it is about to scan. Writing the refusal document
+// to the same path bypassed that guard and truncated the fixture's own source — six ⟨0.28⟩ rows caught
+// it. A refusal may replace this run's OWN placeholder; it may not write anywhere the arming declined to.
+let armedGateSink = null;
+const refuseEarly = (why) => {
+  // ⟨0.31⟩ A FILE `--gate-json` SINK GETS THE REASON TOO, and until now it did not: this only ever
+  // wrote to STREAM sinks, so a run refusing with `--gate-json g.json` left the ARMING STUB in place —
+  // "the gate did not complete — this document was written when the run STARTED and was never replaced
+  // … the run failed, crashed or was killed". That describes a crash. This run did none of those things;
+  // it deliberately refused, and it knows exactly why.
+  //
+  // ⟨0.24⟩ pins the refusal document's `reason` as a string NAMING THE CAUSE, and a false description is
+  // rated worse here than a missing one — an operator reading "crashed" goes looking for a crash. The
+  // stub is the right answer only while the run's fate is genuinely unknown; once it has decided to
+  // refuse, leaving the stub is a stale document, which is the thing this whole sink exists to prevent.
+  if (armedGateSink) {
+    try {
+      fs.writeFileSync(armedGateSink, JSON.stringify(refusalVerdict(SPEC_VERSION, why, null), null, 1) + "\n");
+    } catch { /* an unwritable sink is already refused elsewhere; never mask the real cause with this */ }
+  }
   if (preGateSink === "-") console.log(JSON.stringify(refusalVerdict(SPEC_VERSION, why, null), null, 1));
   else if (preWantJson && !reportStreamWritten) {
     // Skipped when stdout is already claimed by `--gate-json -` (the two-stream case is refused
@@ -770,7 +793,7 @@ const disarmUnwrittenOutReports = () => {
       console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as ${flag} ${other} — refusing `
         + `(exit 2). The verdict is armed before the policy is read, so this would overwrite your policy `
         + `and then gate on the wreckage. Nothing was written; give the verdict its own path.`);
-      refuseEarlyToStream(`--gate-json ${gate} names the same file as ${flag} ${other}`);
+      refuseEarly(`--gate-json ${gate} names the same file as ${flag} ${other}`);
       process.exit(2);
     }
   }
@@ -782,7 +805,7 @@ const disarmUnwrittenOutReports = () => {
       + `about to read and then scan the wreckage. A non-source sink under the target `
       + `(${path.join(targetContainmentRoot(preTarget) ?? ".", ".candor", "verdict.json")}, say) is the `
       + `recommended layout and stays permitted.`);
-    refuseEarlyToStream(`--gate-json ${gate} is a source file under the scan target ${preTarget}`);
+    refuseEarly(`--gate-json ${gate} is a source file under the scan target ${preTarget}`);
     process.exit(2);
   }
   // `.candor/config` is never a verdict sink, wherever it is. The per-input checks above can only name
@@ -795,13 +818,13 @@ const disarmUnwrittenOutReports = () => {
       console.error(`candor-ts: --gate-json ${gate} is a .candor/config — refusing (exit 2). The verdict `
         + `is armed before the config is read, so this would destroy the config that configures this `
         + `run. Nothing was written; give the verdict its own path.`);
-      refuseEarlyToStream(`--gate-json ${gate} is a .candor/config`);   // ⟨0.28⟩ report stream too
+      refuseEarly(`--gate-json ${gate} is a .candor/config`);   // ⟨0.28⟩ report stream too
       process.exit(2);
     }
   }
   if (gate && singleSink && sameArtifact(gate, process.env.CANDOR_CONFIG)) {
     console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as CANDOR_CONFIG — refusing (exit 2).`);
-    refuseEarlyToStream(`--gate-json ${gate} names the same file as CANDOR_CONFIG`);   // ⟨0.28⟩
+    refuseEarly(`--gate-json ${gate} names the same file as CANDOR_CONFIG`);   // ⟨0.28⟩
     process.exit(2);
   }
   // ⟨0.28⟩ A REPEATED `--gate-json` IS REFUSED, AND EVERY PATH NAMED GETS THE REFUSAL. Placed after the
@@ -856,7 +879,7 @@ const disarmUnwrittenOutReports = () => {
       if (bad) offending.add(g);
     }
     if (offending.size === distinct.length) {
-      refuseEarlyToStream(`every named --gate-json path collides with an input`);   // ⟨0.28⟩ report stream
+      refuseEarly(`every named --gate-json path collides with an input`);   // ⟨0.28⟩ report stream
       process.exit(2);
     }
   }
@@ -878,7 +901,7 @@ const disarmUnwrittenOutReports = () => {
     // (its verdict arm keys on `preGateSink === "-"` and doesn't know one was just printed). When `-`
     // isn't in the list, refuseEarlyToStream's report arm handles the `--json` case; when it is, the
     // verdict is already there and `--json` was refused earlier (line 333), so nothing more is owed.
-    if (!distinct.includes("-")) refuseEarlyToStream(`--gate-json was given more than once (${list})`);
+    if (!distinct.includes("-")) refuseEarly(`--gate-json was given more than once (${list})`);
     process.exit(2);
   }
   if (gate && gate !== "-") armGateJsonFailClosed(gate);
@@ -932,7 +955,7 @@ const disarmUnwrittenOutReports = () => {
       const inputs = runInputs(preTarget, policy);
       for (const p of namedOuts) armOutPrefixFailClosed(p, inputs);
     }
-    refuseEarlyToStream(`--out was given more than once (${list}) — a run writes one report set to one prefix`);
+    refuseEarly(`--out was given more than once (${list}) — a run writes one report set to one prefix`);
     process.exit(2);
   }
   if (preOut && !preWantJson) armOutPrefixFailClosed(preOut, runInputs(preTarget, policy));
@@ -957,7 +980,7 @@ for (let i = 0; i < argv.length; i++) {
     const v = argv[i + 1];
     if (v === undefined || v.startsWith("--")) {
       console.error(`candor-ts: ${a} requires a value (${usage})`);
-      refuseEarlyToStream(`${a} requires a value`);
+      refuseEarly(`${a} requires a value`);
       process.exit(2);
     }
     if (a === "--out") outPrefix = v; else if (a === "--policy") policyPath = v; else gateJsonPath = v;
@@ -971,21 +994,21 @@ for (let i = 0; i < argv.length; i++) {
     console.error(`candor-ts: unknown flag ${a} (${usage})`);
     // ⟨0.27⟩ §3.3 names an unknown flag as a broken-gate-config exit-2 cause; the stream sink gets the
     // refusal document too (see refuseEarlyToStream — the file sink is already armed).
-    refuseEarlyToStream(`unknown flag ${a}`);
+    refuseEarly(`unknown flag ${a}`);
     process.exit(2);
   }
   else if (target === null) target = a;
   else if (outPrefix === null) outPrefix = a; // legacy positional prefix
   else {
     console.error(`candor-ts: unexpected extra argument ${a} (${usage})`);
-    refuseEarlyToStream(`unexpected extra argument ${a}`);
+    refuseEarly(`unexpected extra argument ${a}`);
     process.exit(2);
   }
 }
 if (wantAgents) { printAgents(); process.exit(0); }
 if (target === null) {
   console.error(usage);
-  refuseEarlyToStream("no scan target");
+  refuseEarly("no scan target");
   process.exit(2);
 }
 
@@ -1092,7 +1115,7 @@ function enforceEnginePin(targetPath) {
   // duplicate put TWO documents on the stream — which parses as neither. The other branch (a build that
   // cannot determine its own release) RETURNS rather than exiting: disclosed, not scored, so no refusal
   // belongs there.
-  refuseEarlyToStream(`.candor/config pins engine ${pin}, which this build does not satisfy`);
+  refuseEarly(`.candor/config pins engine ${pin}, which this build does not satisfy`);
   process.exit(2);
 }
 
@@ -1136,7 +1159,7 @@ function loadCandorConfig(targetPath, { lenient = false } = {}) {
       // The config is the EARLIEST exit-2 cause, and the one the stream sink is least likely to be
       // armed for — which is exactly why it was the last one still leaving stdout empty. Found by
       // PART 36 (b11), a row written before this line was.
-      refuseEarlyToStream(`CANDOR_CONFIG set but ${file} is not a readable file`);
+      refuseEarly(`CANDOR_CONFIG set but ${file} is not a readable file`);
       process.exit(2);
     }
   } else {
@@ -1148,7 +1171,7 @@ function loadCandorConfig(targetPath, { lenient = false } = {}) {
   catch (e) {
     if (lenient) throw new Error(`config ${file} exists but could not be read (${e.message})`);
     console.error(`candor-ts: config ${file} exists but could not be read (${e.message}) — failing (exit 2)`);
-    refuseEarlyToStream(`config ${file} exists but could not be read`);
+    refuseEarly(`config ${file} exists but could not be read`);
     process.exit(2);
   }
   const cfg = {};
@@ -1230,6 +1253,7 @@ function writeSinkAtomic(p, text) {
 }
 
 function armGateJsonFailClosed(p) {
+  armedGateSink = p;   // ⟨0.31⟩ this path is now ours to replace if the run refuses
   try {
     writeSinkAtomic(p, JSON.stringify({
       spec: SPEC_VERSION, ok: false, refused: true,
@@ -1323,18 +1347,37 @@ if (!stat) {
   // RETURNS — it is not a `Never`, and calling it INSTEAD of the exit lets the run continue past its
   // own refusal (measured, while getting this wrong: an unreadable dep wrote its refusal and then
   // exited 0). rust's equivalent is typed `-> !`, which is why the same slip could not happen there.
-  refuseEarlyToStream(`no such path: ${target}`);
+  refuseEarly(`no such path: ${target}`);
   process.exit(2);
 }
 let usedTsconfig = null;   // the tsconfig this run actually read, so a later disclosure can name the
                            // cause that APPLIES rather than the one that usually does.
+// ⟨0.31⟩ THE one admission rule. The directory walk had it inline and the single-file branch had none,
+// which is how a target this engine cannot read reached a green verdict. `.d.ts` is excluded because a
+// declaration carries no body to analyse, and `.min.js` because a minified bundle is not a source.
+const admitsAsSource = (name) =>
+  (/\.[mc]?tsx?$/.test(name) && !name.endsWith(".d.ts"))
+  || (allowJs && /\.[mc]?jsx?$/.test(name) && !/\.min\.js$/.test(name));
+
 if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.dirname(path.resolve(target));
   usedTsconfig = path.resolve(target);
   fileNames = fromTsconfig(path.resolve(target), rootDir);
 } else if (stat.isFile()) {
   rootDir = path.dirname(path.resolve(target));
-  fileNames = [path.resolve(target)];
+  // ⟨0.31⟩ A SINGLE-FILE TARGET IS ADMITTED BY THE SAME RULE AS A FILE INSIDE A DIRECTORY, and this
+  // branch used to admit it UNCONDITIONALLY. MEASURED: `candor-ts x.txt --policy p` printed
+  // `policy ✓` and exited 0 with `ok: true` over a file this engine cannot read — the compiler
+  // silently dropped it and `NO_SOURCES` was false because the name was in the list. rust, java and
+  // swift all refuse the same input at exit 2.
+  //
+  // That is precisely the §3.3 ⟨0.31⟩ cause this rung adds — "the walk admitted no file this engine
+  // can read" — answered with a green gate, in the release that introduces the clause. A typo'd path
+  // in CI (`--policy` pointed at a file, a glob that matched a README) is a permanent pass.
+  //
+  // Single-file targets remain supported: a real `.ts` still scans. What changed is that the file has
+  // to be one this engine parses, which is what the directory walk always required.
+  fileNames = admitsAsSource(path.basename(target)) ? [path.resolve(target)] : [];
 } else {
   rootDir = path.resolve(target);
   const tsconfig = path.join(rootDir, "tsconfig.json");
@@ -1348,8 +1391,7 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
         const p = path.join(d, ent.name);
         if (!IS_PEEK && isTestPath(path.relative(rootDir, p))) continue;   // ⟨0.29⟩ see IS_PEEK
         if (ent.isDirectory()) walk(p);
-        else if (/\.[mc]?tsx?$/.test(ent.name) && !ent.name.endsWith(".d.ts")) fileNames.push(p);
-        else if (allowJs && /\.[mc]?jsx?$/.test(ent.name) && !/\.min\.js$/.test(ent.name)) fileNames.push(p);
+        else if (admitsAsSource(ent.name)) fileNames.push(p);
       }
     })(rootDir);
   }
@@ -1397,13 +1439,43 @@ const EXCLUDED_REASON = {
     + "analyzed — a file your build excludes may still run in CI or at install time",
   "not-a-parsed-source": "not in this run's parse set",
 };
-if (fileNames.length === 0) {
+// ⟨0.30⟩ NO ANALYZABLE SOURCE IS STILL A REASON TO LOOK AT WHAT WAS EXCLUDED.
+//
+// This refusal used to exit here, before the peek existed in the run at all. Measured on the PUBLISHED
+// 0.30.0: a declarations-only package whose `.js` performs the denied effect answered `no TypeScript
+// sources`, exit 2, and named NOTHING — while candor-rust, over the analogous shape (no `.rs` sources, a
+// `build.rs` running `curl`), reached its peek and named `build::main performs Exec`. Both fail closed,
+// so no gate went green; but naming the function IS this rung's premise, and whether a user got names
+// turned on where a package happens to keep its declarations — `axios` ships `index.d.ts` at the root and
+// got 13 findings, `ky` ships them under `distribution/` and got a bare refusal.
+//
+// So: when a policy is configured and there IS something excluded to look at, the run continues to the
+// peek and the findings are named. The refusal itself does not move — see the NO_SOURCES arm beside the
+// other exit-2 causes at the end of this file. THAT ORDER IS THE WHOLE CARE POINT: the first version of
+// this change let the run fall through to a normal ending, and a clean-sibling tree — zero files
+// analyzed, nothing wrong in the excluded `.js` — answered `policy ✓` at EXIT 0. A green over a tree the
+// engine never read is the cardinal sin, introduced by a disclosure fix, and it was caught by writing
+// that control fixture BEFORE the fix rather than after.
+const NO_SOURCES = fileNames.length === 0;
+if (NO_SOURCES && !(policyPath && excludedFiles.length)) {
   console.error(`candor-ts: no TypeScript sources under ${target}`);
+  // §3.3(d) MUST: the refusal names what a target of this engine's kind looks like. Without it the
+  // message says only that something is wrong, and the commonest cause — a path that moved, or one
+  // pointing at a file this engine does not parse — has an obvious fix the reader is left to guess.
+  console.error(`        candor-ts reads .ts/.tsx/.mts/.cts (and .js with --allow-js) — point it at a `
+              + `project directory or a TypeScript file. Exit 2 (unevaluable): a target this engine `
+              + `cannot read is not a clean scan.`);
   // An empty scan is an exit-2 cause like any other: a consumer reading the stream after it must not
   // get nothing. §3.1 exempts no cause, and this one is easy to hit in CI (a path that moved).
-  refuseEarlyToStream(`no TypeScript sources under ${target}`);
+  refuseEarly(`no TypeScript sources under ${target} — candor-ts reads .ts/.tsx/.mts/.cts `
+            + `(and .js with --allow-js); point it at a project directory or a TypeScript file. `
+            + `Exit 2 (unevaluable): a target this engine cannot read is not a clean scan.`);
   process.exit(2);
 }
+if (NO_SOURCES) {
+  console.error(`candor-ts: no TypeScript sources under ${target} — reading what this scan excluded, `
+    + `because a policy is configured and there are excluded files to look at`);
+}
 // Builtin typings FALLBACK: the engine ships @types/node as its own dependency, so a target that
 // hasn't installed it still resolves node:fs/node:net/… (found by the first npx-distribution
 // probe: a bare fixture read Unknown for fs.readFileSync because nothing supplied the builtin
@@ -1436,7 +1508,7 @@ if (!wantJson) {
         console.error(`candor-ts: the report set at --out ${outPrefix} includes ${w}, which is the SAME `
           + `FILE as ${label} ${other} — refusing (exit 2). Writing the report there would destroy an `
           + `input of this run. Nothing was scanned; give the report set its own prefix.`);
-        refuseEarlyToStream(`the report set at ${outPrefix} would overwrite ${label} ${other}`);
+        refuseEarly(`the report set at ${outPrefix} would overwrite ${label} ${other}`);
         process.exit(2);
       }
     }
@@ -1944,7 +2016,7 @@ const corruptDepPkgs = new Set();
       // The TOKEN arm needed this too. The read and parse arms below were routed to the stream and this
       // one was not — three exits for one rule, two of them answered on the machine channel and one
       // silent, which a conformance row (PART 36 b8) caught immediately once the cause was posed at all.
-      refuseEarlyToStream(`configured dependency ${tok} is not a readable file or directory`);
+      refuseEarly(`configured dependency ${tok} is not a readable file or directory`);
       process.exit(2);
     }
   }
@@ -1968,7 +2040,7 @@ const corruptDepPkgs = new Set();
       console.error(`        failing (exit 2, unevaluable). A configured dep this scan cannot read is not`);
       console.error(`        reduced coverage: its callers would serialise \`inferred: []\`, a purity claim`);
       console.error(`        about code this scan never saw.`);
-      refuseEarlyToStream(`configured dependency report ${f} could not be read`);
+      refuseEarly(`configured dependency report ${f} could not be read`);
       process.exit(2);
     }
     let parsed;
@@ -1978,7 +2050,7 @@ const corruptDepPkgs = new Set();
       console.error(`candor-ts: CANDOR_DEPS report ${f} is not valid JSON —`);
       console.error(`        failing (exit 2, unevaluable). Same reason as an unreadable one: a report`);
       console.error(`        that cannot be parsed makes no claim, and continuing would publish one.`);
-      refuseEarlyToStream(`configured dependency report ${f} is not valid JSON`);
+      refuseEarly(`configured dependency report ${f} is not valid JSON`);
       process.exit(2);
     }
     try {
@@ -3463,6 +3535,74 @@ function enclosing(node) {
 // and the whole-module Net rule paints them — but console fd 0/1/2 I/O is not Net (§1 has no Console effect).
 // `net.Socket.on`/`.write` return the stream (`this`), so a chained call's receiver is still the std stream;
 // the exact-string check missed it (the receiver is the inner CallExpression). Walk the chain to its head.
+// R54 — THE STD-STREAM CARVE-OUT, DECIDED FROM THE RECEIVER'S TYPE RATHER THAN ITS SPELLING.
+//
+// `rootsAtStdStream` above matches the TEXT of the receiver chain, so it only ever recognised
+// `process.stdout.write(...)` written literally. MEASURED on `execa` in the ⟨0.30⟩ blast-radius sweep:
+// one level of indirection defeats it —
+//
+//     const pick = fd => (fd === 1 ? process.stdout : createWriteStream("", {fd}));
+//     pick(3).write("hello");     // charged Net, netClass unknown-host. There is no socket.
+//
+// The receiver types as `tty.WriteStream | fs.WriteStream`, `tty.WriteStream` EXTENDS `net.Socket`, so
+// resolving `.write` lands in the net cluster's typings and the whole-module Net rule paints it. It
+// accounted for 2 of the 31 ⟨0.30⟩ verdict flips — the only two of that sweep that were not genuine.
+//
+// DENYLIST, NOT ALLOWLIST, and the direction is stated so it can be checked: this suppresses Net ONLY
+// when EVERY constituent of the receiver's type is a PROVEN non-network stream class. An unknown
+// constituent, an `any`, a project type, or a real `net.Socket` all fail the test and KEEP the charge.
+// The failure mode is therefore an over-report, never a false all-clear.
+//
+// THE SAFE SET IS CONCRETE CLASSES ONLY. `stream.Writable`/`Readable` are deliberately ABSENT: a real
+// `net.Socket` IS a `stream.Duplex` and therefore satisfies them, so admitting the base types would
+// suppress Net on genuine sockets — the exact silent under-report this family has measured arriving in
+// 4 of 5 over-charge fixes. Only `tty`/`fs` stream classes, and only when declared in @types/node's own
+// `tty.d.ts`/`fs.d.ts`, so a project class named `WriteStream` cannot buy the carve-out.
+const SAFE_STREAM_CLASSES = new Set(["WriteStream", "ReadStream"]);
+// `process` is in the set because that is where @types/node DECLARES the std streams' own
+// `WriteStream`/`ReadStream` (process.stdout is `WriteStream & { fd: 1 }`, declared in process.d.ts and
+// extending tty's). Measured: without it the predicate rejected the very case it exists for.
+const SAFE_STREAM_MODULES = new Set(["tty", "fs", "process"]);
+function receiverIsProvenNonNetworkStream(expr) {
+  if (!expr) return false;
+  let t;
+  try { t = checker.getTypeAtLocation(expr); } catch { return false; }
+  if (!t) return false;
+  const parts = (t.isUnion && t.isUnion()) ? t.types : [t];
+  if (!parts.length) return false;
+  // INTERSECTIONS CARRY NO SINGLE SYMBOL, and every real case here is one: `process.stdout` types as
+  // `tty.WriteStream & { fd: 1 }`, and the helper's union is `(WriteStream & {fd:1}) | WriteStream`.
+  // The first attempt asked each union part for its symbol, got none for the intersection, and
+  // suppressed nothing — measured, before this comment existed.
+  const flatten = (ty) => (ty.isIntersection && ty.isIntersection()) ? ty.types : [ty];
+  const declaredSafely = (sym) => {
+    const decls = sym.getDeclarations?.() ?? [];
+    if (!decls.length) return false;
+    return decls.every((d) => {
+      const f = path.resolve(d.getSourceFile().fileName);
+      const m = f.match(/@types\/node\/(.+?)\.d\.ts$/);
+      return !!m && SAFE_STREAM_MODULES.has(m[1]);
+    });
+  };
+  return parts.every((part) => {
+    let sawSafe = false;
+    for (const member of flatten(part)) {
+      const sym = member.getSymbol?.() ?? member.symbol;
+      const name = sym?.getName?.();
+      // An ANONYMOUS shape (`{ fd: 1 }`) carries no class identity: it neither proves nor disproves,
+      // so it is skipped. If EVERY member is anonymous, `sawSafe` stays false and the charge is kept.
+      // TypeScript names anonymous shapes SYNTHETICALLY — `__type` for a type literal,
+      // `__object` for an object literal — so `!name` alone does not skip them and the
+      // `{ fd: 1 }` half of `process.stdout`'s intersection fell through to the rejection
+      // below. Measured: this is what still suppressed nothing after the intersection fix.
+      if (!name || name.startsWith("__")) continue;
+      if (!SAFE_STREAM_CLASSES.has(name) || !declaredSafely(sym)) return false;
+      sawSafe = true;
+    }
+    return sawSafe;
+  });
+}
+
 function rootsAtStdStream(expr) {
   let e = expr;
   for (;;) {
@@ -4848,6 +4988,14 @@ function visitCalls(node) {
           if (eff && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
               && rootsAtStdStream(node.expression.expression))
             eff = null;
+          // R54 — the same carve-out through a helper, decided from the receiver's TYPE. SCOPED TO Net
+          // DELIBERATELY: an `fs.WriteStream` receiver legitimately carries Fs, and suppressing whatever
+          // effect happened to resolve would swallow that — the same under-report one door along. Only
+          // the fabricated network charge is removed.
+          if (eff === "Net"
+              && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
+              && receiverIsProvenNonNetworkStream(node.expression.expression))
+            eff = null;
           if (eff) {
             rec.direct.add(eff);
             // SPEC §2 `fs` — refine an Fs we just PROVED with the direction its verb implies. DIRECT only
@@ -6092,6 +6240,8 @@ for (const m of ["hosts", "tables", "cmds", "paths", "blind", "incomplete", "fsK
 // nothing for the rest of the run. Printed once, here, beside the other config diagnostics.
 const netPartnerErrs = [];
 const netPartners = parseNetPartners(discoverConfigText(target), netPartnerErrs);
+// ⟨0.31⟩ the declared partners that actually MOVED a classification in this run — see the envelope key.
+const partnersUsed = new Set();
 for (const e of netPartnerErrs) console.error(`candor-ts: ${e.why} — ${e.raw}`);
 const functions = [];
 for (const [name, rec] of fns) {
@@ -6123,7 +6273,16 @@ for (const [name, rec] of fns) {
   // ⟨0.20⟩ Net destination-class (NET-DESTINATION-CLASS-DESIGN.md): the classes present in this fn's
   // transitive Net surface — exact host-literal match, fail-closed unknown-host on a masked surface (rec
   // .incomplete has Net) OR a Net with no visible host. The class travels the call graph like the effect.
-  if (inf.includes("Net")) entry.netClass = netClassesOf([...rec.hosts], rec.incomplete.has("Net"), netPartners);
+  if (inf.includes("Net")) {
+    entry.netClass = netClassesOf([...rec.hosts], rec.incomplete.has("Net"), netPartners);
+    // ⟨0.31⟩ RECORD WHICH DECLARED PARTNER PARTICIPATED, at the point the class is decided. Asking
+    // `partnerFor` — the function `netDestClass` itself asks — is what keeps the disclosure and the
+    // decision on one rule; the reverted first attempt re-matched and normalised differently.
+    for (const h of rec.hosts) {
+      const pm = partnerFor(h, netPartners);
+      if (pm) partnersUsed.add(pm);
+    }
+  }
   if (inf.includes("Db") && rec.tables.size) entry.tables = [...rec.tables].sort();
   if (inf.includes("Exec") && rec.cmds.size) entry.cmds = [...rec.cmds].sort();
   if (inf.includes("Fs") && rec.paths.size) entry.paths = [...rec.paths].sort();
@@ -6566,7 +6725,7 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     // ⟨0.28⟩ report stream: this exit-2 fires BEFORE the envelope is printed, so a `--json` run would
     // otherwise leave stdout empty for the whole class of trust-marker contradictions. The latch is
     // still unset at this point; the helper writes the fail-closed doc as stdout's only content.
-    refuseEarlyToStream(`${contradictions.length} report entr${contradictions.length === 1 ? "y contradicts its" : "ies contradict their"} own trust markers`);
+    refuseEarly(`${contradictions.length} report entr${contradictions.length === 1 ? "y contradicts its" : "ies contradict their"} own trust markers`);
     process.exit(2);
   }
 }
@@ -6631,6 +6790,26 @@ if (uncoveredLedger.length) {
 // and NOT cross-engine comparable — qualifiers differ). ALWAYS present.
 const analyzedQuals = [...fns.keys()].sort();
 envelope.analyzed = { count: fns.size, digest: fnv1aHex(analyzedQuals) };
+// ⟨0.31⟩ `netPartners` — WHICH ambient `.candor/config` declared a partner, and which of its hosts
+// actually participated. MEASURED: `deny Net[unknown-host]` over a call to `partner.example` exits 1;
+// adding `net-partner partner.example` to `.candor/config` exits 0 with `ok:true`, and nothing in the
+// verdict named the file, its path, or the host. An operator reading that green could not tell an
+// ambient file turned a red into it — the same failure §3.1's `policyVocabulary` exists to refuse for
+// `unknown-alias`, whose argument reaches this key and whose MUST did not.
+//
+// IT LIVES IN THE REPORT, and that is what makes it emittable at all. `net-partner` anchors at the
+// TARGET, and `gate --report` has no target — it reads the producer's already-computed `netClass`. A
+// verdict-only disclosure is therefore computable on one route and not the other, which breaks §3.1's
+// byte-equality and is exactly why the first attempt was reverted (candor-ts's own suite: "pure: NOT
+// byte-equal"). Recorded by the PRODUCER, both routes read the same source, and they agree by
+// construction — the shape ⟨0.30⟩'s `outOfScope` already uses for the same structural reason.
+//
+// Omitted when empty, so a project declaring no partners — or declaring some that never matched — is
+// byte-identical to a pre-rung report. A declaration that changed nothing is not provenance.
+if (partnersUsed.size) {
+  const cfg = discoverConfigPath(target);
+  if (cfg) envelope.netPartners = { config: cfg, hosts: [...partnersUsed].sort() };
+}
 // ⟨0.21⟩ COMPLETENESS MANIFEST (Gap 2): the target's own source candor could NOT analyze (unparsed .ts).
 // OMITTED when empty — a complete scan stays byte-identical to a pre-rung report — so a MACHINE reading
 // --json sees the incompleteness the stderr warning alone used to hide.
@@ -6646,7 +6825,8 @@ for (const [name, rec] of fns) cg[name] = [...rec.edges].sort();
 const writeAtomic = (file, text) => writeSinkAtomic(file, text);
 // ── ⟨0.29⟩ THE PEEK ───────────────────────────────────────────────────────────────────────────────
 // Read the files this run deliberately did NOT judge, and say so when they hold an effect the policy
-// DENIES. The verdict does not move: `outOfScope` is its own kind and never a violation, because a file
+// DENIES. ⟨0.30⟩ THE VERDICT DOES MOVE — see the exit site below: a non-empty block makes it
+// `ok:false, incomplete:true` at exit 2. It is still never a violation, because a file
 // the gate declined to judge must not decide an exit code.
 //
 // A CHILD `scan.mjs`, not a second analysis path. candor-rust buys this by recursing into `scan_one`;
@@ -6678,7 +6858,11 @@ let peekRead = false;
 const peekUnread = new Set();
 let peekUnattributed = false;
 if (policyPath && excludedFiles.length) {
-  let denied = new Set();
+  // ⟨0.30⟩ HOISTED, because the matcher below needs it. It was a `const` inside the try, so the
+  // evaluatePolicy call added in this rung threw ReferenceError straight into the "a peek that cannot
+  // run must not fail the gate" catch — findings silently empty, gate green. The catch is right; a bug
+  // hiding behind it is not, which is why the trigger below is now a POSITIVE test on the rules.
+  let peekPolicy = null;
   try {
     const pol = parsePolicy(fs.readFileSync(policyPath, "utf8"), {});
     // ⟨0.29⟩ A REFUSED POLICY LEAVES THE KEY ABSENT (SPEC §2). The peek is a producer reading the policy,
@@ -6687,11 +6871,39 @@ if (policyPath && excludedFiles.length) {
     // parser's SALVAGE of an unhonourable file — the rewriting `fatalPolicyErrors` exists to refuse.
     // candor-java already withheld here; this engine, candor-rust and candor-swift did not.
     if (!fatalPolicyErrors(pol.errors).length) {
-      denied = new Set((pol.deny ?? []).flatMap((r) => r.effects ?? []));
+      peekPolicy = pol;
     }
   } catch { /* an unreadable policy is the gate's business to refuse, not the peek's */ }
-  if (denied.size) {
+  // ⟨0.30⟩ THE TRIGGER IS "ARE THERE DENY RULES", not "is the flattened effect-name set non-empty". The
+  // old test read the name set, and `pure` is a deny rule with an EMPTY effect list meaning "every effect
+  // except Unknown" — so under the STRICTEST policy the set was empty, the peek never ran, and the tree
+  // passed at exit 0 while the strictly weaker `deny Exec` exited 2 on the same files. MEASURED four-way.
+  if ((peekPolicy?.deny ?? []).length) {
     outOfScopeFindings = [];
+    // ⟨0.31⟩ A FILE THIS ENGINE CANNOT READ CANNOT BE PEEKED, AND THE CLASS MUST SAY SO.
+    //
+    // MEASURED: an excluded file performing a denied `Fs`, with the policy `deny Fs`. Readable, the peek
+    // finds it and the gate exits 2 naming the function. `chmod 000` on that ONE file and the same run
+    // exits 0 with `ok: true`, `outOfScope: []` and `excluded: [{class: …, peeked: true}]` — byte-
+    // identical to a genuinely clean peek. The only difference between a red gate and a green one is
+    // whether the engine could open the file, and nothing in the report says so.
+    //
+    // The child's TypeScript program drops an unreadable file SILENTLY: no diagnostic, and no entry in
+    // `unanalyzed`, so the `peekUnread` accounting below never fires. candor-rust answers `peeked: false`
+    // on the same shape, so this was ts alone.
+    //
+    // Asked HERE, in the parent, because the parent is the process that decided these files are in the
+    // peek's scope and can check the premise directly. A file the parent cannot read is one the child
+    // cannot read either. This is ⟨0.26⟩'s manifest rule applied to the peek: a claim of completeness
+    // over a set requires having actually covered the set, and a PARTIAL peek publishing `peeked: true`
+    // answers worse than one that admits it read nothing.
+    for (const e of excludedFiles) {
+      try {
+        fs.accessSync(path.resolve(rootDir, e.path), fs.constants.R_OK);
+      } catch {
+        peekUnread.add(e.cls);   // its class withdraws the completeness claim; the gate stays cautious
+      }
+    }
     const peekDir = fs.mkdtempSync(path.join(os.tmpdir(), "candor-ts-peek-"));
     try {
       fs.writeFileSync(path.join(peekDir, "tsconfig.json"), JSON.stringify({
@@ -6712,17 +6924,122 @@ if (policyPath && excludedFiles.length) {
           stdio: ["ignore", "pipe", "ignore"] });
       const doc = JSON.parse(out);
       peekRead = true;   // the child returned a report this run could read — see `peekRead`
+      // ⟨0.31⟩ ONE LOOKUP FOR ALL THREE CALLERS. This was written THREE times — the matcher's
+      // qualifier, the finding's path, and the `unanalyzed`→`peekUnread` attribution below — and every
+      // copy carried the same defect:
+      //     find(e => loc.endsWith(e.path) || loc.endsWith(basename(e.path)))
+      // The `||` sits INSIDE one `.find`, so a BASENAME match on an earlier entry beats a FULL PATH
+      // match on a later one. MEASURED: with `src/one/dup.test.ts` and `src/two/dup.test.ts`, a
+      // function from `two` was disclosed at `one`. A previous fix collapsed two of the three copies
+      // and its commit message said so; the third survived here, where the failure mode is not a
+      // fabricated locator but CLASS MIS-ATTRIBUTION feeding `peeked` — worse in kind.
+      //
+      // AND SUFFIX MATCHING IS ITSELF THE BUG. The replacement tried "longest suffix wins" and argued
+      // no counterexample existed; here is one: a project directory literally NAMED `app`, holding
+      // `x.test.ts` and `app/x.test.ts`. The root file's absolute path `/…/app/x.test.ts` genuinely
+      // ends with the NESTED file's relative path `app/x.test.ts`, on a proper segment boundary, and
+      // it is the longer match — so the root function is disclosed at the nested file. A
+      // segment-boundary test would not have caught it either.
+      //
+      // So: RESOLVE, don't match. The child is handed absolute paths under `rootDir`, so its reported
+      // location relativises back to exactly the `e.path` this run recorded. Suffix and basename
+      // remain only as fallbacks for a child that reported something unrelativisable, and the basename
+      // one is used only when it names exactly ONE excluded file. When nothing resolves this returns
+      // null and the caller reports the child's own path — an ugly true locator beats a tidy false one.
+      const locateExcluded = (childLoc) => {
+        if (!childLoc) return null;
+        // RESOLVE AGAINST THE CHILD'S OWN ROOT. The child scan runs under a tsconfig in `peekDir`, and
+        // reports locations RELATIVE TO THAT — `../../../../../private/tmp/…/app/x.test.ts`. Resolving
+        // such a path against the parent's cwd yields nonsense, which is why the first attempt at an
+        // exact match never matched anything and quietly fell through to the suffix arm that carries
+        // the bug. Resolve against `peekDir`, then relativise to `rootDir`, and the result is exactly
+        // the `e.path` this run recorded.
+        const abs = path.resolve(peekDir, childLoc);
+        let rel = path.relative(rootDir, abs);
+        let exact = excludedFiles.find((e) => e.path === rel);
+        // …and once more through realpath, because macOS resolves `/tmp` to `/private/tmp` and a run
+        // invoked through the symlinked spelling would otherwise miss its own files.
+        if (!exact) {
+          try {
+            rel = path.relative(fs.realpathSync(rootDir), fs.realpathSync(abs));
+            exact = excludedFiles.find((e) => e.path === rel);
+          } catch { /* the file may not exist from here; fall through to the suffix arms */ }
+        }
+        if (exact) return exact;
+        let best = null;
+        for (const e of excludedFiles) {
+          const sfx = path.sep + e.path;
+          if ((childLoc === e.path || childLoc.endsWith(sfx) || childLoc.endsWith("/" + e.path))
+              && (!best || e.path.length > best.path.length)) best = e;
+        }
+        if (best) return best;
+        const base = path.basename(childLoc);
+        const byBase = excludedFiles.filter((e) => path.basename(e.path) === base);
+        return byBase.length === 1 ? byBase[0] : null;
+      };
       for (const u of Array.isArray(doc.unanalyzed) ? doc.unanalyzed : []) {
         const where = String(u?.path ?? "");
-        const hit = excludedFiles.find((e) => where.endsWith(e.path)
-                                           || where.endsWith(path.basename(e.path)));
+        const hit = locateExcluded(where);
         // The peek walks ONLY excluded files, so an unread path matching no exclusion is one this code
         // cannot attribute — fail closed across every class rather than let one unattributable file leave
         // all of them claiming completeness.
         if (hit) peekUnread.add(hit.cls); else peekUnattributed = true;
       }
+      // ⟨0.30⟩ THE PEEK ASKS THE GATE'S OWN MATCHER, not a flat set of effect NAMES. §6.2 already
+      // requires it — "THE GATE AND THE DISCLOSURE MUST APPLY THE SAME RULE, AND SHOULD SHARE THE SAME
+      // CODE" — and the name-set approximation was wrong in BOTH directions once ⟨0.30⟩ made this
+      // verdict-bearing (both MEASURED four-way in review):
+      //
+      //   OVER-CHARGE: `deny Net[known-partner]` denies only that destination class, but the name set
+      //   held bare "Net", so a peeked fn fetching an UNKNOWN host — which the rule does not deny —
+      //   turned the verdict red, while the identical code IN scope passed. Rule SCOPES were dropped the
+      //   same way: a layer-scoped `deny Exec server` fired on a test file the scope excludes.
+      //
+      //   UNDER-REPORT: `pure` is a deny rule with an EMPTY effect list, meaning "every effect except
+      //   Unknown". Flattened, it contributed NOTHING, so the denied set was empty and the peek never
+      //   ran — the STRICTEST policy silently disarmed the rung while the strictly weaker `deny Exec`
+      //   exited 2 on the identical tree. A four-way false all-clear.
+      //
+      // Only the DENY rules are handed over: ⟨0.29⟩ bounds this block to "effects that policy DENIES",
+      // and evaluating `allow`/`forbid`/`only` here would widen it past the bound that keeps it quiet.
+      // ⟨0.30⟩ THE PROJECT'S OWN `net-partner` SET, not an empty one. The child scan runs over a temp
+      // tsconfig and never sees the project's `.candor/config`, and this call passed `new Set()` on top of
+      // that — so a `deny Net[known-partner]` peek asked "is this host a declared partner?" against a set
+      // that was always empty. MEASURED both ways: a test file reaching a DECLARED partner answered exit 0
+      // where the same code in scope exits 1 (a false all-clear), and `deny Net[unknown-host]` answered
+      // exit 2 over that same declared partner where in scope it exits 0 (the mirror over-charge).
+      // candor-rust never had this — its peek runs in-process and inherits the config.
+      //
+      // `netClasses` stays null so the resolver recomputes each entry's class from the `hosts` the child
+      // DID capture, against these partners — the child's own `netClass` was computed partner-blind and
+      // must not be trusted here.
+      // ⟨0.30⟩ MATCH SCOPES AGAINST A PROJECT-RELATIVE QUALIFIER, not the child's. The child scan runs
+      // under a temp-directory tsconfig, so its `fn` is derived from THAT root — an absolute dotted path.
+      // Handing those to the matcher made a rule's SCOPE match segments of the checkout directory: on a
+      // tree at `…/fresh/src/execa`, `deny Net src` armed the peek while binding nothing in scope, so the
+      // verdict depended on where the repo happened to be cloned. CI checkouts live under names nobody
+      // chose (Bitbucket uses `agent/build`), which makes that a verdict decided by infrastructure.
+      //
+      // The project-relative path is already known here — it is what this run disclosed as excluded — and
+      // the finding below is already named from it. The MATCHER must see the same thing the FINDING does.
+      const relQual = (f) => {
+        const childLoc = (f.loc ?? "").split(":")[0] ?? "";
+        const hit = locateExcluded(childLoc);
+        if (!hit) return f.fn;
+        const stem = hit.path.replace(/\.[cm]?[jt]sx?$/, "").split(path.sep).join(".");
+        const leaf = f.fn.split(".").pop() ?? f.fn;
+        return `${stem}.${leaf}`;
+      };
+      const peekEntries = (doc.functions ?? []).map((f) => ({ ...f, fn: relQual(f) }));
+      const peekViolations = evaluatePolicy({ ...peekPolicy, allow: [], forbid: [], only: [] },
+                                            peekEntries, {}, new Map(), netPartners, null, null);
+      const deniedByFn = new Map();
+      for (const v of peekViolations) {
+        if (!deniedByFn.has(v.fn)) deniedByFn.set(v.fn, new Set());
+        for (const e of v.effects ?? []) deniedByFn.get(v.fn).add(e);
+      }
       for (const f of doc.functions ?? []) {
-        const hits = (f.inferred ?? []).filter((e) => denied.has(e));
+        const hits = [...(deniedByFn.get(relQual(f)) ?? [])].sort();
         if (!hits.length) continue;
         // NAME IT FROM THE PROJECT, NOT FROM THE CHILD'S TEMP ROOT. The child's tsconfig lives in a
         // temp directory, so it derives module qualifiers from THAT root and the fn came out as a
@@ -6730,14 +7047,15 @@ if (policyPath && excludedFiles.length) {
         // exists by the time anyone reads it. The project-relative path is already known here (it is
         // what was excluded), so match on basename and report the path we already trust.
         const childLoc = (f.loc ?? "").split(":")[0] ?? "";
-        const hit = excludedFiles.find((e) => childLoc.endsWith(e.path)
-                                           || childLoc.endsWith(path.basename(e.path)));
+        const hit = locateExcluded(childLoc);
         const where = hit?.path ?? childLoc;
         const cls = hit?.cls ?? "excluded";
         outOfScopeFindings.push({
           fn: f.fn.split(".").pop() ?? f.fn, path: where, effects: hits, class: cls,
           reason: `OUTSIDE this scan's scope (${cls}) — the gate did NOT judge it. `
-                + "The effect is real; the verdict does not account for it.",
+                + "candor's ANALYSIS of that file reaches this effect; the gate did not judge it, so "
+                + "the verdict is INCOMPLETE rather than a pass. (An analysis result, not a claim about "
+                + "what the code does at runtime — see the release notes' known over-charge.)",
         });
       }
       outOfScopeFindings.sort((a, b) => (a.path + a.fn).localeCompare(b.path + b.fn));
@@ -6751,6 +7069,31 @@ if (policyPath && excludedFiles.length) {
     }
   }
 }
+// ⟨0.30⟩ NOTHING ANALYZABLE, AND THE PEEK FOUND NOTHING EITHER: REFUSE — AND REFUSE BEFORE AN ENVELOPE
+// EXISTS. The peek above is the whole reason this run got past the early refusal; if it named something,
+// the ⟨0.30⟩ arm at the end reports it and exits 2 with `outOfScope` IN the report, so `gate --report` over
+// that report reaches the same 2 and §3.1 holds. If it named nothing there is nothing to report, and the
+// run must go back to being a refusal.
+//
+// WHY HERE AND NOT AT THE END, measured: the first version of this change let the clean case fall through
+// to a normal ending and exit 2 from an arm after the verdict was written — so the process exited 2 while
+// `--gate-json` said `ok: true`, and `gate --report` over the report it left behind exited 0. The exit code
+// was right and the DOCUMENT was green; a SARIF consumer reads the document. §3.1's byte-equality is
+// quantified over "any report a scan produced", so the only safe refusal is one that produces no report at
+// all — once an envelope exists, the scan route owns the gate route's answer.
+if (NO_SOURCES && !(Array.isArray(outOfScopeFindings) && outOfScopeFindings.length)) {
+  console.error(`candor-ts: gate NOT certified — no analyzable TypeScript source under ${target}, and the `
+    + `files this scan excluded perform no effect this policy denies; a gate cannot be green over a tree `
+    + `it did not read`);
+  // §3.3(d) MUST — the same remedy the no-policy branch names. This arm explains WHY the gate is not
+  // certified and, without this, still leaves the reader to guess what a valid target looks like.
+  console.error(`        candor-ts reads .ts/.tsx/.mts/.cts (and .js with --allow-js) — point it at a `
+              + `project directory or a TypeScript file.`);
+  refuseEarly(`no analyzable TypeScript source under ${target} — candor-ts reads `
+            + `.ts/.tsx/.mts/.cts (and .js with --allow-js); point it at a project directory or a `
+            + `TypeScript file.`);
+  process.exit(2);
+}
 if (outOfScopeFindings) {
   envelope.outOfScope = outOfScopeFindings;
   // SAY IT ON STDERR TOO. The report block is for machines; an operator reading `policy ✓` needs to know
@@ -6761,7 +7104,7 @@ if (outOfScopeFindings) {
     if (f.path) console.error(`             ${f.path}`);
   }
   if (outOfScopeFindings.length) {
-    console.error("             The verdict does not account for "
+    console.error("             The verdict below is INCOMPLETE because of "
       + (outOfScopeFindings.length === 1 ? "it." : `these ${outOfScopeFindings.length}.`));
   }
 }
@@ -7356,12 +7699,24 @@ if (gateJsonPath) {
   // must NOT read green — those effects are invisible, so a `deny`/`pure` that "passes" over them is a
   // false-pure. `ok` requires BOTH no violation AND a complete analysis. `analyzed:{count}` (Gap 1) mirrors
   // the report envelope so a --gate-json consumer sees the scan's scope from the verdict alone.
-  const incomplete = unanalyzedUnits.length > 0;
+  // ⟨0.30⟩ THE SECOND CAUSE OF INCOMPLETENESS — a peeked function performs an effect the policy DENIES.
+  // ⟨0.29⟩ required the verdict NOT to move here, on the assumption the peek surfaces uncertainty a gate
+  // may decline to act on. It does not: measured on published 0.29.1 the peek resolves a CONCRETE denied
+  // effect and names the function (axios 37 × `performs Net`, exit 0, `policy ✓`). Reported through
+  // `incomplete`, never through `violations`, because the gate did not JUDGE these units — see the exit
+  // site below for why that makes the code 2 and not 1.
+  const scopeIncomplete = Array.isArray(outOfScopeFindings) && outOfScopeFindings.length > 0;
+  const incomplete = unanalyzedUnits.length > 0 || scopeIncomplete;
   const verdictObj = { spec: SPEC_VERSION, ok: gateViolations.length === 0 && !incomplete,
                        analyzed: { count: fns.size } };
   // ⟨0.24⟩ the vocabulary file that moved the verdict, in the SAME position `gate --report` puts it, because
   // §3.1 makes byte-equality between the two routes the acceptance test. Omitted when no alias was used.
   if (policyVocabulary) verdictObj.policyVocabulary = policyVocabulary;
+  // ⟨0.31⟩ …and the partner declaration that moved it, COPIED FROM THE REPORT rather than recomputed.
+  // Copying is the point: `gate --report` cannot compute this (no target), so if the two routes derived
+  // it independently they could not agree. Reading the producer's record on both routes is what makes
+  // the byte-equality hold instead of break. Same position in both, for the same reason as the line above.
+  if (envelope.netPartners) verdictObj.netPartners = [envelope.netPartners];
   verdictObj.violations = gateViolations;
   // ⟨0.24⟩ …and when a certain violation DOMINATED a policy refusal, the refusal is disclosed here rather
   // than deleted (SPEC §3.1: "the RAW policy line, verbatim", one entry per rule, omitted when empty). A
@@ -7388,8 +7743,14 @@ if (gateJsonPath) {
   // incomplete:true is honest — never a fabricated pass. OMITTED when complete (byte-compatible verdict).
   if (incomplete) {
     verdictObj.incomplete = true;
-    verdictObj.unanalyzed = unanalyzedUnits.map((u) => ({ path: u.path, reason: u.reason }));
-  }
+    if (unanalyzedUnits.length)
+      verdictObj.unanalyzed = unanalyzedUnits.map((u) => ({ path: u.path, reason: u.reason }));
+  }
+  // ⟨0.30⟩ …and WHICH functions made it incomplete, in the machine channel. The same array the report
+  // carries, so `gate --report` re-emits it from the report and §3.1 byte-equality holds by construction —
+  // this is the anchor the `net-partner` attempt lacked. Omitted when empty, so a clean verdict is
+  // byte-identical to a pre-⟨0.30⟩ one.
+  if (scopeIncomplete) verdictObj.outOfScope = outOfScopeFindings;
   // ⟨0.15 staged⟩ coverage ADVISORY (COVERAGE-DESIGN.md §3): when the κ ledger is non-empty, the
   // verdict discloses what the gate could NOT see — VERDICT-PRESERVING (the ⟨0.9⟩ provable-purity
   // auto-disclosure precedent exactly): ok/violations/exit are computed above and untouched here. A
@@ -7429,5 +7790,21 @@ if (gateConfigured && unanalyzedUnits.length) {
   console.error(`candor-ts: gate NOT certified — ${unanalyzedUnits.length} source file(s) could not be analyzed (see above); a gate cannot be green over unanalyzed code`);
   process.exit(2);
 }
+// ⟨0.30⟩ THE SCOPE HALF OF THE SAME POSTURE. `unanalyzed` above is "I opened this file and could not read
+// it"; this is "I never opened it, and when I looked afterwards it performed the effect you denied". Both
+// mean the same thing to a consumer — the gate could not see enough of this tree to certify it — so both
+// are exit 2.
+//
+// EXIT 2, NOT 1, DELIBERATELY: these functions are not in `violations` and not in `functions`, because the
+// gate did not judge them. Exit 1 would claim "I judged your code and it breaks the policy", which is
+// false in the other direction. Exit 2 says "I could not see enough to answer", which is what happened.
+// A real violation (exit 1, above) still dominates: certain beats unevaluable.
+if (gateConfigured && Array.isArray(outOfScopeFindings) && outOfScopeFindings.length) {
+  const n = outOfScopeFindings.length;
+  console.error(`candor-ts: gate NOT certified — ${n} function(s) OUTSIDE this scan's scope perform an `
+    + `effect this policy denies (named above); the gate did not judge them, so the verdict is `
+    + `incomplete rather than a pass`);
+  process.exit(2);
+}
 if (policyPath !== null) console.error("candor-ts: policy ✓");
 if (baselinePath !== null && fs.existsSync(baselinePath)) console.error("candor-ts: baseline ✓"); // absent = inactive (noted above)

package/scratch.mjs

@@ -0,0 +1,58 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Scratch directories for the harnesses, removed when the run ends.
+//
+// WHY THIS EXISTS. Every harness here made fixture trees with a bare `fs.mkdtempSync` and removed none
+// of them. Measured 2026-08-14: 46,919 `candor-*` directories in $TMPDIR, ~7,300 of them from test.mjs's
+// `project()` alone, which mints one per fixture and is called ~1,300 times a run. It is not only
+// untidy — it made a single `candor-swift privacy-manifest --verify` take 72 seconds, because listing
+// the plist's ancestor meant listing all of $TMPDIR. The engine side of that was fixed in 2026-08-07;
+// this is the side that keeps refilling the directory.
+//
+// KEPT ON FAILURE, DELIBERATELY. A failing assertion prints the path to its fixture tree, and deleting
+// it on the way out would remove the evidence at exactly the moment someone needs it. `keepOnFailure()`
+// lets a harness say "this run failed" and the trees survive, with a line saying where they are.
+// Success is the common case and the one that accumulates.
+//
+// SIGINT/SIGTERM are handled because the killed-mid-run case was the obvious contributor — though 46,919
+// is not all killed runs.
+const made = [];
+let keep = false;
+
+export function scratch(prefix) {
+  const d = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  made.push(d);
+  return d;
+}
+
+/** Call before exiting when the run FAILED — the trees are evidence, so they stay. */
+export function keepOnFailure() { keep = true; }
+
+function sweep() {
+  if (keep) {
+    if (made.length) console.log(`  (${made.length} fixture tree(s) kept for inspection under ${os.tmpdir()})`);
+    return;
+  }
+  for (const d of made) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
+  made.length = 0;
+}
+
+process.on("exit", sweep);
+// An uncaught throw still runs `exit` handlers — with `keep` false, so a harness that dies mid-assertion
+// would sweep away the very trees whose paths the crash just printed. Treat any abnormal end as failure.
+for (const ev of ["uncaughtException", "unhandledRejection"]) {
+  process.on(ev, (e) => { keepOnFailure(); console.error(e); process.exit(1); });
+}
+// A signal does NOT run `exit` handlers on its own, which is the killed-mid-run leak. Re-raise after
+// sweeping so the exit status still reflects the signal rather than becoming a clean 0.
+//
+// `removeAllListeners` FIRST, and it is the whole trick: installing a listener REPLACES Node's default
+// disposition for that signal, so `process.kill(process.pid, sig)` re-enters this same handler. The
+// first version of this shipped without it and made the harness unkillable — Ctrl-C swept, re-signalled,
+// swept, forever, and a second Ctrl-C did not help either. Removing the listener restores the default,
+// so the re-raise terminates with the right status.
+for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.on(sig, () => { sweep(); process.removeAllListeners(sig); process.kill(process.pid, sig); });
+}