candor-ts 0.30.0 → 0.31.0

package/AGENTS.md

@@ -21,7 +21,7 @@ the TypeScript-specific production + query surface.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.30)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.31)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >

package/README.md

@@ -192,7 +192,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.30" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.31" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -210,7 +210,7 @@ read the Rust source".
 
 ## Status
 
-0.30.0, speaking candor-spec 0.30: the analysis core, the gate (`--policy` / `--gate-json` /
+0.30.0, speaking candor-spec 0.31: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.30.0",
-  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.30)",
+  "version": "0.31.0",
+  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.31)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",

package/query-core.mjs

@@ -780,7 +780,7 @@ export function loadReport(prefix) {
  */
 export function loadGateReport(prefix) {
   const files = reportFilesAt(prefix);
-  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [];
+  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [], netPartners = [];
   let hardFail = false, analyzed = 0;
   // ⟨0.24⟩ did the report handed to the gate judge ANYTHING? Per FILE, then ANDed across the multi-report
   // siblings, because the union of several reports has judged something as soon as ONE of them has — the
@@ -858,6 +858,19 @@ export function loadGateReport(prefix) {
         if (e && typeof e === "object" && Array.isArray(e.effects) && e.effects.length)
           outOfScope.push(e);
         else corrupt.push(`${f}: \`outOfScope\` (an element is not an object carrying a non-empty \`effects\`)`);
+    // ⟨0.31⟩ the producer's PARTNER PROVENANCE, carried through verbatim and never recomputed — this
+    // route has no target to anchor `net-partner` at, and re-classifying through the consumer's own
+    // config is the re-derivation §3.1 forbids. A prefix can match several reports (a workspace writes
+    // one per member), each anchoring its own config, so this is collected as a LIST even though a
+    // single report carries a single record. Shape-checked like every other key read off the wire: a
+    // malformed one is corruption, not something to quietly drop.
+    const nps = parsed.netPartners;
+    if (nps !== undefined) {
+      if (nps && typeof nps === "object" && !Array.isArray(nps)
+          && typeof nps.config === "string" && Array.isArray(nps.hosts))
+        netPartners.push({ config: nps.config, hosts: nps.hosts.map(String) });
+      else corrupt.push(`${f}: \`netPartners\` is present and is not { config: string, hosts: [string] }`);
+    }
     // ⟨0.15⟩ the κ ledger. Merged + re-sorted the PRODUCER's way (count desc, name asc by code point —
     // reportCoverage's rule, and scan.mjs's), so a single-report prefix reproduces the emitted order exactly.
     const unc = parsed.coverage?.uncovered;
@@ -870,7 +883,7 @@ export function loadGateReport(prefix) {
   }
   const coverage = [...cov.entries()].sort((a, b) => b[1] - a[1] || byCodePoint(a[0], b[0]))
     .map(([name, calls]) => ({ name, calls }));
-  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, hardFail: hardFail || corrupt.length > 0, corrupt };
+  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, netPartners, hardFail: hardFail || corrupt.length > 0, corrupt };
 }
 // The returned graph carries a non-enumerable `partial` flag (the loadReport `hardFail` precedent):
 // true iff a sidecar file was MATCHED but failed to read/parse — its edges were DROPPED (disclosed on

package/query.mjs

@@ -509,7 +509,7 @@ function renderPathHuman(fns, cg, fnQ, eff) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.30";
+const SPEC_VERSION = "0.31";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]
@@ -2170,6 +2170,14 @@ switch (cmd) {
     const gverdictObj = { spec: SPEC_VERSION, ok: gviol.length === 0 && !gincomplete,
                           analyzed: { count: g.analyzed } };
     if (gvocab) gverdictObj.policyVocabulary = gvocab;
+    // ⟨0.31⟩ the partner declaration that moved the producer's classification, READ OFF THE REPORT —
+    // never recomputed here. This route has no target to anchor `net-partner` at, and the note above
+    // says why recomputing would be wrong anyway: `netClass` is read verbatim off the wire, so
+    // re-classifying through THIS machine's config is the re-derivation §3.1 forbids and would make the
+    // verdict depend on the consumer's CWD. The producer recorded which of its declared partners
+    // actually participated; both routes copy that one record, and byte-equality holds by construction.
+    // Same position as the scan route puts it, for the same reason as `policyVocabulary` above.
+    if (g.netPartners?.length) gverdictObj.netPartners = g.netPartners;
     gverdictObj.violations = gviol;
     if (gunevaluated.length) gverdictObj.unevaluated = gunevaluated;
     // ⟨0.27⟩ SPEC §4 `zeroMatch` — the same list the stderr lines above carry, in the machine channel,

package/scan-core.mjs

@@ -404,11 +404,26 @@ export function isTelemetryHost(hostLiteral) { return hostInSet(hostLiteral, TEL
 // Literals.netDestClass.
 export function netDestClass(hostLiteral, partners) {
   if (isTelemetryHost(hostLiteral)) return "known-telemetry";
-  const host = normHost(hostLiteral);
-  const partnerMatch = partners && (partners.has(host) || [...partners].some((p) => host.endsWith("." + p)));
-  if (partnerMatch || isModelHost(hostLiteral)) return "known-partner";
+  if (partnerFor(hostLiteral, partners) !== null || isModelHost(hostLiteral)) return "known-partner";
   return "unknown-host";
 }
+/**
+ * ⟨0.31⟩ WHICH declared partner a host matched, or null — the SAME match `netDestClass` decides on,
+ * extracted so the DISCLOSURE and the DECISION cannot use different rules.
+ *
+ * That is not a stylistic preference. The first attempt at the `net-partner` disclosure re-implemented
+ * this match and normalised differently from the classifier — `partner.example:443` never equalled the
+ * declared `partner.example` — so the disclosure came back SILENTLY EMPTY on every real run while the
+ * verdict it was reporting on had flipped. A disclosure normalised differently from the decision it
+ * reports can only be wrong, and the way to make that impossible is one function with two callers.
+ */
+export function partnerFor(hostLiteral, partners) {
+  if (!partners || !partners.size) return null;
+  const host = normHost(hostLiteral);
+  if (partners.has(host)) return host;
+  for (const p of partners) if (host.endsWith("." + p)) return p;
+  return null;
+}
 // ⟨0.20⟩ The closed `Net` destination-class vocabulary, for the `deny Net[<dest…>]` policy filter.
 export const NET_DEST_CLASSES = ["known-telemetry", "known-partner", "unknown-host"];
 // ⟨0.20⟩ The `Net` destination classes an fn reaches — the SINGLE derivation shared by the report's

package/scan.mjs

@@ -34,7 +34,7 @@ import { parsePolicy, evaluatePolicy, scopeMatches, parseUnknownAliases, parseNe
 import { unverifiedHoleRule, ruleUpgrade, byCodePoint, claimsToHaveJudgedNothing, reportCorruptKeys, entryCorruptKeys } from "./query-core.mjs";
 import { printAgents, writeStdoutSync } from "./contract.mjs";
 import { isTestPath, kappa, kappaKnows, fsKind, commandHeadEffects, hostLiteral, tablesInSql,
-         modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf } from "./scan-core.mjs";
+         modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf, partnerFor } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -45,7 +45,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.30";
+const SPEC_VERSION = "0.31";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -489,7 +489,30 @@ const failClosedReportDoc = (reason) => {
   const esc = (s) => String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/[\n\r]/g, " ");
   return `{\n "candor": {\n  "version": "candor-ts-${PKG_VERSION}",\n  "toolchain": "node-${process.versions.node}",\n  "spec": "${SPEC_VERSION}"\n },\n "functions": [],\n "analyzed": { "count": 0 },\n "unanalyzed": [\n  { "path": "<run>", "reason": "${esc(reason)}" }\n ]\n}`;
 };
-const refuseEarlyToStream = (why) => {
+// ⟨0.31⟩ The gate sink this run ARMED, and the ONLY path `refuseEarly` may overwrite.
+//
+// The first version of that helper wrote straight to `preGateSink`, which broke the ⟨0.28⟩ rule it sits
+// beside: a `--gate-json` naming a source file under the scan target is REFUSED and nothing is written
+// there, precisely so arming cannot destroy the source it is about to scan. Writing the refusal document
+// to the same path bypassed that guard and truncated the fixture's own source — six ⟨0.28⟩ rows caught
+// it. A refusal may replace this run's OWN placeholder; it may not write anywhere the arming declined to.
+let armedGateSink = null;
+const refuseEarly = (why) => {
+  // ⟨0.31⟩ A FILE `--gate-json` SINK GETS THE REASON TOO, and until now it did not: this only ever
+  // wrote to STREAM sinks, so a run refusing with `--gate-json g.json` left the ARMING STUB in place —
+  // "the gate did not complete — this document was written when the run STARTED and was never replaced
+  // … the run failed, crashed or was killed". That describes a crash. This run did none of those things;
+  // it deliberately refused, and it knows exactly why.
+  //
+  // ⟨0.24⟩ pins the refusal document's `reason` as a string NAMING THE CAUSE, and a false description is
+  // rated worse here than a missing one — an operator reading "crashed" goes looking for a crash. The
+  // stub is the right answer only while the run's fate is genuinely unknown; once it has decided to
+  // refuse, leaving the stub is a stale document, which is the thing this whole sink exists to prevent.
+  if (armedGateSink) {
+    try {
+      fs.writeFileSync(armedGateSink, JSON.stringify(refusalVerdict(SPEC_VERSION, why, null), null, 1) + "\n");
+    } catch { /* an unwritable sink is already refused elsewhere; never mask the real cause with this */ }
+  }
   if (preGateSink === "-") console.log(JSON.stringify(refusalVerdict(SPEC_VERSION, why, null), null, 1));
   else if (preWantJson && !reportStreamWritten) {
     // Skipped when stdout is already claimed by `--gate-json -` (the two-stream case is refused
@@ -770,7 +793,7 @@ const disarmUnwrittenOutReports = () => {
       console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as ${flag} ${other} — refusing `
         + `(exit 2). The verdict is armed before the policy is read, so this would overwrite your policy `
         + `and then gate on the wreckage. Nothing was written; give the verdict its own path.`);
-      refuseEarlyToStream(`--gate-json ${gate} names the same file as ${flag} ${other}`);
+      refuseEarly(`--gate-json ${gate} names the same file as ${flag} ${other}`);
       process.exit(2);
     }
   }
@@ -782,7 +805,7 @@ const disarmUnwrittenOutReports = () => {
       + `about to read and then scan the wreckage. A non-source sink under the target `
       + `(${path.join(targetContainmentRoot(preTarget) ?? ".", ".candor", "verdict.json")}, say) is the `
       + `recommended layout and stays permitted.`);
-    refuseEarlyToStream(`--gate-json ${gate} is a source file under the scan target ${preTarget}`);
+    refuseEarly(`--gate-json ${gate} is a source file under the scan target ${preTarget}`);
     process.exit(2);
   }
   // `.candor/config` is never a verdict sink, wherever it is. The per-input checks above can only name
@@ -795,13 +818,13 @@ const disarmUnwrittenOutReports = () => {
       console.error(`candor-ts: --gate-json ${gate} is a .candor/config — refusing (exit 2). The verdict `
         + `is armed before the config is read, so this would destroy the config that configures this `
         + `run. Nothing was written; give the verdict its own path.`);
-      refuseEarlyToStream(`--gate-json ${gate} is a .candor/config`);   // ⟨0.28⟩ report stream too
+      refuseEarly(`--gate-json ${gate} is a .candor/config`);   // ⟨0.28⟩ report stream too
       process.exit(2);
     }
   }
   if (gate && singleSink && sameArtifact(gate, process.env.CANDOR_CONFIG)) {
     console.error(`candor-ts: --gate-json ${gate} names the SAME FILE as CANDOR_CONFIG — refusing (exit 2).`);
-    refuseEarlyToStream(`--gate-json ${gate} names the same file as CANDOR_CONFIG`);   // ⟨0.28⟩
+    refuseEarly(`--gate-json ${gate} names the same file as CANDOR_CONFIG`);   // ⟨0.28⟩
     process.exit(2);
   }
   // ⟨0.28⟩ A REPEATED `--gate-json` IS REFUSED, AND EVERY PATH NAMED GETS THE REFUSAL. Placed after the
@@ -856,7 +879,7 @@ const disarmUnwrittenOutReports = () => {
       if (bad) offending.add(g);
     }
     if (offending.size === distinct.length) {
-      refuseEarlyToStream(`every named --gate-json path collides with an input`);   // ⟨0.28⟩ report stream
+      refuseEarly(`every named --gate-json path collides with an input`);   // ⟨0.28⟩ report stream
       process.exit(2);
     }
   }
@@ -878,7 +901,7 @@ const disarmUnwrittenOutReports = () => {
     // (its verdict arm keys on `preGateSink === "-"` and doesn't know one was just printed). When `-`
     // isn't in the list, refuseEarlyToStream's report arm handles the `--json` case; when it is, the
     // verdict is already there and `--json` was refused earlier (line 333), so nothing more is owed.
-    if (!distinct.includes("-")) refuseEarlyToStream(`--gate-json was given more than once (${list})`);
+    if (!distinct.includes("-")) refuseEarly(`--gate-json was given more than once (${list})`);
     process.exit(2);
   }
   if (gate && gate !== "-") armGateJsonFailClosed(gate);
@@ -932,7 +955,7 @@ const disarmUnwrittenOutReports = () => {
       const inputs = runInputs(preTarget, policy);
       for (const p of namedOuts) armOutPrefixFailClosed(p, inputs);
     }
-    refuseEarlyToStream(`--out was given more than once (${list}) — a run writes one report set to one prefix`);
+    refuseEarly(`--out was given more than once (${list}) — a run writes one report set to one prefix`);
     process.exit(2);
   }
   if (preOut && !preWantJson) armOutPrefixFailClosed(preOut, runInputs(preTarget, policy));
@@ -957,7 +980,7 @@ for (let i = 0; i < argv.length; i++) {
     const v = argv[i + 1];
     if (v === undefined || v.startsWith("--")) {
       console.error(`candor-ts: ${a} requires a value (${usage})`);
-      refuseEarlyToStream(`${a} requires a value`);
+      refuseEarly(`${a} requires a value`);
       process.exit(2);
     }
     if (a === "--out") outPrefix = v; else if (a === "--policy") policyPath = v; else gateJsonPath = v;
@@ -971,21 +994,21 @@ for (let i = 0; i < argv.length; i++) {
     console.error(`candor-ts: unknown flag ${a} (${usage})`);
     // ⟨0.27⟩ §3.3 names an unknown flag as a broken-gate-config exit-2 cause; the stream sink gets the
     // refusal document too (see refuseEarlyToStream — the file sink is already armed).
-    refuseEarlyToStream(`unknown flag ${a}`);
+    refuseEarly(`unknown flag ${a}`);
     process.exit(2);
   }
   else if (target === null) target = a;
   else if (outPrefix === null) outPrefix = a; // legacy positional prefix
   else {
     console.error(`candor-ts: unexpected extra argument ${a} (${usage})`);
-    refuseEarlyToStream(`unexpected extra argument ${a}`);
+    refuseEarly(`unexpected extra argument ${a}`);
     process.exit(2);
   }
 }
 if (wantAgents) { printAgents(); process.exit(0); }
 if (target === null) {
   console.error(usage);
-  refuseEarlyToStream("no scan target");
+  refuseEarly("no scan target");
   process.exit(2);
 }
 
@@ -1092,7 +1115,7 @@ function enforceEnginePin(targetPath) {
   // duplicate put TWO documents on the stream — which parses as neither. The other branch (a build that
   // cannot determine its own release) RETURNS rather than exiting: disclosed, not scored, so no refusal
   // belongs there.
-  refuseEarlyToStream(`.candor/config pins engine ${pin}, which this build does not satisfy`);
+  refuseEarly(`.candor/config pins engine ${pin}, which this build does not satisfy`);
   process.exit(2);
 }
 
@@ -1136,7 +1159,7 @@ function loadCandorConfig(targetPath, { lenient = false } = {}) {
       // The config is the EARLIEST exit-2 cause, and the one the stream sink is least likely to be
       // armed for — which is exactly why it was the last one still leaving stdout empty. Found by
       // PART 36 (b11), a row written before this line was.
-      refuseEarlyToStream(`CANDOR_CONFIG set but ${file} is not a readable file`);
+      refuseEarly(`CANDOR_CONFIG set but ${file} is not a readable file`);
       process.exit(2);
     }
   } else {
@@ -1148,7 +1171,7 @@ function loadCandorConfig(targetPath, { lenient = false } = {}) {
   catch (e) {
     if (lenient) throw new Error(`config ${file} exists but could not be read (${e.message})`);
     console.error(`candor-ts: config ${file} exists but could not be read (${e.message}) — failing (exit 2)`);
-    refuseEarlyToStream(`config ${file} exists but could not be read`);
+    refuseEarly(`config ${file} exists but could not be read`);
     process.exit(2);
   }
   const cfg = {};
@@ -1230,6 +1253,7 @@ function writeSinkAtomic(p, text) {
 }
 
 function armGateJsonFailClosed(p) {
+  armedGateSink = p;   // ⟨0.31⟩ this path is now ours to replace if the run refuses
   try {
     writeSinkAtomic(p, JSON.stringify({
       spec: SPEC_VERSION, ok: false, refused: true,
@@ -1323,18 +1347,37 @@ if (!stat) {
   // RETURNS — it is not a `Never`, and calling it INSTEAD of the exit lets the run continue past its
   // own refusal (measured, while getting this wrong: an unreadable dep wrote its refusal and then
   // exited 0). rust's equivalent is typed `-> !`, which is why the same slip could not happen there.
-  refuseEarlyToStream(`no such path: ${target}`);
+  refuseEarly(`no such path: ${target}`);
   process.exit(2);
 }
 let usedTsconfig = null;   // the tsconfig this run actually read, so a later disclosure can name the
                            // cause that APPLIES rather than the one that usually does.
+// ⟨0.31⟩ THE one admission rule. The directory walk had it inline and the single-file branch had none,
+// which is how a target this engine cannot read reached a green verdict. `.d.ts` is excluded because a
+// declaration carries no body to analyse, and `.min.js` because a minified bundle is not a source.
+const admitsAsSource = (name) =>
+  (/\.[mc]?tsx?$/.test(name) && !name.endsWith(".d.ts"))
+  || (allowJs && /\.[mc]?jsx?$/.test(name) && !/\.min\.js$/.test(name));
+
 if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.dirname(path.resolve(target));
   usedTsconfig = path.resolve(target);
   fileNames = fromTsconfig(path.resolve(target), rootDir);
 } else if (stat.isFile()) {
   rootDir = path.dirname(path.resolve(target));
-  fileNames = [path.resolve(target)];
+  // ⟨0.31⟩ A SINGLE-FILE TARGET IS ADMITTED BY THE SAME RULE AS A FILE INSIDE A DIRECTORY, and this
+  // branch used to admit it UNCONDITIONALLY. MEASURED: `candor-ts x.txt --policy p` printed
+  // `policy ✓` and exited 0 with `ok: true` over a file this engine cannot read — the compiler
+  // silently dropped it and `NO_SOURCES` was false because the name was in the list. rust, java and
+  // swift all refuse the same input at exit 2.
+  //
+  // That is precisely the §3.3 ⟨0.31⟩ cause this rung adds — "the walk admitted no file this engine
+  // can read" — answered with a green gate, in the release that introduces the clause. A typo'd path
+  // in CI (`--policy` pointed at a file, a glob that matched a README) is a permanent pass.
+  //
+  // Single-file targets remain supported: a real `.ts` still scans. What changed is that the file has
+  // to be one this engine parses, which is what the directory walk always required.
+  fileNames = admitsAsSource(path.basename(target)) ? [path.resolve(target)] : [];
 } else {
   rootDir = path.resolve(target);
   const tsconfig = path.join(rootDir, "tsconfig.json");
@@ -1348,8 +1391,7 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
         const p = path.join(d, ent.name);
         if (!IS_PEEK && isTestPath(path.relative(rootDir, p))) continue;   // ⟨0.29⟩ see IS_PEEK
         if (ent.isDirectory()) walk(p);
-        else if (/\.[mc]?tsx?$/.test(ent.name) && !ent.name.endsWith(".d.ts")) fileNames.push(p);
-        else if (allowJs && /\.[mc]?jsx?$/.test(ent.name) && !/\.min\.js$/.test(ent.name)) fileNames.push(p);
+        else if (admitsAsSource(ent.name)) fileNames.push(p);
       }
     })(rootDir);
   }
@@ -1397,13 +1439,43 @@ const EXCLUDED_REASON = {
     + "analyzed — a file your build excludes may still run in CI or at install time",
   "not-a-parsed-source": "not in this run's parse set",
 };
-if (fileNames.length === 0) {
+// ⟨0.30⟩ NO ANALYZABLE SOURCE IS STILL A REASON TO LOOK AT WHAT WAS EXCLUDED.
+//
+// This refusal used to exit here, before the peek existed in the run at all. Measured on the PUBLISHED
+// 0.30.0: a declarations-only package whose `.js` performs the denied effect answered `no TypeScript
+// sources`, exit 2, and named NOTHING — while candor-rust, over the analogous shape (no `.rs` sources, a
+// `build.rs` running `curl`), reached its peek and named `build::main performs Exec`. Both fail closed,
+// so no gate went green; but naming the function IS this rung's premise, and whether a user got names
+// turned on where a package happens to keep its declarations — `axios` ships `index.d.ts` at the root and
+// got 13 findings, `ky` ships them under `distribution/` and got a bare refusal.
+//
+// So: when a policy is configured and there IS something excluded to look at, the run continues to the
+// peek and the findings are named. The refusal itself does not move — see the NO_SOURCES arm beside the
+// other exit-2 causes at the end of this file. THAT ORDER IS THE WHOLE CARE POINT: the first version of
+// this change let the run fall through to a normal ending, and a clean-sibling tree — zero files
+// analyzed, nothing wrong in the excluded `.js` — answered `policy ✓` at EXIT 0. A green over a tree the
+// engine never read is the cardinal sin, introduced by a disclosure fix, and it was caught by writing
+// that control fixture BEFORE the fix rather than after.
+const NO_SOURCES = fileNames.length === 0;
+if (NO_SOURCES && !(policyPath && excludedFiles.length)) {
   console.error(`candor-ts: no TypeScript sources under ${target}`);
+  // §3.3(d) MUST: the refusal names what a target of this engine's kind looks like. Without it the
+  // message says only that something is wrong, and the commonest cause — a path that moved, or one
+  // pointing at a file this engine does not parse — has an obvious fix the reader is left to guess.
+  console.error(`        candor-ts reads .ts/.tsx/.mts/.cts (and .js with --allow-js) — point it at a `
+              + `project directory or a TypeScript file. Exit 2 (unevaluable): a target this engine `
+              + `cannot read is not a clean scan.`);
   // An empty scan is an exit-2 cause like any other: a consumer reading the stream after it must not
   // get nothing. §3.1 exempts no cause, and this one is easy to hit in CI (a path that moved).
-  refuseEarlyToStream(`no TypeScript sources under ${target}`);
+  refuseEarly(`no TypeScript sources under ${target} — candor-ts reads .ts/.tsx/.mts/.cts `
+            + `(and .js with --allow-js); point it at a project directory or a TypeScript file. `
+            + `Exit 2 (unevaluable): a target this engine cannot read is not a clean scan.`);
   process.exit(2);
 }
+if (NO_SOURCES) {
+  console.error(`candor-ts: no TypeScript sources under ${target} — reading what this scan excluded, `
+    + `because a policy is configured and there are excluded files to look at`);
+}
 // Builtin typings FALLBACK: the engine ships @types/node as its own dependency, so a target that
 // hasn't installed it still resolves node:fs/node:net/… (found by the first npx-distribution
 // probe: a bare fixture read Unknown for fs.readFileSync because nothing supplied the builtin
@@ -1436,7 +1508,7 @@ if (!wantJson) {
         console.error(`candor-ts: the report set at --out ${outPrefix} includes ${w}, which is the SAME `
           + `FILE as ${label} ${other} — refusing (exit 2). Writing the report there would destroy an `
           + `input of this run. Nothing was scanned; give the report set its own prefix.`);
-        refuseEarlyToStream(`the report set at ${outPrefix} would overwrite ${label} ${other}`);
+        refuseEarly(`the report set at ${outPrefix} would overwrite ${label} ${other}`);
         process.exit(2);
       }
     }
@@ -1944,7 +2016,7 @@ const corruptDepPkgs = new Set();
       // The TOKEN arm needed this too. The read and parse arms below were routed to the stream and this
       // one was not — three exits for one rule, two of them answered on the machine channel and one
       // silent, which a conformance row (PART 36 b8) caught immediately once the cause was posed at all.
-      refuseEarlyToStream(`configured dependency ${tok} is not a readable file or directory`);
+      refuseEarly(`configured dependency ${tok} is not a readable file or directory`);
       process.exit(2);
     }
   }
@@ -1968,7 +2040,7 @@ const corruptDepPkgs = new Set();
       console.error(`        failing (exit 2, unevaluable). A configured dep this scan cannot read is not`);
       console.error(`        reduced coverage: its callers would serialise \`inferred: []\`, a purity claim`);
       console.error(`        about code this scan never saw.`);
-      refuseEarlyToStream(`configured dependency report ${f} could not be read`);
+      refuseEarly(`configured dependency report ${f} could not be read`);
       process.exit(2);
     }
     let parsed;
@@ -1978,7 +2050,7 @@ const corruptDepPkgs = new Set();
       console.error(`candor-ts: CANDOR_DEPS report ${f} is not valid JSON —`);
       console.error(`        failing (exit 2, unevaluable). Same reason as an unreadable one: a report`);
       console.error(`        that cannot be parsed makes no claim, and continuing would publish one.`);
-      refuseEarlyToStream(`configured dependency report ${f} is not valid JSON`);
+      refuseEarly(`configured dependency report ${f} is not valid JSON`);
       process.exit(2);
     }
     try {
@@ -3463,6 +3535,74 @@ function enclosing(node) {
 // and the whole-module Net rule paints them — but console fd 0/1/2 I/O is not Net (§1 has no Console effect).
 // `net.Socket.on`/`.write` return the stream (`this`), so a chained call's receiver is still the std stream;
 // the exact-string check missed it (the receiver is the inner CallExpression). Walk the chain to its head.
+// R54 — THE STD-STREAM CARVE-OUT, DECIDED FROM THE RECEIVER'S TYPE RATHER THAN ITS SPELLING.
+//
+// `rootsAtStdStream` above matches the TEXT of the receiver chain, so it only ever recognised
+// `process.stdout.write(...)` written literally. MEASURED on `execa` in the ⟨0.30⟩ blast-radius sweep:
+// one level of indirection defeats it —
+//
+//     const pick = fd => (fd === 1 ? process.stdout : createWriteStream("", {fd}));
+//     pick(3).write("hello");     // charged Net, netClass unknown-host. There is no socket.
+//
+// The receiver types as `tty.WriteStream | fs.WriteStream`, `tty.WriteStream` EXTENDS `net.Socket`, so
+// resolving `.write` lands in the net cluster's typings and the whole-module Net rule paints it. It
+// accounted for 2 of the 31 ⟨0.30⟩ verdict flips — the only two of that sweep that were not genuine.
+//
+// DENYLIST, NOT ALLOWLIST, and the direction is stated so it can be checked: this suppresses Net ONLY
+// when EVERY constituent of the receiver's type is a PROVEN non-network stream class. An unknown
+// constituent, an `any`, a project type, or a real `net.Socket` all fail the test and KEEP the charge.
+// The failure mode is therefore an over-report, never a false all-clear.
+//
+// THE SAFE SET IS CONCRETE CLASSES ONLY. `stream.Writable`/`Readable` are deliberately ABSENT: a real
+// `net.Socket` IS a `stream.Duplex` and therefore satisfies them, so admitting the base types would
+// suppress Net on genuine sockets — the exact silent under-report this family has measured arriving in
+// 4 of 5 over-charge fixes. Only `tty`/`fs` stream classes, and only when declared in @types/node's own
+// `tty.d.ts`/`fs.d.ts`, so a project class named `WriteStream` cannot buy the carve-out.
+const SAFE_STREAM_CLASSES = new Set(["WriteStream", "ReadStream"]);
+// `process` is in the set because that is where @types/node DECLARES the std streams' own
+// `WriteStream`/`ReadStream` (process.stdout is `WriteStream & { fd: 1 }`, declared in process.d.ts and
+// extending tty's). Measured: without it the predicate rejected the very case it exists for.
+const SAFE_STREAM_MODULES = new Set(["tty", "fs", "process"]);
+function receiverIsProvenNonNetworkStream(expr) {
+  if (!expr) return false;
+  let t;
+  try { t = checker.getTypeAtLocation(expr); } catch { return false; }
+  if (!t) return false;
+  const parts = (t.isUnion && t.isUnion()) ? t.types : [t];
+  if (!parts.length) return false;
+  // INTERSECTIONS CARRY NO SINGLE SYMBOL, and every real case here is one: `process.stdout` types as
+  // `tty.WriteStream & { fd: 1 }`, and the helper's union is `(WriteStream & {fd:1}) | WriteStream`.
+  // The first attempt asked each union part for its symbol, got none for the intersection, and
+  // suppressed nothing — measured, before this comment existed.
+  const flatten = (ty) => (ty.isIntersection && ty.isIntersection()) ? ty.types : [ty];
+  const declaredSafely = (sym) => {
+    const decls = sym.getDeclarations?.() ?? [];
+    if (!decls.length) return false;
+    return decls.every((d) => {
+      const f = path.resolve(d.getSourceFile().fileName);
+      const m = f.match(/@types\/node\/(.+?)\.d\.ts$/);
+      return !!m && SAFE_STREAM_MODULES.has(m[1]);
+    });
+  };
+  return parts.every((part) => {
+    let sawSafe = false;
+    for (const member of flatten(part)) {
+      const sym = member.getSymbol?.() ?? member.symbol;
+      const name = sym?.getName?.();
+      // An ANONYMOUS shape (`{ fd: 1 }`) carries no class identity: it neither proves nor disproves,
+      // so it is skipped. If EVERY member is anonymous, `sawSafe` stays false and the charge is kept.
+      // TypeScript names anonymous shapes SYNTHETICALLY — `__type` for a type literal,
+      // `__object` for an object literal — so `!name` alone does not skip them and the
+      // `{ fd: 1 }` half of `process.stdout`'s intersection fell through to the rejection
+      // below. Measured: this is what still suppressed nothing after the intersection fix.
+      if (!name || name.startsWith("__")) continue;
+      if (!SAFE_STREAM_CLASSES.has(name) || !declaredSafely(sym)) return false;
+      sawSafe = true;
+    }
+    return sawSafe;
+  });
+}
+
 function rootsAtStdStream(expr) {
   let e = expr;
   for (;;) {
@@ -4848,6 +4988,14 @@ function visitCalls(node) {
           if (eff && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
               && rootsAtStdStream(node.expression.expression))
             eff = null;
+          // R54 — the same carve-out through a helper, decided from the receiver's TYPE. SCOPED TO Net
+          // DELIBERATELY: an `fs.WriteStream` receiver legitimately carries Fs, and suppressing whatever
+          // effect happened to resolve would swallow that — the same under-report one door along. Only
+          // the fabricated network charge is removed.
+          if (eff === "Net"
+              && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))
+              && receiverIsProvenNonNetworkStream(node.expression.expression))
+            eff = null;
           if (eff) {
             rec.direct.add(eff);
             // SPEC §2 `fs` — refine an Fs we just PROVED with the direction its verb implies. DIRECT only
@@ -6092,6 +6240,8 @@ for (const m of ["hosts", "tables", "cmds", "paths", "blind", "incomplete", "fsK
 // nothing for the rest of the run. Printed once, here, beside the other config diagnostics.
 const netPartnerErrs = [];
 const netPartners = parseNetPartners(discoverConfigText(target), netPartnerErrs);
+// ⟨0.31⟩ the declared partners that actually MOVED a classification in this run — see the envelope key.
+const partnersUsed = new Set();
 for (const e of netPartnerErrs) console.error(`candor-ts: ${e.why} — ${e.raw}`);
 const functions = [];
 for (const [name, rec] of fns) {
@@ -6123,7 +6273,16 @@ for (const [name, rec] of fns) {
   // ⟨0.20⟩ Net destination-class (NET-DESTINATION-CLASS-DESIGN.md): the classes present in this fn's
   // transitive Net surface — exact host-literal match, fail-closed unknown-host on a masked surface (rec
   // .incomplete has Net) OR a Net with no visible host. The class travels the call graph like the effect.
-  if (inf.includes("Net")) entry.netClass = netClassesOf([...rec.hosts], rec.incomplete.has("Net"), netPartners);
+  if (inf.includes("Net")) {
+    entry.netClass = netClassesOf([...rec.hosts], rec.incomplete.has("Net"), netPartners);
+    // ⟨0.31⟩ RECORD WHICH DECLARED PARTNER PARTICIPATED, at the point the class is decided. Asking
+    // `partnerFor` — the function `netDestClass` itself asks — is what keeps the disclosure and the
+    // decision on one rule; the reverted first attempt re-matched and normalised differently.
+    for (const h of rec.hosts) {
+      const pm = partnerFor(h, netPartners);
+      if (pm) partnersUsed.add(pm);
+    }
+  }
   if (inf.includes("Db") && rec.tables.size) entry.tables = [...rec.tables].sort();
   if (inf.includes("Exec") && rec.cmds.size) entry.cmds = [...rec.cmds].sort();
   if (inf.includes("Fs") && rec.paths.size) entry.paths = [...rec.paths].sort();
@@ -6566,7 +6725,7 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     // ⟨0.28⟩ report stream: this exit-2 fires BEFORE the envelope is printed, so a `--json` run would
     // otherwise leave stdout empty for the whole class of trust-marker contradictions. The latch is
     // still unset at this point; the helper writes the fail-closed doc as stdout's only content.
-    refuseEarlyToStream(`${contradictions.length} report entr${contradictions.length === 1 ? "y contradicts its" : "ies contradict their"} own trust markers`);
+    refuseEarly(`${contradictions.length} report entr${contradictions.length === 1 ? "y contradicts its" : "ies contradict their"} own trust markers`);
     process.exit(2);
   }
 }
@@ -6631,6 +6790,26 @@ if (uncoveredLedger.length) {
 // and NOT cross-engine comparable — qualifiers differ). ALWAYS present.
 const analyzedQuals = [...fns.keys()].sort();
 envelope.analyzed = { count: fns.size, digest: fnv1aHex(analyzedQuals) };
+// ⟨0.31⟩ `netPartners` — WHICH ambient `.candor/config` declared a partner, and which of its hosts
+// actually participated. MEASURED: `deny Net[unknown-host]` over a call to `partner.example` exits 1;
+// adding `net-partner partner.example` to `.candor/config` exits 0 with `ok:true`, and nothing in the
+// verdict named the file, its path, or the host. An operator reading that green could not tell an
+// ambient file turned a red into it — the same failure §3.1's `policyVocabulary` exists to refuse for
+// `unknown-alias`, whose argument reaches this key and whose MUST did not.
+//
+// IT LIVES IN THE REPORT, and that is what makes it emittable at all. `net-partner` anchors at the
+// TARGET, and `gate --report` has no target — it reads the producer's already-computed `netClass`. A
+// verdict-only disclosure is therefore computable on one route and not the other, which breaks §3.1's
+// byte-equality and is exactly why the first attempt was reverted (candor-ts's own suite: "pure: NOT
+// byte-equal"). Recorded by the PRODUCER, both routes read the same source, and they agree by
+// construction — the shape ⟨0.30⟩'s `outOfScope` already uses for the same structural reason.
+//
+// Omitted when empty, so a project declaring no partners — or declaring some that never matched — is
+// byte-identical to a pre-rung report. A declaration that changed nothing is not provenance.
+if (partnersUsed.size) {
+  const cfg = discoverConfigPath(target);
+  if (cfg) envelope.netPartners = { config: cfg, hosts: [...partnersUsed].sort() };
+}
 // ⟨0.21⟩ COMPLETENESS MANIFEST (Gap 2): the target's own source candor could NOT analyze (unparsed .ts).
 // OMITTED when empty — a complete scan stays byte-identical to a pre-rung report — so a MACHINE reading
 // --json sees the incompleteness the stderr warning alone used to hide.
@@ -6701,6 +6880,30 @@ if (policyPath && excludedFiles.length) {
   // passed at exit 0 while the strictly weaker `deny Exec` exited 2 on the same files. MEASURED four-way.
   if ((peekPolicy?.deny ?? []).length) {
     outOfScopeFindings = [];
+    // ⟨0.31⟩ A FILE THIS ENGINE CANNOT READ CANNOT BE PEEKED, AND THE CLASS MUST SAY SO.
+    //
+    // MEASURED: an excluded file performing a denied `Fs`, with the policy `deny Fs`. Readable, the peek
+    // finds it and the gate exits 2 naming the function. `chmod 000` on that ONE file and the same run
+    // exits 0 with `ok: true`, `outOfScope: []` and `excluded: [{class: …, peeked: true}]` — byte-
+    // identical to a genuinely clean peek. The only difference between a red gate and a green one is
+    // whether the engine could open the file, and nothing in the report says so.
+    //
+    // The child's TypeScript program drops an unreadable file SILENTLY: no diagnostic, and no entry in
+    // `unanalyzed`, so the `peekUnread` accounting below never fires. candor-rust answers `peeked: false`
+    // on the same shape, so this was ts alone.
+    //
+    // Asked HERE, in the parent, because the parent is the process that decided these files are in the
+    // peek's scope and can check the premise directly. A file the parent cannot read is one the child
+    // cannot read either. This is ⟨0.26⟩'s manifest rule applied to the peek: a claim of completeness
+    // over a set requires having actually covered the set, and a PARTIAL peek publishing `peeked: true`
+    // answers worse than one that admits it read nothing.
+    for (const e of excludedFiles) {
+      try {
+        fs.accessSync(path.resolve(rootDir, e.path), fs.constants.R_OK);
+      } catch {
+        peekUnread.add(e.cls);   // its class withdraws the completeness claim; the gate stays cautious
+      }
+    }
     const peekDir = fs.mkdtempSync(path.join(os.tmpdir(), "candor-ts-peek-"));
     try {
       fs.writeFileSync(path.join(peekDir, "tsconfig.json"), JSON.stringify({
@@ -6721,10 +6924,62 @@ if (policyPath && excludedFiles.length) {
           stdio: ["ignore", "pipe", "ignore"] });
       const doc = JSON.parse(out);
       peekRead = true;   // the child returned a report this run could read — see `peekRead`
+      // ⟨0.31⟩ ONE LOOKUP FOR ALL THREE CALLERS. This was written THREE times — the matcher's
+      // qualifier, the finding's path, and the `unanalyzed`→`peekUnread` attribution below — and every
+      // copy carried the same defect:
+      //     find(e => loc.endsWith(e.path) || loc.endsWith(basename(e.path)))
+      // The `||` sits INSIDE one `.find`, so a BASENAME match on an earlier entry beats a FULL PATH
+      // match on a later one. MEASURED: with `src/one/dup.test.ts` and `src/two/dup.test.ts`, a
+      // function from `two` was disclosed at `one`. A previous fix collapsed two of the three copies
+      // and its commit message said so; the third survived here, where the failure mode is not a
+      // fabricated locator but CLASS MIS-ATTRIBUTION feeding `peeked` — worse in kind.
+      //
+      // AND SUFFIX MATCHING IS ITSELF THE BUG. The replacement tried "longest suffix wins" and argued
+      // no counterexample existed; here is one: a project directory literally NAMED `app`, holding
+      // `x.test.ts` and `app/x.test.ts`. The root file's absolute path `/…/app/x.test.ts` genuinely
+      // ends with the NESTED file's relative path `app/x.test.ts`, on a proper segment boundary, and
+      // it is the longer match — so the root function is disclosed at the nested file. A
+      // segment-boundary test would not have caught it either.
+      //
+      // So: RESOLVE, don't match. The child is handed absolute paths under `rootDir`, so its reported
+      // location relativises back to exactly the `e.path` this run recorded. Suffix and basename
+      // remain only as fallbacks for a child that reported something unrelativisable, and the basename
+      // one is used only when it names exactly ONE excluded file. When nothing resolves this returns
+      // null and the caller reports the child's own path — an ugly true locator beats a tidy false one.
+      const locateExcluded = (childLoc) => {
+        if (!childLoc) return null;
+        // RESOLVE AGAINST THE CHILD'S OWN ROOT. The child scan runs under a tsconfig in `peekDir`, and
+        // reports locations RELATIVE TO THAT — `../../../../../private/tmp/…/app/x.test.ts`. Resolving
+        // such a path against the parent's cwd yields nonsense, which is why the first attempt at an
+        // exact match never matched anything and quietly fell through to the suffix arm that carries
+        // the bug. Resolve against `peekDir`, then relativise to `rootDir`, and the result is exactly
+        // the `e.path` this run recorded.
+        const abs = path.resolve(peekDir, childLoc);
+        let rel = path.relative(rootDir, abs);
+        let exact = excludedFiles.find((e) => e.path === rel);
+        // …and once more through realpath, because macOS resolves `/tmp` to `/private/tmp` and a run
+        // invoked through the symlinked spelling would otherwise miss its own files.
+        if (!exact) {
+          try {
+            rel = path.relative(fs.realpathSync(rootDir), fs.realpathSync(abs));
+            exact = excludedFiles.find((e) => e.path === rel);
+          } catch { /* the file may not exist from here; fall through to the suffix arms */ }
+        }
+        if (exact) return exact;
+        let best = null;
+        for (const e of excludedFiles) {
+          const sfx = path.sep + e.path;
+          if ((childLoc === e.path || childLoc.endsWith(sfx) || childLoc.endsWith("/" + e.path))
+              && (!best || e.path.length > best.path.length)) best = e;
+        }
+        if (best) return best;
+        const base = path.basename(childLoc);
+        const byBase = excludedFiles.filter((e) => path.basename(e.path) === base);
+        return byBase.length === 1 ? byBase[0] : null;
+      };
       for (const u of Array.isArray(doc.unanalyzed) ? doc.unanalyzed : []) {
         const where = String(u?.path ?? "");
-        const hit = excludedFiles.find((e) => where.endsWith(e.path)
-                                           || where.endsWith(path.basename(e.path)));
+        const hit = locateExcluded(where);
         // The peek walks ONLY excluded files, so an unread path matching no exclusion is one this code
         // cannot attribute — fail closed across every class rather than let one unattributable file leave
         // all of them claiming completeness.
@@ -6769,8 +7024,7 @@ if (policyPath && excludedFiles.length) {
       // the finding below is already named from it. The MATCHER must see the same thing the FINDING does.
       const relQual = (f) => {
         const childLoc = (f.loc ?? "").split(":")[0] ?? "";
-        const hit = excludedFiles.find((e) => childLoc.endsWith(e.path)
-                                           || childLoc.endsWith(path.basename(e.path)));
+        const hit = locateExcluded(childLoc);
         if (!hit) return f.fn;
         const stem = hit.path.replace(/\.[cm]?[jt]sx?$/, "").split(path.sep).join(".");
         const leaf = f.fn.split(".").pop() ?? f.fn;
@@ -6793,8 +7047,7 @@ if (policyPath && excludedFiles.length) {
         // exists by the time anyone reads it. The project-relative path is already known here (it is
         // what was excluded), so match on basename and report the path we already trust.
         const childLoc = (f.loc ?? "").split(":")[0] ?? "";
-        const hit = excludedFiles.find((e) => childLoc.endsWith(e.path)
-                                           || childLoc.endsWith(path.basename(e.path)));
+        const hit = locateExcluded(childLoc);
         const where = hit?.path ?? childLoc;
         const cls = hit?.cls ?? "excluded";
         outOfScopeFindings.push({
@@ -6816,6 +7069,31 @@ if (policyPath && excludedFiles.length) {
     }
   }
 }
+// ⟨0.30⟩ NOTHING ANALYZABLE, AND THE PEEK FOUND NOTHING EITHER: REFUSE — AND REFUSE BEFORE AN ENVELOPE
+// EXISTS. The peek above is the whole reason this run got past the early refusal; if it named something,
+// the ⟨0.30⟩ arm at the end reports it and exits 2 with `outOfScope` IN the report, so `gate --report` over
+// that report reaches the same 2 and §3.1 holds. If it named nothing there is nothing to report, and the
+// run must go back to being a refusal.
+//
+// WHY HERE AND NOT AT THE END, measured: the first version of this change let the clean case fall through
+// to a normal ending and exit 2 from an arm after the verdict was written — so the process exited 2 while
+// `--gate-json` said `ok: true`, and `gate --report` over the report it left behind exited 0. The exit code
+// was right and the DOCUMENT was green; a SARIF consumer reads the document. §3.1's byte-equality is
+// quantified over "any report a scan produced", so the only safe refusal is one that produces no report at
+// all — once an envelope exists, the scan route owns the gate route's answer.
+if (NO_SOURCES && !(Array.isArray(outOfScopeFindings) && outOfScopeFindings.length)) {
+  console.error(`candor-ts: gate NOT certified — no analyzable TypeScript source under ${target}, and the `
+    + `files this scan excluded perform no effect this policy denies; a gate cannot be green over a tree `
+    + `it did not read`);
+  // §3.3(d) MUST — the same remedy the no-policy branch names. This arm explains WHY the gate is not
+  // certified and, without this, still leaves the reader to guess what a valid target looks like.
+  console.error(`        candor-ts reads .ts/.tsx/.mts/.cts (and .js with --allow-js) — point it at a `
+              + `project directory or a TypeScript file.`);
+  refuseEarly(`no analyzable TypeScript source under ${target} — candor-ts reads `
+            + `.ts/.tsx/.mts/.cts (and .js with --allow-js); point it at a project directory or a `
+            + `TypeScript file.`);
+  process.exit(2);
+}
 if (outOfScopeFindings) {
   envelope.outOfScope = outOfScopeFindings;
   // SAY IT ON STDERR TOO. The report block is for machines; an operator reading `policy ✓` needs to know
@@ -7434,6 +7712,11 @@ if (gateJsonPath) {
   // ⟨0.24⟩ the vocabulary file that moved the verdict, in the SAME position `gate --report` puts it, because
   // §3.1 makes byte-equality between the two routes the acceptance test. Omitted when no alias was used.
   if (policyVocabulary) verdictObj.policyVocabulary = policyVocabulary;
+  // ⟨0.31⟩ …and the partner declaration that moved it, COPIED FROM THE REPORT rather than recomputed.
+  // Copying is the point: `gate --report` cannot compute this (no target), so if the two routes derived
+  // it independently they could not agree. Reading the producer's record on both routes is what makes
+  // the byte-equality hold instead of break. Same position in both, for the same reason as the line above.
+  if (envelope.netPartners) verdictObj.netPartners = [envelope.netPartners];
   verdictObj.violations = gateViolations;
   // ⟨0.24⟩ …and when a certain violation DOMINATED a policy refusal, the refusal is disclosed here rather
   // than deleted (SPEC §3.1: "the RAW policy line, verbatim", one entry per rule, omitted when empty). A