candor-ts 0.30.0 → 0.32.0

package/query-core.mjs

@@ -11,7 +11,8 @@
 import fs from "node:fs";
 import nodePath from "node:path";
 import { reasonClass, REASON_CLASSES, DYNAMIC_CLASSES, resolveReasonClasses, reasonClassesMatch,
-         classFilterExcludes, netClassResolver, reportNetClasses, unanswerableScoped } from "./policy.mjs";
+         classFilterExcludes, netClassResolver, reportNetClasses, unanswerableScoped,
+         effectiveInferred, reportUnits } from "./policy.mjs";
 
 // Sibling report/callgraph files of a multi-report prefix (candor-scan writes <prefix>.<crate>.scan.json,
 // one per workspace member) — so the loaders read ANY engine's output, not just candor-ts's <prefix>.json.
@@ -37,7 +38,13 @@ function siblings(prefix, predicate) {
 // sibling is `.encountered-*`/`.calibrated.json` passes the existence check but loads ZERO functions →
 // an authoritative-empty result (silent under-report; review find). `.gate.json` has no functions array,
 // so merging it "disclosed a malformed report" on every query over the recommended CI layout — noisy, excluded.
-export const isReport = (f) => !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.endsWith(".locs.json") && !f.includes(".encountered-") && !f.endsWith(".calibrated.json") && !f.endsWith(".gate.json");
+// ⟨0.32⟩ `.refused.json` joins the reserved set (SPEC §2.2). It is a refusal MARKER, not a report — it
+// carries no `functions` array, and a prefix whose only sibling is one would otherwise pass the existence
+// check and load zero functions, which is the authoritative-empty silent under-report this predicate
+// exists to prevent. CAUGHT BY PART 56 the moment ⟨0.32⟩ landed in this engine: a refusal "left a report",
+// because discovery counted the marker the refusal had just written. Adding a file kind beside the
+// reports means teaching discovery about it in the same change.
+export const isReport = (f) => !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.endsWith(".locs.json") && !f.includes(".encountered-") && !f.endsWith(".calibrated.json") && !f.endsWith(".gate.json") && !f.endsWith(".refused.json");
 
 // A report exists at the prefix if there's an exact `<prefix>.json` (candor-ts) OR a sibling
 // `<prefix>.<crate>.scan.json` (the candor-scan/Rust multi-report form) — the loaders read both, so a
@@ -560,6 +567,13 @@ export function reportCompleteness(prefix) {
            noManifest: reportNoManifestFiles(prefix),
            // ⟨0.30⟩ the peek's findings, so an advisory verb keying `--strict` on this object is at least
            // as pessimistic as the gate over the same bytes (the ⟨0.24⟩ MUST).
+           // ⟨0.32⟩ …and the classes the producing scan never OPENED. This IS an arm of `mustHedge`
+           // below — see the ruling there. It used to read *"NOT an arm … the verbs `mustHedge` serves
+           // carry no policy, so there is nothing to condition it on"*, and that was overturned four-way
+           // on 2026-08-24. The two verbs that DO carry a policy (`fix-gate`, `unverified`) still read
+           // this field directly for their EXIT code and apply the gate's own condition to it: only a
+           // `deny`/`pure` rule's answer depends on code outside the scan's scope.
+           unread: reportUnread(prefix),
            ...(() => {
              const o = reportOutOfScope(prefix);
              // A corrupt key rides `unreadable`, which is ALREADY an arm of the strict exit — so the
@@ -581,10 +595,46 @@ export function reportCompleteness(prefix) {
  * claim it got LESS far than the gate on identical input, the mirror of the over-claim the strict exit
  * exists to prevent. So count-0 reaches both DISCLOSURE channels through this predicate and stops at the
  * exit code; see `advisoryAnswer`, whose exit-bearing callers key `--strict` on manifest + unreadable.
+ *
+ * ⟨0.32⟩ **AND `unread` IS AN ARM OF THIS — RULED 2026-08-24 AFTER A FOUR-WAY DIVERGENCE. DO NOT
+ * RE-LITIGATE IT HERE.** Over a report whose `excluded` names a class the scan never opened, `tour`
+ * printed the bare *"nothing hidden — every effect sits where its name says it should"* at exit 0 in
+ * this engine, candor-rust and candor-swift, while candor-java hedged and named the class. **candor-java
+ * was right.**
+ *
+ * **IT IS A DISCLOSURE, NOT A VERDICT, AND IT MUST NOT MOVE AN EXIT CODE** — which is why the arm is
+ * here and nowhere near the `--strict` predicate. ⟨0.24⟩'s advisory-verb pessimism MUST binds verbs that
+ * answer `ok`; `tour` answers none and has no exit-code obligation, so that clause does not reach it.
+ * What reaches it is SPEC §2 ⟨0.28⟩, which widens the re-disclosure MUST to *"any verb whose output
+ * could be read as a negative finding about the code — a verdict, an empty result set, or a zero
+ * count"*, and SPEC §3.1 ⟨0.18⟩, which already forbids THIS EXACT SENTENCE over a ≥⅓-Unknown graph. An
+ * unread exclusion class is the same ignorance arriving by a different route, and the ⅓ threshold
+ * structurally CANNOT see it: an unread unit contributes no entry, so it moves neither the numerator
+ * nor the denominator.
+ *
+ * **AND THE ARGUMENT THAT KEPT IT OUT WAS THE WRONG WAY ROUND.** Three engines reasoned *"these verbs
+ * carry no policy, so there is nothing to condition it on"*. The condition ⟨0.32⟩ states is the QUESTION
+ * IN FORCE, and a verb with no policy is not asking a NARROWER question than `deny Exec` — it is asking
+ * the widest one there is, the whole effect surface. A `deny`/`pure` rule's answer can depend on unread
+ * code; an `allow`/`forbid`/`only`/`layer` policy's answer cannot; a descriptive verb's answer always
+ * can.
+ *
+ * **THE TRIGGER IS THE GATE'S, MINUS THE POLICY CONDITION**: `peeked !== true` with no
+ * `judgedElsewhere`, off the same key through the same reader (`reportUnread`), `count` IGNORED —
+ * measured 2026-08-24, all four gates refuse over a `count: 0` unread class and certify over a
+ * `judgedElsewhere: true` one. One matcher, so a report that earns an unhedged `tour` is exactly a
+ * report `gate --report` can certify. The NOISE objection — this fires on nearly every no-policy report
+ * — is real, and it is answered by the REMEDY rather than by silence: scan with the policy, the peek
+ * reads the class, `peeked` turns true and the hedge goes away.
+ *
+ * **KNOWN RESIDUAL, stated rather than asserted away:** `peeked: true` means the class was READ, not
+ * ANALYZED — the peek looks only for effects the PRODUCER's policy denied — so an undenied effect inside
+ * a peeked class is still outside `tour`'s graph and outside this hedge. That is the gate's residual
+ * too (SPEC §2 ⟨0.32⟩ files it), and closing it is a rung, not a fix.
  */
 export const mustHedge = (c) => !!(c && (c.unanalyzed?.length || c.judgedNothing?.length
                                          || c.noManifest?.length || c.unreadable?.length
-                                         || c.outOfScope?.length));
+                                         || c.outOfScope?.length || c.unread?.length));
 
 /** ⟨0.30⟩ The peek's findings across the reports under a locator. Read leniently HERE (a malformed key is
  *  the gate's refusal to make, and this feeds a disclosure) but non-emptiness raises the same hedge the
@@ -616,6 +666,29 @@ export function reportOutOfScope(prefix) {
   return { findings: out, corrupt };
 }
 
+/** ⟨0.32⟩ The classes the producing scan never OPENED, across the reports under a locator — `excluded[]`
+ *  entries that are neither `peeked` nor `judgedElsewhere`, deduped, in report order.
+ *
+ *  LENIENT, like `reportOutOfScope` beside it and for the same reason: a malformed key is the GATE's
+ *  refusal to make (it reads the same bytes strictly, in `loadGateReport`, and NAMES the key), and this
+ *  feeds a disclosure. A non-boolean `peeked` is skipped here rather than trusted, so the leniency never
+ *  runs in the fail-open direction — `"peeked": "no"` is TRUTHY in this language, and a lenient reader that
+ *  simply believed it would turn an unread class into a peeked one. */
+export function reportUnread(prefix) {
+  const files = (prefix.endsWith(".json") && fs.existsSync(prefix)) ? [prefix] : reportFilesAt(prefix);
+  const out = new Set();
+  for (const f of files) {
+    try {
+      const d = JSON.parse(fs.readFileSync(f, "utf8"));
+      if (!Array.isArray(d?.excluded)) continue;
+      for (const e of d.excluded)
+        if (e && typeof e === "object" && typeof e.class === "string" && e.class
+            && e.peeked !== true && e.judgedElsewhere !== true) out.add(e.class);
+    } catch { /* unparseable TEXT is `unreadable`'s business, not this key's */ }
+  }
+  return [...out];
+}
+
 /**
  * ⟨0.28⟩ The disclosure KEYS, defined ONCE, for spreading into a verb's answer document — `{}` when there
  * is nothing to disclose, so `{ ...data, ...completenessFields(c) }` is byte-identical to `data` on a
@@ -649,6 +722,13 @@ export function completenessFields(c) {
   // safe under every cause. It is separate from `judgedNothing` because that key is pinned to "reports
   // declaring `analyzed.count: 0`" and a row-3 report declares nothing: merging them would make one key
   // mean two things and lose the distinction §2's three-row table exists to draw.
+  // ⟨0.32⟩ `unread` (an exclusion class nothing opened) raises the flag and adds NO key of its own
+  // either, by the same rule as `unreadable` one comment up — and deliberately, now that it hedges the
+  // descriptive verbs. candor-rust publishes an `unread` array on its ADVISORY documents and is the only
+  // engine that does (measured 2026-08-24: `fix-gate --json` over one unread report — rust
+  // `{"incomplete": true, "unread": […]}`, java and swift `{"incomplete": true}` alone). Minting it here,
+  // on six verbs where three engines publish nothing, is §3.3.1's "four independent guesses with a
+  // conformance failure scheduled". The prose note names the class; the flag is the wire surface.
   return { incomplete: true,
            ...(c.unanalyzed?.length ? { unanalyzed: c.unanalyzed } : {}),
            ...(c.judgedNothing?.length ? { judgedNothing: c.judgedNothing } : {}),
@@ -714,10 +794,11 @@ export const absorbCompleteness = (a, b) => ({
  * over-claim the strict exit exists to prevent. (`mustHedge` is the same distinction, stated for a verb
  * that has no exit code for it to matter to.)
  */
-export function advisoryAnswer(body, unanalyzed, judgedNothing = [], unreadable = [], noManifest = []) {
+export function advisoryAnswer(body, unanalyzed, judgedNothing = [], unreadable = [], noManifest = [],
+                               outOfScope = [], unread = []) {
   const unevaluated = body?.unevaluated;
   if (!unanalyzed?.length && !unevaluated?.length && !judgedNothing?.length && !unreadable?.length
-      && !noManifest?.length)
+      && !noManifest?.length && !outOfScope?.length && !unread?.length)
     return body;  // COMPLETE: unchanged, byte for byte, `ok` and all.
   const { ok, ...rest } = body;                          // eslint-disable-line no-unused-vars -- omitted BY DESIGN
   // The array of report paths, same key and same shape as `completenessFields` — ONE wire spelling for
@@ -728,10 +809,19 @@ export function advisoryAnswer(body, unanalyzed, judgedNothing = [], unreadable
   // never emitted a manifest cannot support it (row 3: *no manifest, no claim*).
   const judged = { ...(judgedNothing?.length ? { judgedNothing } : {}),
                    ...(noManifest?.length ? { noManifest } : {}) };
+  // ⟨0.30⟩/⟨0.32⟩ THE TWO SCOPE CAUSES — the ones the `--strict` exit has consulted since ⟨0.30⟩ while this
+  // document did not, which is the document/exit split in its worse direction. MEASURED 2026-08-24 on
+  // `fix-gate --strict` and `unverified --strict` over a report carrying `outOfScope`: BOTH printed
+  // `{"ok": true, …: []}` **at exit 2** — the exit was right and the document certified. A CI wrapper reads
+  // the exit; an agent reads the document, and the agent channel is the one that cannot ask a follow-up
+  // question. Same keys and same order as the gate's verdict document, so one consumer parses both.
+  const scope = { ...(outOfScope?.length ? { outOfScope } : {}),
+                  ...(unread?.length ? { unread } : {}) };
   // Key order matches the gate's verdict document: the finding, then `unevaluated`, then the manifest.
-  if (unanalyzed?.length) return { ...rest, incomplete: true, unanalyzed, ...judged };
-  return (judgedNothing?.length || noManifest?.length || unreadable?.length)
-    ? { ...rest, incomplete: true, ...judged } : rest;
+  if (unanalyzed?.length) return { ...rest, incomplete: true, unanalyzed, ...scope, ...judged };
+  return (judgedNothing?.length || noManifest?.length || unreadable?.length
+          || outOfScope?.length || unread?.length)
+    ? { ...rest, incomplete: true, ...scope, ...judged } : rest;
 }
 
 export function loadReport(prefix) {
@@ -771,7 +861,7 @@ export function loadReport(prefix) {
  * `net-partner` re-mapping of the `netClass` this report already states. The reach the reason-class
  * fixpoint runs over is the entries' OWN §2 `calls` field — report data in, report data out.
  *
- * Returns `{functions, analyzed, unanalyzed, coverage, judgedNothing, hardFail, corrupt}`. `hardFail`
+ * Returns `{functions, analyzed, unanalyzed, coverage, judgedNothing, unread, hardFail, corrupt}`. `hardFail`
  * carries the `loadReport` meaning exactly: a file was FOUND and yielded nothing trustworthy (never "there
  * was no file" — the caller's `requireReport` owns that), so a corrupt report can be refused instead of
  * gated green. `corrupt` NAMES every present-but-unparseable §2 key found (SPEC §2 ⟨0.24⟩ requires the
@@ -780,7 +870,8 @@ export function loadReport(prefix) {
  */
 export function loadGateReport(prefix) {
   const files = reportFilesAt(prefix);
-  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [];
+  const functions = [], unanalyzed = [], cov = new Map(), corrupt = [], outOfScope = [], netPartners = [],
+        unread = [];
   let hardFail = false, analyzed = 0;
   // ⟨0.24⟩ did the report handed to the gate judge ANYTHING? Per FILE, then ANDed across the multi-report
   // siblings, because the union of several reports has judged something as soon as ONE of them has — the
@@ -858,6 +949,61 @@ export function loadGateReport(prefix) {
         if (e && typeof e === "object" && Array.isArray(e.effects) && e.effects.length)
           outOfScope.push(e);
         else corrupt.push(`${f}: \`outOfScope\` (an element is not an object carrying a non-empty \`effects\`)`);
+    // ⟨0.32⟩ THE CLASSES THE PRODUCER DID NOT READ, off `excluded[].peeked` — the ⟨0.32⟩ unread-code rule,
+    // which until now existed ONLY in scan.mjs. A user who scans in CI and gates the artifact later got a
+    // green over code nobody had opened; MEASURED at HEAD before this line existed, on a tree whose
+    // excluded `dist/shipped.js` runs `execSync`: `candor-ts <tree> --policy 'deny Exec'` exits 2 naming
+    // the function, while gating the report of a bare `candor-ts <tree> --out N` under the SAME policy
+    // exited 0 with `ok: true` and no disclosure.
+    //
+    // THE RULE, stated here and applied ONCE in query.mjs's gate: a class the producing scan did not READ
+    // licenses nothing, and whether that matters is decided by the policy applied NOW, not by the
+    // producer's history. `peeked: false` genuinely has two causes — "opened it and failed" and "never
+    // asked" — but from a REPORT they are indistinguishable, because they leave the identical hole: those
+    // files' effects are absent from `functions` because nothing looked, and ⟨0.21⟩ licenses a purity
+    // claim only over units the scan actually judged. The carve-out is about the QUESTION (only a
+    // `deny`/`pure` rule's answer depends on code outside the scan's scope), not about the history.
+    //
+    // `judgedElsewhere` is the PRODUCER's carve-out for a derived copy of already-judged code, and only
+    // the producer may set it: the class TOKENS are engine-chosen (`build-output` here, `build-output-
+    // archive` in candor-java), so a consumer inferring "derived" from a name would gate another engine's
+    // report differently from the engine that wrote it.
+    //
+    // STRICT, like every other verdict-bearing key on this route: `excluded` now MOVES the verdict, so a
+    // present-but-unparseable one is corrupt input NAMED in the refusal, never coerced to `[]` — the
+    // safe-LOOKING value, which is the claim "this scan excluded nothing" and deletes the rule. `peeked`
+    // is the sharpest case the language offers: `"peeked": "no"` is TRUTHY, so an unchecked read turns an
+    // unread class into a peeked one. ABSENT stays permissive: `excluded` is a ⟨0.29⟩ key, and refusing
+    // over its absence would refuse every report an older producer ever wrote.
+    const exc = parsed.excluded;
+    if (exc !== undefined && !Array.isArray(exc))
+      corrupt.push(`${f}: \`excluded\` is present and is not a list`);
+    else if (Array.isArray(exc))
+      for (const e of exc) {
+        if (!e || typeof e !== "object" || Array.isArray(e) || typeof e.class !== "string" || !e.class
+            || ("peeked" in e && typeof e.peeked !== "boolean")
+            || ("judgedElsewhere" in e && typeof e.judgedElsewhere !== "boolean")
+            || ("count" in e && !(typeof e.count === "number" && Number.isInteger(e.count) && e.count >= 0)))
+          corrupt.push(`${f}: \`excluded\` (an element is not \`{class, count, peeked, reason}\` — `
+            + `\`class\` a non-empty string, \`count\` a non-negative integer, \`peeked\`/\`judgedElsewhere\` booleans)`);
+        // An ABSENT `peeked` reads as FALSE, which is the fail-closed direction and what candor-rust's
+        // `#[serde(default)]` does on the same field: a producer that does not say it read the class has
+        // not said it read the class.
+        else if (e.peeked !== true && e.judgedElsewhere !== true) unread.push(e.class);
+      }
+    // ⟨0.31⟩ the producer's PARTNER PROVENANCE, carried through verbatim and never recomputed — this
+    // route has no target to anchor `net-partner` at, and re-classifying through the consumer's own
+    // config is the re-derivation §3.1 forbids. A prefix can match several reports (a workspace writes
+    // one per member), each anchoring its own config, so this is collected as a LIST even though a
+    // single report carries a single record. Shape-checked like every other key read off the wire: a
+    // malformed one is corruption, not something to quietly drop.
+    const nps = parsed.netPartners;
+    if (nps !== undefined) {
+      if (nps && typeof nps === "object" && !Array.isArray(nps)
+          && typeof nps.config === "string" && Array.isArray(nps.hosts))
+        netPartners.push({ config: nps.config, hosts: nps.hosts.map(String) });
+      else corrupt.push(`${f}: \`netPartners\` is present and is not { config: string, hosts: [string] }`);
+    }
     // ⟨0.15⟩ the κ ledger. Merged + re-sorted the PRODUCER's way (count desc, name asc by code point —
     // reportCoverage's rule, and scan.mjs's), so a single-report prefix reproduces the emitted order exactly.
     const unc = parsed.coverage?.uncovered;
@@ -870,7 +1016,12 @@ export function loadGateReport(prefix) {
   }
   const coverage = [...cov.entries()].sort((a, b) => b[1] - a[1] || byCodePoint(a[0], b[0]))
     .map(([name, calls]) => ({ name, calls }));
-  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, hardFail: hardFail || corrupt.length > 0, corrupt };
+  // ⟨0.32⟩ `unread` is DEDUPED: a class is the unit of the answer (the producer publishes one entry per
+  // class), and a multi-report prefix — a workspace writing one report per member — otherwise repeats the
+  // same class once per member in a message whose job is to name what to re-scan. The verdict is unmoved
+  // either way; only the sentence is.
+  return { functions, analyzed, unanalyzed, coverage, judgedNothing, outOfScope, netPartners,
+           unread: [...new Set(unread)], hardFail: hardFail || corrupt.length > 0, corrupt };
 }
 // The returned graph carries a non-enumerable `partial` flag (the loadReport `hardFail` precedent):
 // true iff a sidecar file was MATCHED but failed to read/parse — its edges were DROPPED (disclosed on
@@ -1563,16 +1714,38 @@ export function whatif(cg, target, eff, policyParsed, scopeMatches) {
 // here, and the caller must DISCLOSE it rather than compute a remedy from it. `continue` is the whole
 // mechanism: the rule is skipped, a later rule may still deny, and if none does, `deniedLayer` returns null
 // and the caller reads `ctx.held(fn, eff)` to tell "nothing forbids this" from "the gate could not say".
-function deniedLayer(fn, eff, policyParsed, scopeMatches, ctx = null) {
+function denyingRule(fn, eff, policyParsed, scopeMatches, ctx = null, unit = null) {
+  const entry = unit ?? (ctx ? ctx.entry(fn) : null);
   for (const r of policyParsed.deny) {
     const denies = r.effects.length === 0 ? eff !== "Unknown" : r.effects.includes(eff);
     if (!denies || (r.scope && !scopeMatches(fn, r.scope))) continue;
-    if (ctx && classFilterExcludes(r, ctx.entry(fn), eff, ctx.reasonAcc, ctx.netClassOf)) continue;
-    if (ctx?.withhold && ctx.withhold(r, fn, eff)) continue;
-    return r.scope ?? "";
+    if (ctx && classFilterExcludes(r, entry, eff, ctx.reasonAcc, ctx.netClassOf, ctx.units)) continue;
+    if (ctx?.withhold && ctx.withhold(r, entry ?? fn, eff)) continue;
+    return r;
   }
   return null;
 }
+function deniedLayer(fn, eff, policyParsed, scopeMatches, ctx = null, unit = null) {
+  const r = denyingRule(fn, eff, policyParsed, scopeMatches, ctx, unit);
+  return r === null ? null : (r.scope ?? "");
+}
+
+/**
+ * ⟨0.32⟩ An effect the MERGE contributed rather than the report — today only the `Unknown` a unit acquires
+ * when a callee NAME it declares is declared by two or more units (SPEC §2.2; see `reportUnits`). There is
+ * no `direct` site for it and therefore no span to hoist, so `fix`/`fix-gate` must DISCLOSE it rather than
+ * invent a remedy — and must not fall silent either, or the gate charges a violation while the verb that
+ * exists to fix it answers "nothing left to fix". That silence is what the ⟨0.24⟩ withhold ruling calls
+ * trading a fabricated instruction for a false all-clear.
+ */
+const mergeContributedHold = (entry, rule) => ({
+  fn: entry.fn, rule: rule.raw, effect: "Unknown",
+  why: `\`${rule.raw.trim()}\` fires on \`${entry.fn}\`, but the Unknown it fires on is this MERGE's: a `
+     + "callee this entry names is declared by two or more units in the report set, so the reach cannot be "
+     + "resolved and no site can be named (SPEC §2.2 — a consumer joins by `hash`, never by bare `fn`). "
+     + "There is nothing to hoist, so NO remedy is offered; the gate still reports the violation. Gate at "
+     + "scan time (candor-ts <src> --policy <file>), or gate the member's report on its own."
+});
 
 /**
  * ⟨0.24⟩ The narrowing context the class filter needs, over a LOADED report: a function's transitive
@@ -1620,14 +1793,20 @@ function deniedLayer(fn, eff, policyParsed, scopeMatches, ctx = null) {
  * whether or not the caller loaded a callgraph — which is why MCP's `candor_unverified`, which loads no
  * sidecar, gets the same narrowing as the CLI.
  */
-export function narrowingContext(fns, cg = {}, policyParsed = null) {
+export function narrowingContext(fns, cg = {}, policyParsed = null, units = null) {
   const byName = indexFns(fns);
-  const reasonAcc = resolveReasonClasses(fns, cg);
+  // ⟨0.32⟩ the unit identity the GATE uses over these same bytes — `null` is the identity, which is what
+  // the scan-time note in scan.mjs wants. `uk` is how every accumulator on this page is keyed; `byName`
+  // stays a NAME index, because the advisory verbs are called with the names a human typed.
+  const uk = (e) => (units ? units.key(e) : e?.fn);
+  /** A unit key from an ENTRY (exact) or from a NAME (resolved through the name index — see `classesOf`). */
+  const unitOf = (x) => uk(typeof x === "string" ? (byName.get(x) ?? { fn: x }) : x);
+  const reasonAcc = resolveReasonClasses(fns, cg, units);
   // VERBATIM OFF THE WIRE: every `Net`-bearing entry maps to its `netClass` or to the EMPTY set, so the
   // derivation is unreachable and the report is the only source of the class (reportNetClasses' argument).
-  const netMap = reportNetClasses(fns, { authoritative: true });
+  const netMap = reportNetClasses(fns, { authoritative: true, units });
   const { unevaluated, withhold } = policyParsed
-    ? unanswerableScoped(policyParsed, fns, reasonAcc, netMap)
+    ? unanswerableScoped(policyParsed, fns, reasonAcc, netMap, units)
     : { unevaluated: [], withhold: null };
   // The disclosure, keyed by FUNCTION. `unanswerableScoped` groups by RULE because that is the granularity
   // a gate verdict lists; an advisory verb names FUNCTIONS, so the same triples are indexed both ways here
@@ -1637,22 +1816,33 @@ export function narrowingContext(fns, cg = {}, policyParsed = null) {
   if (withhold)
     for (const f of fns)
       for (const r of policyParsed.deny)
-        for (const eff of f.inferred ?? []) {
-          if (!withhold(r, f.fn, eff)) continue;
+        for (const eff of effectiveInferred(f, reasonAcc, units)) {
+          if (!withhold(r, uk(f), eff)) continue;
           const u = byRaw.get(r.raw);
           if (!u) continue;                                  // unreachable: every held triple has a group
-          const cur = heldByFn.get(f.fn) ?? new Map();
+          // ⟨0.32⟩ indexed by UNIT, read back by unit — `held(fn)` still accepts a name for the
+          // name-driven verbs, and `held(entry)` is exact where the caller is iterating entries.
+          const cur = heldByFn.get(uk(f)) ?? new Map();
           cur.set(`${r.raw}\0${eff}`, { fn: f.fn, rule: r.raw, effect: eff, why: u.why });
-          heldByFn.set(f.fn, cur);
+          heldByFn.set(uk(f), cur);
         }
   return {
     reasonAcc,
-    netClassOf: netClassResolver(new Map(), new Set(), netMap),
+    netClassOf: netClassResolver(new Map(), new Set(), netMap, units),
     entry: (fn) => byName.get(fn) ?? null,
-    withhold,
+    units,
+    // ⟨0.32⟩ THE UNIT, FROM AN ENTRY WHERE THE CALLER HAS ONE AND FROM A NAME WHERE IT DOES NOT. The
+    // advisory verbs are driven by names a human typed, so a name has to resolve; but a verb ITERATING
+    // entries must pass the entry, or two same-named units both resolve to whichever one `byName` kept and
+    // one of them is answered for by the other — the same §2.2 harm this rung closes, one layer out.
+    classesOf: (x) => reasonAcc.get(unitOf(x)),
+    // The withhold is keyed by UNIT (unanswerableScoped); resolving here rather than at each call site is
+    // deliberate, because a name-keyed probe of a unit-keyed set does not error — it answers `false`,
+    // which reads as "the gate could judge this" and puts back the fabricated remedy it exists to suppress.
+    withhold: withhold ? (r, x, eff) => withhold(r, unitOf(x), eff) : null,
     unevaluated,
-    held: (fn, eff = null) =>
-      [...(heldByFn.get(fn)?.values() ?? [])].filter((h) => eff === null || h.effect === eff),
+    held: (x, eff = null) =>
+      [...(heldByFn.get(unitOf(x))?.values() ?? [])].filter((h) => eff === null || h.effect === eff),
   };
 }
 
@@ -1753,7 +1943,7 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
 // `107755b`): `refused: true`, the `unevaluated` disclosure, and **NO `crossing` KEY AT ALL** — absent, not
 // `false`, because a claim it cannot make must not be spelled as a claim it can.
 export function fix(cg, fns, target, eff, policyParsed, scopeMatches) {
-  const ctx = narrowingContext(fns, cg, policyParsed);   // ⟨0.24⟩ the rule's class filter + the gate's refusal
+  const ctx = narrowingContext(fns, cg, policyParsed, reportUnits(fns));   // ⟨0.24⟩ the rule's class filter + the gate's refusal
   // Resolve against REPORT function names only (not callgraph nodes, which include pure fns absent from the
   // report) — so `fix <pure-fn>` is a uniform "no such fn" across engines, not a TS-only crossing:false.
   // (/code-review — candor-query/java/swift all match report fns only.)
@@ -1763,9 +1953,14 @@ export function fix(cg, fns, target, eff, policyParsed, scopeMatches) {
   // prefer a match that actually performs the effect, so a bare leaf resolves to the violating function
   const start = m.find((n) => (byName.get(n)?.inferred ?? []).includes(eff)) ?? m[0];
   const se = byName.get(start);
-  if (!se || !(se.inferred ?? []).includes(eff))
+  if (!se || !effectiveInferred(se, ctx.reasonAcc, ctx.units).includes(eff))
     return { fn: start, effect: eff, crossing: false, reason: "does-not-perform" };
-  const layer = deniedLayer(start, eff, policyParsed, scopeMatches, ctx);
+  // ⟨0.32⟩ the same split `fix-gate` makes: an effect the MERGE contributed has no site to hoist, so it is
+  // disclosed as unevaluated rather than answered `not-forbidden` (which would read as a clean boundary).
+  const mcr = (se.inferred ?? []).includes(eff)
+    ? null : denyingRule(start, eff, policyParsed, scopeMatches, ctx, se);
+  if (mcr) return { fn: start, effect: eff, refused: true, unevaluated: unevaluatedOf([mergeContributedHold(se, mcr)]) };
+  const layer = deniedLayer(start, eff, policyParsed, scopeMatches, ctx, se);
   if (layer === null) {
     // ORDER MATTERS: the withhold is checked only where NO rule denied, because a rule that fires on
     // evidence the report DOES carry is certain and dominates (PAPER3 Lemma 2 — the same precedence the
@@ -1792,7 +1987,7 @@ export function fix(cg, fns, target, eff, policyParsed, scopeMatches) {
 // EITHER. Dropping the plan without the disclosure would trade a fabricated instruction for a false
 // all-clear, which is the failure this project keeps measuring in fabrication repairs.
 export function fixGate(cg, fns, policyParsed, scopeMatches) {
-  const ctx = narrowingContext(fns, cg, policyParsed);   // ⟨0.24⟩ the class filter + the gate's refusal
+  const ctx = narrowingContext(fns, cg, policyParsed, reportUnits(fns));   // ⟨0.24⟩ the class filter + the gate's refusal
   const byName = indexFns(fns);
   const rev = reverseGraph(cg);
   const plans = new Map();
@@ -1800,14 +1995,20 @@ export function fixGate(cg, fns, policyParsed, scopeMatches) {
   // Iterate functions in sorted-name order so the first-writer-wins `fn` representative of a collapsed
   // remedy is deterministic across engines (candor-query/java/swift all iterate a sorted key set).
   for (const e of [...fns].sort((a, b) => (a.fn < b.fn ? -1 : a.fn > b.fn ? 1 : 0))) {
-    for (const eff of [...(e.inferred ?? [])].sort()) {
-      const layer = deniedLayer(e.fn, eff, policyParsed, scopeMatches, ctx);
-      if (layer !== null) {
-        const p = computeRemedy(e.fn, eff, layer, cg, rev, byName, policyParsed, scopeMatches, ctx);
+    // ⟨0.32⟩ THE GATE'S EFFECT SET, not the wire's — this verb has to see every effect `evaluatePolicy`
+    // sees or it answers "nothing left to fix" over a violation the gate reports (measured: gate exit 1,
+    // `fix-gate --strict` exit 0 with `ok: true`). `wire` separates the two so the merge's own
+    // contribution is DISCLOSED rather than remedied; see `mergeContributedHold`.
+    const wire = new Set(e.inferred ?? []);
+    for (const eff of [...effectiveInferred(e, ctx.reasonAcc, ctx.units)].sort()) {
+      const r = denyingRule(e.fn, eff, policyParsed, scopeMatches, ctx, e);
+      if (r !== null) {
+        if (!wire.has(eff)) { held.push(mergeContributedHold(e, r)); continue; }
+        const p = computeRemedy(e.fn, eff, r.scope ?? "", cg, rev, byName, policyParsed, scopeMatches, ctx);
         const key = `${p.effect}|${p.layer}|${p.site}|${p.hoistTo}`;
         if (!plans.has(key)) plans.set(key, p);
       } else {
-        held.push(...ctx.held(e.fn, eff));   // see `fix`: only where nothing certain denied
+        held.push(...ctx.held(e, eff));   // see `fix`: only where nothing certain denied
       }
     }
   }
@@ -1885,14 +2086,16 @@ export function ruleUpgrade(r) {
  *  a violation would silently drop the function from this list on the strength of a violation nobody made,
  *  which is the same silence in a second place. Withheld ⇒ not a firing ⇒ the function stays a hole here,
  *  the LESS-confident direction, which is the one this verb is allowed to move in. */
-export function unverifiedHoleRule(fn, inferred, policyParsed, scopeMatches, ctx = null) {
+export function unverifiedHoleRule(fn, inferred, policyParsed, scopeMatches, ctx = null, unit = null) {
   const inf = inferred ?? [];
   if (!inf.includes("Unknown")) return null;
-  const entry = ctx ? ctx.entry(fn) : null;
+  // ⟨0.32⟩ `unit` is the ENTRY when the caller is iterating entries (two units may share `fn`, and the
+  // name index keeps only one of them); it falls back to the name lookup for the name-driven callers.
+  const entry = unit ?? (ctx ? ctx.entry(fn) : null);
   // An effect the rule NAMES but whose class filter excludes here is not a violation — it is exactly what
   // the gate tolerates, so the pass is real, and the Unknown it passes with makes that pass unverified.
-  const fires = (r, x) => !(ctx && classFilterExcludes(r, entry, x, ctx.reasonAcc, ctx.netClassOf))
-                       && !(ctx?.withhold && ctx.withhold(r, fn, x));
+  const fires = (r, x) => !(ctx && classFilterExcludes(r, entry, x, ctx.reasonAcc, ctx.netClassOf, ctx.units))
+                       && !(ctx?.withhold && ctx.withhold(r, entry ?? fn, x));
   for (const r of policyParsed.deny) {
     if (r.scope && !scopeMatches(fn, r.scope)) continue;
     const violates = r.effects.length === 0
@@ -1935,20 +2138,22 @@ export function unverified(fns, policyParsed, scopeMatches, classSpec = null, cg
   // ⟨0.24⟩ the POLICY's own `Unknown[…]`/`Net[…]` narrowing, which is a different question from `--class`
   // (the reader's drill-down) and was never asked at all: `reasonAcc` here rides the ctx, so the two
   // narrowings resolve the class set exactly once and from the same code as the gate.
-  const ctx = narrowingContext(fns, cg, policyParsed);
+  const ctx = narrowingContext(fns, cg, policyParsed, reportUnits(fns));
   const holes = [];
   const held = [];
   for (const e of fns) {
     // Same predicate + upgrade as the gate note (scan.mjs) — one source of truth for a hole.
-    const r = unverifiedHoleRule(e.fn, e.inferred, policyParsed, scopeMatches, ctx);
-    if (r && !(cf && !reasonClassesMatch(ctx.reasonAcc.get(e.fn), cf))) {
+    // ⟨0.32⟩ the effect set the GATE reads, not the raw wire one — an entry whose callee name the merge
+    // could not resolve carries `Unknown` here too, or this verb would clear a hole the gate refuses.
+    const r = unverifiedHoleRule(e.fn, effectiveInferred(e, ctx.reasonAcc, ctx.units), policyParsed, scopeMatches, ctx, e);
+    if (r && !(cf && !reasonClassesMatch(ctx.classesOf(e), cf))) {
       const [rule, upgrade] = ruleUpgrade(r);
       holes.push({ fn: e.fn, rule, unknownWhy: e.unknownWhy ?? [], upgrade });
     }
     // …and, INDEPENDENTLY of whether it is also a provable-purity hole, every rule the gate withheld on
     // this function: one entry per (function, rule), in report order, beside the holes rather than in a
     // separate array a consumer reading `unverified[]` would never look at.
-    const h = ctx.held(e.fn);
+    const h = ctx.held(e);
     for (const u of unevaluatedOf(h)) holes.push({ fn: e.fn, rule: u.rule, why: u.why });
     held.push(...h);
   }