candor-ts 0.33.0 → 0.33.1

package/lsp.mjs

@@ -402,7 +402,14 @@ const zeroRulePolicyWarn = (what) =>
  * same reason ("there is no line to pin it to"); the activity overlay's line-0 diagnostic is not a
  * counter-example, because its record NAMES the edited file and this one names no file in the workspace.
  */
-function discloseIncompleteness(unanalyzed, outOfScope, unread, unaskedRules) {
+// `certainViolation`: SPEC §3.1's precedence (`query.mjs`'s `gate --report`: violation (1) > refusal (2) >
+// incomplete (2)) means a policy violation ELSEWHERE in this same report makes the real exit 1, not the 2
+// this function used to assert unconditionally. Measured: a report with an unread file AND a certain `Fs`
+// violation exits 1 over `gate --report` — the incompleteness is still real and still unjudged, but "exits
+// 2 (INCOMPLETE)" / "CI exits 2 over these bytes" is a wrong, checkable claim in exactly that case. Two
+// fixtures with the identical unread-file cause differ only in whether a violation coexists, and only the
+// violation-free one made this text true.
+function discloseIncompleteness(unanalyzed, outOfScope, unread, unaskedRules, certainViolation) {
   const causes = [];
   // The CLI's order (`unanalyzed` → `outOfScope` → `unread` → `unaskedRules`), so a report tripping two
   // of them reads the same way here as it does in CI. The repairs genuinely differ — a parse to fix, a
@@ -433,15 +440,28 @@ function discloseIncompleteness(unanalyzed, outOfScope, unread, unaskedRules) {
       + `squiggled here — re-run the producing scan under THE SAME policy this editor is applying `
       + `(candor-ts <dir> --policy <file>), not merely under a policy.`);
   if (!causes.length) return;
+  // ⟨lsp-precedence⟩ the exit-code claim is conditional on whether a certain violation ALSO fires: if one
+  // does, Lemma 2 makes it dominate (exit 1), and the incompleteness below is true but not what CI is red
+  // over. See `certainViolation`'s definition above.
+  const exitClaim = certainViolation
+    ? `a certain policy violation ELSEWHERE in this report makes \`gate --report\` over the same bytes exit `
+      + `1 — SPEC §3.1's precedence has a firing rule dominate a refusal, so CI is red on THAT, not on this. `
+      + `The incompleteness below is still real and still unjudged; it is just not what the exit code names`
+    : `\`gate --report\` over the same bytes exits 2 (INCOMPLETE), so the squiggles in this editor are NOT `
+      + `the whole verdict`;
+  const briefClaim = certainViolation
+    ? `candor gate: a certain violation elsewhere in this report already makes CI exit 1 over these bytes — `
+      + `but this report ALSO has unjudged code (see the candor log); fixing the violation alone will not `
+      + `make it complete.`
+    : `candor gate: INCOMPLETE — this report cannot support a green verdict (CI exits 2 over these bytes). `
+      + `See the candor log for what went unjudged and how to fix it.`;
   warnLoudOnce(
-    `candor-lsp: this report cannot support a GREEN gate — \`gate --report\` over the same bytes exits 2 `
-    + `(INCOMPLETE), so the squiggles in this editor are NOT the whole verdict:\n`
+    `candor-lsp: this report cannot support a GREEN gate — ${exitClaim}:\n`
     + causes.map((c) => `    · ${c}`).join("\n")
     + `\n  NO diagnostic can be drawn for any of the above: the code it names is not in the report, so it `
     + `has no line in this editor to sit on. Its ABSENCE from the squiggles is the incompleteness itself, `
     + `not an all-clear.`,
-    `candor gate: INCOMPLETE — this report cannot support a green verdict (CI exits 2 over these bytes). `
-    + `See the candor log for what went unjudged and how to fix it.`);
+    briefClaim);
 }
 
 function diagnosticsFor(docPath) {
@@ -490,8 +510,20 @@ function diagnosticsFor(docPath) {
   // condition is applied HERE, to the value, for the reason the CLI states at its own call site: one
   // list, one condition, so two consumers of it cannot disagree about a run.
   const dcomp = Q.reportCompleteness(reportPrefix, dpol.deny);
+  // Cheap, side-effect-free pre-check for `discloseIncompleteness`'s exit-code wording (see its own
+  // comment): does THIS report already carry a certain violation, over the WHOLE report the way
+  // `gate --report` reads it, not just this one document? A redundant pass over an already-loaded report
+  // — the real one runs again below, where its `dunevaluated`/`violations` are also needed for the
+  // diagnostics themselves and for OTHER `warnOnce` lines whose relative order this must not disturb.
+  const dwp0 = wholePolicyUnanswerable(dpol, "the editor's report route");
+  const dunits0 = reportUnits(fns);
+  const dnet0 = reportNetClasses(fns, { authoritative: true, units: dunits0 });
+  const { withhold: dwithhold0 } = unanswerableScoped(dpol, fns,
+    resolveReasonClasses(fns, Q.loadCallgraph(reportPrefix), dunits0), dnet0, dunits0);
+  const certainViolation = evaluatePolicy(dwp0.answerable, fns, Q.loadCallgraph(reportPrefix),
+    new Map(), new Set(), dnet0, dwithhold0, dunits0).length > 0;
   discloseIncompleteness(dcomp.unanalyzed ?? [], dcomp.outOfScope ?? [],
-                         dpol.deny.length ? (dcomp.unread ?? []) : [], dcomp.unaskedRules ?? []);
+                         dpol.deny.length ? (dcomp.unread ?? []) : [], dcomp.unaskedRules ?? [], certainViolation);
   // ⟨0.24⟩ THE ANSWERABILITY WITHHOLD, which this surface ran WITHOUT — `evaluatePolicy` was called with no
   // `withhold` predicate and the DEFAULT netClass mode, so both directions of the §3.1 harm were live in the
   // editor. Measured against the CLI on one report and one policy: `deny Unknown[reflect]` drew NO squiggle

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.33)",
   "type": "module",
   "dependencies": {

package/query.mjs

@@ -143,14 +143,38 @@ const advisoryUnreadableNote = (verb, unreadable) => {
 // below, for the reason `incompleteAnswerNote` gives: that note asserts `analyzed.count: 0`, which a
 // row-3 report never said, and the repair is a producer that emits a manifest rather than a scan that
 // reaches a conclusion.
-const advisoryNoManifestNote = (verb, files) => {
+//
+// ⟨fix, sibling of 658e3c0 / gateLine⟩ BOTH SENTENCES BELOW HAD THE SAME UNCONDITIONED "exits 0" CLAIM
+// gateLine's third branch has, and unlike that branch's remaining causes (`judgedNothing` ALONE, with
+// no other sibling report under the locator, truly cannot carry a violation — there is nothing to
+// evaluate), a MULTI-REPORT prefix breaks the argument: `reportNoManifestFiles`/`reportJudgedNothingFiles`
+// are PER-FILE lists (a locator with one silent/manifest-less sibling among several still hedges), while
+// the real `gate` route's `judgedNothing` is the loadGateReport UNION across siblings — "judged something
+// as soon as ONE of them has" — and a noManifest file is folded into the SAME union the moment it lists
+// real functions. MEASURED: a prefix with report.a.json (a certain `deny Fs` violation) beside
+// report.b.json (an empty bare-array / `analyzed.count: 0` sibling, either cause) makes `gate --report`
+// exit 1 — the violation in `a` dominates — while `unverified`/`fix-gate --strict` printed "`gate --report`
+// exits 0 … NOTHING DOWNSTREAM WILL CATCH THIS FOR YOU" and exited 0 themselves. `certainViolation` is
+// reused from the caller's ALREADY-LOADED policy — cheaper here than the eleven read-only verbs' discovery
+// hack, since whatif/fix-gate/unverified hold their own `pol`/`fgpol`/`upol` already.
+//
+// `advisoryUnreadableNote` just above is DELIBERATELY NOT changed: a report FILE that failed to PARSE is
+// the real gate's `g.hardFail` refusal, and that one is proven to dominate ABSOLUTELY (see the ruling at
+// the `gate` case's own `if (g.hardFail)` branch, "the precedence ruling does NOT reach this exit") —
+// conditioning it on `certainViolation` would be the flip-the-wording regression the correction to
+// `gateLine` above had to undo for the same cause.
+const advisoryNoManifestNote = (verb, files, certainViolation) => {
   console.error(`candor-ts: ${verb} could NOT fully evaluate — ${files.length} report(s) under this locator carry NO \`analyzed\` manifest at all (SPEC §2 row 3, a pre-⟨0.21⟩ producer), so they make no claim about what was judged and their silence licenses none either:`);
   for (const f of files) console.error(`    ${f}`);
-  console.error("  (`ok` is OMITTED — neither value is a statement this input licenses. `gate --report` exits 0 over these bytes, so this note is the whole of the warning. Re-scan with a current engine so the report carries its manifest.)");
+  console.error(certainViolation
+    ? "  (`ok` is OMITTED — neither value is a statement this input licenses. A certain policy violation ELSEWHERE in this report makes `gate --report` over the same bytes exit 1, not 0 — SPEC §3.1's precedence has a firing rule dominate; this cause is still real and still unjudged, it is just not what the exit code names. Re-scan with a current engine so the report carries its manifest.)"
+    : "  (`ok` is OMITTED — neither value is a statement this input licenses. `gate --report` exits 0 over these bytes, so this note is the whole of the warning. Re-scan with a current engine so the report carries its manifest.)");
 };
-const advisoryJudgedNothingNote = (verb) => {
+const advisoryJudgedNothingNote = (verb, certainViolation) => {
   console.error(`candor-ts: ${verb} could NOT fully evaluate — the report(s) under this locator say they JUDGED NOTHING (⟨0.24⟩ \`analyzed.count\` is 0, absent with no entries, or unreadable), so absence from \`functions\` licenses no purity claim about any unit and there is nothing here to certify`);
-  console.error("  (`ok` is OMITTED — neither value is a statement this input licenses. NOTHING DOWNSTREAM WILL CATCH THIS FOR YOU: `gate --report` exits 0 over a judged-nothing report and `--strict` does not move either, so this note is the whole of the warning. Re-scan the sources you meant to check.)");
+  console.error(certainViolation
+    ? "  (`ok` is OMITTED — neither value is a statement this input licenses. A certain policy violation ELSEWHERE in this report makes `gate --report` over the same bytes exit 1 — SPEC §3.1's precedence has a firing rule dominate, so CI IS RED on that, not on this judged-nothing sibling; `--strict` here does not move either way. Re-scan the sources you meant to check.)"
+    : "  (`ok` is OMITTED — neither value is a statement this input licenses. NOTHING DOWNSTREAM WILL CATCH THIS FOR YOU: `gate --report` exits 0 over a judged-nothing report and `--strict` does not move either, so this note is the whole of the warning. Re-scan the sources you meant to check.)");
 };
 // The §6 effect vocabulary — used to reject a typo'd effect name in `where` (corpus-audit #3). Kept in step
 // with SPEC §6 / the umbrella's list; an unknown name PRESENT in a report (a spec extension) is still allowed.
@@ -200,11 +224,94 @@ const put = (a, data, proseFn) => { if (!proseFn || wantJsonOut(a)) emit(data);
 // unevaluable on that route — so the exit is a certainty once a policy exists; the gap is that none does
 // here. Checked FIRST, because a report can carry an unread class and unanalyzed units together and this
 // is the sentence naming the cause the other two do not.
-const gateLine = (comp) => (comp.unread?.length && !comp.unanalyzed.length && !comp.unreadable?.length
-  ? "`gate --report` exits 2 over these bytes under any policy it can evaluate (they are all `deny`/`pure`), and this verb holds none — so NOTHING DOWNSTREAM IS FAILING CLOSED ON IT HERE and this note is the whole of the warning."
-  : comp.unanalyzed.length || comp.unreadable?.length
-  ? "`gate --report` exits 2 over these bytes."
-  : "NOTHING DOWNSTREAM WILL CATCH THIS FOR YOU — `gate --report` exits 0 over a judged-nothing report (⟨0.24⟩: a disclosure, not an exit code), so this note is the whole of the warning.");
+//
+// ⟨fix, sibling of 658e3c0⟩ THIS SENTENCE HAS THE IDENTICAL DEFECT THE LSP'S `discloseIncompleteness`
+// HAD: it asserted "exits 2" unconditionally, when SPEC §3.1's precedence (violation (1) > refusal (2)
+// > incomplete (2)) makes a CERTAIN violation elsewhere in the SAME report dominate — the real exit is
+// 1, not 2, and "exits 2 over these bytes" is a false, checkable claim in exactly that case. MEASURED:
+// a report naming an unread exclusion class (branch 1 below) or an unanalyzed unit (branch 2, the
+// `comp.unanalyzed` half only — see next paragraph) ALSO carrying a certain `deny Fs`/`deny Exec`
+// violation elsewhere exits 1 over `gate --report`, not 2. `certainViolationOver` below is the cheap,
+// side-effect-free pre-check; see its own comment for why it must discover a policy rather than read
+// one from these arguments (these eleven verbs hold none of their own).
+//
+// `comp.unreadable` (a report FILE under this locator that failed to PARSE — corrupt or mid-write) IS
+// NOT PART OF THIS. MEASURED against the real `gate` verb's own ruling on this exact question (its
+// `g.hardFail` branch, `grefuse`d before any violation is ever evaluated): "the precedence ruling does
+// NOT reach this exit" — a CORRUPTION refusal says the report cannot be read AS A REPORT, which
+// undermines the very premise Lemma 2 runs on, and it dominates ABSOLUTELY, never the other way round.
+// Confirmed: a prefix with one clean sibling carrying a certain `deny Fs` violation beside a SECOND,
+// unparseable sibling still exits 2, unconditionally. Folding `unreadable` into the same
+// certain-violation branch as `unanalyzed` — the first attempt at this fix did exactly that — flips the
+// wording to claim a "1, not 2" dominance that is false whenever `unreadable` fired, the EXACT opposite
+// error the LSP's own fix warns against. So `unreadable` gets its own, ALWAYS-unconditional arm.
+// Shared by BOTH sibling fixes (this file's `gateLine` and the `advisoryNoManifestNote`/
+// `advisoryJudgedNothingNote` pair below `advisoryUnreadableNote`): given an ALREADY-PARSED, ALREADY-
+// resolved policy object (or `null`, for `whatif`'s optional one), does it find a certain violation
+// anywhere in the report at `prefix`? A zero-rule policy or a load/evaluate exception answers `false`
+// rather than throwing — this is a pre-check for WORDING, never a certifying read, so it must never
+// promote an internal error into an over-claim it cannot support.
+function certainViolationFromPolicy(pol, prefix) {
+  if (!pol || policyAskedNothing(pol)) return false;
+  try {
+    const fns = loadReport(prefix);
+    const cg = loadCallgraph(prefix);
+    const wp = wholePolicyUnanswerable(pol, "the advisory route's precedence pre-check");
+    const units = reportUnits(fns);
+    const net = reportNetClasses(fns, { authoritative: true, units });
+    const { withhold } = unanswerableScoped(pol, fns, resolveReasonClasses(fns, cg, units), net, units);
+    return evaluatePolicy(wp.answerable, fns, cg, new Map(), new Set(), net, withhold, units).length > 0;
+  } catch { return false; }
+}
+function certainViolationOver(prefix) {
+  const { policyFile } = resolvePolicy(null, null);
+  if (!policyFile) return false;
+  let text;
+  try { text = fs.readFileSync(policyFile, "utf8"); } catch { return false; }
+  let pol;
+  try {
+    const errs = [];
+    const aliases = parseUnknownAliases(discoverConfigText(policyVocabularyAnchor(policyFile, process.cwd())), errs);
+    pol = parsePolicy(text, aliases);
+    errs.push(...pol.errors);
+    if (fatalPolicyErrors(errs).length) return false;
+  } catch { return false; }
+  return certainViolationFromPolicy(pol, prefix);
+}
+const gateLine = (comp, prefix) => {
+  const dominanceNote = (tail) =>
+    `a certain policy violation ELSEWHERE in this report makes \`gate --report\` over the same bytes exit `
+    + `1 — SPEC §3.1's precedence has a firing rule dominate a refusal, so CI is red on THAT, not on ${tail}. `
+    + `The incompleteness above is still real and still unjudged; it is just not what the exit code names.`;
+  // `unreadable` FIRST and UNCONDITIONALLY (see the comment above `certainViolationOver`): a corrupt
+  // report file refuses absolutely, so this arm never calls the pre-check at all — never mind consults
+  // it — and no wording below it is reachable while `unreadable` is non-empty.
+  if (comp.unreadable?.length) return "`gate --report` exits 2 over these bytes.";
+  const certainViolation = certainViolationOver(prefix) === true;
+  // TIER B — DOMINATED BY LEMMA 2, three causes: `unread`, `unanalyzed`, and `outOfScope`.
+  // ⟨fix, found widening the inventory for this same defect⟩ `outOfScope` used to be ABSENT from every
+  // condition here, so an `outOfScope`-only report (no `unread`, no `unanalyzed`, no `unreadable`) fell
+  // through to the "exits 0 … NOTHING DOWNSTREAM WILL CATCH THIS" tail below — but ⟨0.30⟩ made a
+  // non-empty `outOfScope` its OWN exit-2 INCOMPLETE cause, and MEASURED it is dominated exactly like
+  // `unanalyzed`: a certain violation coexisting with an `outOfScope`-only report exits 1, not 2 (and
+  // `outOfScope` ALONE, with no violation anywhere, exits 2, never the 0 this used to claim). That was
+  // the WORSE of the two possible errors on this cause — "nothing downstream" is false in BOTH of its
+  // sub-cases, not just the dominance one — so `outOfScope` now takes this tier, not the last one.
+  return comp.unread?.length && !comp.unanalyzed.length && !comp.outOfScope?.length
+  ? (certainViolation ? dominanceNote("this incompleteness")
+    : "`gate --report` exits 2 over these bytes under any policy it can evaluate (they are all `deny`/`pure`), and this verb holds none — so NOTHING DOWNSTREAM IS FAILING CLOSED ON IT HERE and this note is the whole of the warning.")
+  : comp.unanalyzed.length || comp.outOfScope?.length
+  ? (certainViolation ? dominanceNote("this")
+    : "`gate --report` exits 2 over these bytes.")
+  // TIER C — `judgedNothing`/`noManifest` ALONE (the only causes left once A and B are ruled out). The
+  // real gate's union-across-siblings semantics make this exit 0 so long as NOTHING under the locator
+  // judged real content; a multi-report locator with one silent/manifest-less sibling beside another
+  // that carries a certain violation breaks that (identical fix to `advisoryNoManifestNote`/
+  // `advisoryJudgedNothingNote` below `advisoryUnreadableNote` — see their shared comment) — the union
+  // has judged SOMETHING, so `gate --report` evaluates it normally and a firing rule exits 1, not 0.
+  : (certainViolation ? dominanceNote("this judged-nothing/no-manifest sibling")
+    : "NOTHING DOWNSTREAM WILL CATCH THIS FOR YOU — `gate --report` exits 0 over a judged-nothing report (⟨0.24⟩: a disclosure, not an exit code), so this note is the whole of the warning.");
+};
 
 // The HUMAN half. A no-op when there is nothing to disclose, so an ordinary run stays byte-identical, and
 // printed BEFORE the answer because it qualifies a NON-EMPTY result as much as an empty one: a function in
@@ -217,7 +324,7 @@ const gateLine = (comp) => (comp.unread?.length && !comp.unanalyzed.length && !c
 // loses its withdrawal. Every caller is on the PROSE branch (`putAnswer`'s else-arm, `tour`'s human arm,
 // `gains`' else-arm), so stdout is never carrying a JSON document when this prints — JSON-mode runs take
 // the machine half (`completenessFields`) instead and this function is not called at all.
-const incompleteAnswerNote = (comp, soWhat, tail) => {
+const incompleteAnswerNote = (comp, soWhat, tail, prefix) => {
   if (!mustHedge(comp)) return;
   // Three causes, one sentence each, and only true ones: `unreadable` is a report file whose BYTES could
   // not be parsed — not "declared unanalyzed units" and not "judged nothing", both of which would send
@@ -259,7 +366,7 @@ const incompleteAnswerNote = (comp, soWhat, tail) => {
     console.log(`    ${o.fn ?? "(unnamed)"} — OUTSIDE the producing scan's scope: it performs ${(o.effects ?? []).join(", ")}, and the gate did not judge it`);
   for (const c of comp.unread ?? [])
     console.log(`    ${c} — this exclusion class went UNREAD (\`excluded[].peeked: false\`): its effects are absent because nothing looked, not because there are none. Re-run the producing scan WITH a \`deny\`/\`pure\` policy so the peek reads it (candor-ts <dir> --policy <file>)`);
-  console.log(`    ${tail} ${gateLine(comp)}`);
+  console.log(`    ${tail} ${gateLine(comp, prefix)}`);
 };
 
 // The MACHINE half. Spread LAST so the verb's own pinned key order is untouched (JS objects keep insertion
@@ -280,9 +387,9 @@ const withCompleteness = (data, comp) => ({ ...data, ...completenessFields(comp)
 // half to disagree, which is exactly the mutant (`ec1a441`) that survived a whole suite in candor-rust.
 // `proseFn` receives the hedge flag as its second argument so it can WITHDRAW its reassuring sentence; the
 // note alone is not enough, because "no Unknown sources ✓" IS the prose spelling of the empty JSON.
-const putAnswer = (a, data, proseFn, comp, soWhat, tail) => {
+const putAnswer = (a, data, proseFn, comp, soWhat, tail, prefix) => {
   if (!proseFn || wantJsonOut(a)) { emit(withCompleteness(data, comp)); return data; }
-  incompleteAnswerNote(comp, soWhat, tail);
+  incompleteAnswerNote(comp, soWhat, tail, prefix);
   proseFn(data, mustHedge(comp));
   return data;
 };
@@ -340,12 +447,12 @@ const putAnswer = (a, data, proseFn, comp, soWhat, tail) => {
 // it delegated to `putAnswer`, whose `{ ...data, ...{} }` turned `show`'s ARRAY into `{"0": {…}}` — the
 // pinned top-level array destroyed on the very path this rung promises to leave byte-identical. Caught by
 // the intact-input control before it left the machine. So the healthy arm emits `data` itself.
-const putNestedWithCaveat = (a, key, data, proseFn, comp, soWhat, tail) => {
+const putNestedWithCaveat = (a, key, data, proseFn, comp, soWhat, tail, prefix) => {
   if (!proseFn || wantJsonOut(a)) {
     emit(mustHedge(comp) ? { [key]: data, ...completenessFields(comp) } : data);
     return data;
   }
-  incompleteAnswerNote(comp, soWhat, tail);
+  incompleteAnswerNote(comp, soWhat, tail, prefix);
   proseFn(data, mustHedge(comp));
   return data;
 };
@@ -1333,7 +1440,8 @@ switch (cmd) {
     // under `functions` BESIDE the caveat rather than being replaced by it: `show` certifies nothing.
     putNestedWithCaveat(args, "functions", coreShow(loadReportOrDie(prefix), q), P.show, reportCompleteness(prefix),
       `the function(s) shown below are only those candor could SEE match \`${q}\``,
-      "A function in an unread unit is ABSENT from the report, so it cannot be shown here at all. Re-scan for a complete answer.");
+      "A function in an unread unit is ABSENT from the report, so it cannot be shown here at all. Re-scan for a complete answer.",
+      prefix);
     break;
   }
   case "where": {
@@ -1356,7 +1464,8 @@ switch (cmd) {
     // by measurement. The caveat rides the SAME document (see `putAnswer`); the exit code does not move.
     putAnswer(args, coreWhere(fnsW, eff), P.where, reportCompleteness(prefix),
       `the function(s) named below are only those candor could SEE perform ${eff}`,
-      `A function in an unread unit is ABSENT from the report, so it cannot appear in either list. Re-scan for a complete answer.`);
+      `A function in an unread unit is ABSENT from the report, so it cannot appear in either list. Re-scan for a complete answer.`,
+      prefix);
     break;
   }
   case "callers": {
@@ -1427,7 +1536,7 @@ switch (cmd) {
         // `{"direct": []}`. The sidecar-absence sentence is a DIFFERENT limitation (an effect-only graph)
         // and does not cover a report whose own `excluded` names a class nothing opened.
         putAnswer(args, {}, () => console.log(`candor: no caller of \`${q}\` in the effect-relevant graph (the full call-graph sidecar is absent; re-scan with --out to see pure-only callers).`),
-          reportCompleteness(prefix), CALLERS_SOWHAT, CALLERS_TAIL);
+          reportCompleteness(prefix), CALLERS_SOWHAT, CALLERS_TAIL, prefix);
         break;
       }
       console.error(`candor-ts-query callers: no function matching '${q}' in the call graph`); process.exit(2);
@@ -1440,7 +1549,7 @@ switch (cmd) {
     // collision, and the exit does not move. `show`/`map` OVER-hedged (`putNestedWithCaveat` above, and
     // the descriptive/certifying boundary is stated there); these three UNDER-hedged, which is the
     // direction this family calls the cardinal sin.
-    putAnswer(args, cres, P.callers, reportCompleteness(prefix), CALLERS_SOWHAT, CALLERS_TAIL);
+    putAnswer(args, cres, P.callers, reportCompleteness(prefix), CALLERS_SOWHAT, CALLERS_TAIL, prefix);
     break;
   }
   case "map": {
@@ -1454,7 +1563,8 @@ switch (cmd) {
     // keeps the answer: `map` certifies nothing, so there was never a claim to withhold.
     putNestedWithCaveat(args, "modules", coreMap(loadReportOrDie(prefix)), P.map, reportCompleteness(prefix),
       "the module rows below cover only the source candor read",
-      "A module living wholly in an unread unit is MISSING from this overview, and one that IS listed may be missing functions. Re-scan for a complete map.");
+      "A module living wholly in an unread unit is MISSING from this overview, and one that IS listed may be missing functions. Re-scan for a complete map.",
+      prefix);
     break;
   }
   case "containment": {
@@ -1492,12 +1602,14 @@ switch (cmd) {
       putAnswer(args, r, P.containment,
         absorbCompleteness(reportCompleteness(prefix), reportCompleteness(basePrefix)),
         "the leak set below is a difference over only the code candor read on BOTH sides",
-        "An unread unit of the current tree hides a leak; an unread unit of the baseline manufactures one. Re-scan both before moving the ratchet.");
+        "An unread unit of the current tree hides a leak; an unread unit of the baseline manufactures one. Re-scan both before moving the ratchet.",
+        prefix);
       process.exit(r.leaks.length ? 1 : 0);
     }
     putAnswer(args, coreContainment(loadReportOrDie(prefix)), P.containment, reportCompleteness(prefix),
       "the containment scores below cover only the boundary effects candor could see",
-      "A boundary effect in an unread unit is in no layer's count, so a dispersed effect can score as contained. Re-scan for a complete picture.");
+      "A boundary effect in an unread unit is in no layer's count, so a dispersed effect can score as contained. Re-scan for a complete picture.",
+      prefix);
     break;
   }
   case "diff": {
@@ -1547,9 +1659,9 @@ switch (cmd) {
     if (wantJsonOut(args)) emit(diffDoc);
     else {
       incompleteAnswerNote(dCur, "the changes below are computed only over effects candor read in the CURRENT tree and may be SHORT",
-        "An effect gained or lost in an unread unit of the current tree is not in the list below.");
+        "An effect gained or lost in an unread unit of the current tree is not in the list below.", curPrefix);
       incompleteAnswerNote(dBase, "the BASELINE half of this comparison is itself partial and the floor it sets is soft",
-        "An effect living in an unread unit of the baseline reads as a newly gained or lost change here.");
+        "An effect living in an unread unit of the baseline reads as a newly gained or lost change here.", basePrefix);
       P.diff(diffDoc, mustHedge(dCur) || mustHedge(dBase));
     }
     // diff DISCLOSES (the posture) — it is not a gate. Its gained-effect exit 1 is a convenience for
@@ -1574,7 +1686,8 @@ switch (cmd) {
            effects: Object.fromEntries(Object.entries(byEff).sort()
              .map(([k, v]) => [k, { count: v.length, via: v.sort() }])) }, P.reachable, reportCompleteness(prefix),
       "the runtime effect set below is a union over only the entry points candor could see",
-      "An entry point in an unread unit contributes NOTHING to this union, and neither does any effect it reaches. Re-scan before treating this as the program's runtime surface.");
+      "An entry point in an unread unit contributes NOTHING to this union, and neither does any effect it reaches. Re-scan before treating this as the program's runtime surface.",
+      prefix);
     break;
   }
   case "impact": {
@@ -1641,7 +1754,7 @@ switch (cmd) {
     // above for the measurement and the boundary). `affectedCount: 0` is the strongest claim in this
     // verb's vocabulary, and over a report whose own `excluded` names a class nothing opened it rests on
     // a graph missing whatever lives in that class. Fixed key set, so the caveat spreads in at the root.
-    putAnswer(args, coreImpact(impFns, impCg, q), P.impact, reportCompleteness(prefix), IMPACT_SOWHAT, IMPACT_TAIL);
+    putAnswer(args, coreImpact(impFns, impCg, q), P.impact, reportCompleteness(prefix), IMPACT_SOWHAT, IMPACT_TAIL, prefix);
     break;
   }
   case "blindspots": {
@@ -1659,9 +1772,9 @@ switch (cmd) {
     const bsSoWhat = "the Unknown sources below are only those rooted in a call candor could see";
     const bsTail = "An unread unit contributes no entry at all, so its own Unknowns are not counted here and cannot be. Re-scan before treating this as the blind-spot inventory.";
     if (args.includes("--stats")) {   // ⟨0.20⟩ the reason-class distribution, not the source list
-      putAnswer(args, coreBlindspotsStats(loadReportOrDie(prefix), classFilter), P.blindspotsStats, bsComp, bsSoWhat, bsTail);
+      putAnswer(args, coreBlindspotsStats(loadReportOrDie(prefix), classFilter), P.blindspotsStats, bsComp, bsSoWhat, bsTail, prefix);
     } else {
-      putAnswer(args, coreBlindspots(loadReportOrDie(prefix), loadCallgraph(prefix), classFilter), P.blindspots, bsComp, bsSoWhat, bsTail);
+      putAnswer(args, coreBlindspots(loadReportOrDie(prefix), loadCallgraph(prefix), classFilter), P.blindspots, bsComp, bsSoWhat, bsTail, prefix);
     }
     break;
   }
@@ -1743,7 +1856,8 @@ switch (cmd) {
     }
     incompleteAnswerNote(tourComp,
       "the reaches below are ranked over only the call graph candor could see",
-      "A surprising reach whose path runs through an unread unit is not ranked here at all, and cannot be. Re-scan for the full tour.");
+      "A surprising reach whose path runs through an unread unit is not ranked here at all, and cannot be. Re-scan for the full tour.",
+      prefix);
     if (finds.length === 0) {
       // Effectful-but-nothing-surprising vs genuinely-pure both land here; the honest line is the useful
       // answer (never a manufactured surprise) — mirrors the scan-note fallback + the Rust engine. BUT never
@@ -1822,9 +1936,9 @@ switch (cmd) {
     if (wantJsonOut(args)) emit(gDoc);
     else {
       incompleteAnswerNote(gCur, "the gained set below names only effects candor read in the CURRENT tree and may be SHORT",
-        "An effect introduced in an unread unit of the current tree is not in the list below.");
+        "An effect introduced in an unread unit of the current tree is not in the list below.", curPrefix);
       incompleteAnswerNote(gBase, "the BASELINE half of this comparison is itself partial and the floor it sets is soft",
-        "An effect living in an unread unit of the baseline reads as NEWLY gained here — the existing/new origin split is unreliable until the baseline is re-scanned.");
+        "An effect living in an unread unit of the baseline reads as NEWLY gained here — the existing/new origin split is unreliable until the baseline is re-scanned.", basePrefix);
       P.gains(gDoc, mustHedge(gCur) || mustHedge(gBase));
     }
     // Advisory by default (exit 0 — gains is a diff view); `--strict` fails on ANY gained effect so a
@@ -1918,7 +2032,7 @@ switch (cmd) {
       // The note goes on STDOUT with the answer it qualifies, like every other verb here: a caveat on the
       // other stream is one `2>/dev/null` from gone. `renderPathHuman` takes the hedge flag so its two
       // determined-negative sentences ("does not perform", "not statically traceable") can withdraw.
-      incompleteAnswerNote(pcomp, PATH_SOWHAT, PATH_TAIL);
+      incompleteAnswerNote(pcomp, PATH_SOWHAT, PATH_TAIL, prefix);
       renderPathHuman(fns, cg, fn, eff, mustHedge(pcomp));
     }
     break;
@@ -1966,8 +2080,8 @@ switch (cmd) {
     // ⟨0.28⟩ …and the count-0 cause, which reaches here through a LIVE §2.2 sidecar: the target resolves
     // over the call graph, so this verb answers `ok: true` where the report-only verbs exit 2 on the name.
     // MEASURED exactly so — the pre-edit gate check, green, over a report that judged nothing.
-    if (wcomp.judgedNothing.length) advisoryJudgedNothingNote("whatif");
-    if (wcomp.noManifest.length) advisoryNoManifestNote("whatif", wcomp.noManifest);
+    if (wcomp.judgedNothing.length) advisoryJudgedNothingNote("whatif", certainViolationFromPolicy(pol, prefix));
+    if (wcomp.noManifest.length) advisoryNoManifestNote("whatif", wcomp.noManifest, certainViolationFromPolicy(pol, prefix));
     if (wcomp.unreadable.length) advisoryUnreadableNote("whatif", wcomp.unreadable);
     // ⟨0.28⟩ SPEC §2 — a CONFIGURED policy that parsed to zero rules asked nothing, so the pre-edit
     // verdict AND the blast radius it qualifies are withheld in favour of the caveat document. The exit
@@ -2059,8 +2173,8 @@ switch (cmd) {
     // ⟨0.28⟩ …and the count-0 cause, which reaches the DOCUMENT and the PROSE but deliberately NOT the exit
     // below (see `advisoryAnswer`). Leaving it out would have let this verb print a remedy list beside
     // `ok: true` over a report that judged nothing — the same false all-clear, arriving by omission.
-    if (fgComp.judgedNothing.length) advisoryJudgedNothingNote("fix-gate");
-    if (fgComp.noManifest.length) advisoryNoManifestNote("fix-gate", fgComp.noManifest);
+    if (fgComp.judgedNothing.length) advisoryJudgedNothingNote("fix-gate", certainViolationFromPolicy(fgpol, prefix));
+    if (fgComp.noManifest.length) advisoryNoManifestNote("fix-gate", fgComp.noManifest, certainViolationFromPolicy(fgpol, prefix));
     if (fgComp.unreadable.length) advisoryUnreadableNote("fix-gate", fgComp.unreadable);
     // ⟨0.24⟩ SPEC §3.2 `4fd140c` — and the same posture for a rule the GATE refused: no remedy is computed
     // from evidence the gate declined to read, the refusal is disclosed on both channels, and `--strict`
@@ -2150,8 +2264,8 @@ switch (cmd) {
     if (uUnan.length) advisoryIncompleteNote("unverified", uUnan);
     // ⟨0.28⟩ …and the count-0 cause. MEASURED before this line: `{ok: true, unverified: []}` over a report
     // that judged nothing — this verb certifying a package it never examined. The exit is untouched.
-    if (uComp.judgedNothing.length) advisoryJudgedNothingNote("unverified");
-    if (uComp.noManifest.length) advisoryNoManifestNote("unverified", uComp.noManifest);
+    if (uComp.judgedNothing.length) advisoryJudgedNothingNote("unverified", certainViolationFromPolicy(upol, prefix));
+    if (uComp.noManifest.length) advisoryNoManifestNote("unverified", uComp.noManifest, certainViolationFromPolicy(upol, prefix));
     if (uComp.unreadable.length) advisoryUnreadableNote("unverified", uComp.unreadable);
     // ⟨0.24⟩ SPEC §3.2 `4fd140c` — the function the gate could not judge is NAMED in `unverified` above,
     // with the missing evidence as its reason; this is the human channel for the same fact.

package/scan.mjs

@@ -1883,6 +1883,16 @@ const depChained = () => depReportsRead > 0;
 // serde_json rule the Rust/JVM engines already carry; /code-review found TS missing it). Fed from
 // the envelope's `package` field (works for an all-pure EMPTY report) and from entry hash prefixes.
 const depCoveredPkgs = new Set();
+// ⟨scan-boundary, dynamic re-export⟩ Packages whose OWN report declares a `dynamicReexport` site (see
+// the producer-side `dynamicReexportSites` counter): `Object.keys(impl).forEach(k => exports[k] =
+// impl[k])` and its `Object.defineProperty(exports, k, …)` twin forward names no static matcher can
+// enumerate, so a chained package doing this cannot be trusted the way SPEC §2 rule 3 ordinarily trusts
+// a covered package's silence — the missing name might be exactly one the runtime loop forwards. This is
+// the fifth "neither voice fired" instance (`1d4f648`, filed not fixed): NEVER resolved (minting an alias
+// for a runtime-computed key is a guess), only disclosed, at the one place `disclosureTail` already
+// trusts a covered package's silence. `!stale` guards it below, same discipline as `netClass`/`incomplete`
+// two sections down — an untrusted report's assertions (even an honest-sounding one) are not ours to repeat.
+const dynamicReexportPkgs = new Set();
 // Packages whose ONLY chained report failed the §2.1 version check. Kept OUT of `depCoveredPkgs`, because a
 // report the engine has decided not to trust cannot make a coverage claim on the package's behalf: §2 rule 3
 // turns a report's SILENCE into a purity claim, and §2.1 exists to say this report's assertions are not ours
@@ -2163,6 +2173,12 @@ const corruptDepPkgs = new Set();
       if (corrupt) console.error(`candor-ts: chained dependency report ${f} has ${corruptKeys.length} present-but-unparseable §2 key(s)`
         + ` — granted NO coverage, so calls into it read as INVISIBLE rather than pure (SPEC §2 ⟨0.24⟩): ${corruptKeys.join("; ")}`);
       if (typeof d.package === "string" && d.package) covers.add(d.package);
+      // ⟨scan-boundary, dynamic re-export⟩ a STALE report's OWN assertion of anything, including this
+      // one, is not ours to repeat (§2.1) — a build we do not trust cannot vouch for its own shape either.
+      // Purely ADDITIVE otherwise: it can only widen `disclosureTail`'s Unknown arm, never narrow it, so a
+      // garbled or over-eager value here can never fabricate a purity claim.
+      if (!stale && d.dynamicReexport && typeof d.package === "string" && d.package)
+        dynamicReexportPkgs.add(d.package);
       // NEVER ITERATE AN UNREADABLE VALUE. `d.functions ?? []` walked the CHARACTERS of `functions: "oops"`,
       // and `strs()` is why `inferred: "Fs"` can no longer arrive at the consumer as the effect set
       // `['F','s']` — the `??` idiom only guards null/undefined, and every other wrong type in this format
@@ -2518,6 +2534,113 @@ function crossesPackageBoundary(file) {
   return !!own && own !== pkgName && own !== rootOwnerPkg;
 }
 
+// ⟨fabrication, own-name-collides-with-κ⟩ Is `decl` OUR OWN scanned package's code, reached through a
+// route that makes it LOOK like an external dependency? `declModule`'s `nearestPackageName` fallback
+// fires exactly when a declaration's file isn't in `projectFiles` and has no `node_modules/` segment —
+// the shape of a package's own co-located `dist/foo.js` + `dist/foo.d.ts` (⟨scan-boundary,
+// own-`.d.ts`-shadow⟩ above). That fallback returns the SCANNED package's own `name`, and if that name
+// collides with a whole-module κ rule that has a `null` member-regex (got/pg/fs-extra/execa/dotenv/
+// winston/bcrypt/… — every effect in §1 has at least one), `kappa(ownName, anything)` matches
+// unconditionally: the package's OWN internal calls get charged its own external effect merely because
+// nobody else installed a package by that name. Measured: `super(x)` into a same-package base class,
+// `new ns.Ctor()`, `obj.method()`, and a bare call whose `.js` sibling isn't in `projectFiles` all
+// resolve `mod` to the scanned package's own name with no redirect to catch it (the `.d.ts`-shadow
+// redirect above only recovers the bare-identifier-with-sibling shape).
+//
+// FILE-based, never name-based: a package that genuinely DEPENDS ON an installed node_modules copy of
+// a same-named package (self-referential publish, `npm link` loops) must still be charged — that file's
+// path always carries a `node_modules/` segment (a different `declModule` branch entirely), so it's
+// excluded outright before the name comparison ever runs.
+//
+// "our own package" mirrors `crossesPackageBoundary`'s own definition of "us" — both `pkgName` and
+// `rootOwnerPkg`, because they can differ (see the comment above).
+function isOwnPackageDecl(decl) {
+  const f = path.resolve(decl.getSourceFile().fileName);
+  if (/node_modules\//.test(f)) return false;
+  const own = nearestPackageName(f);
+  return !!own && (own === pkgName || own === rootOwnerPkg);
+}
+
+// ⟨vein: neither-voice-fired, ATTEMPTED AND REVERTED⟩ `crossesPackageBoundary` answers FALSE for two
+// different reasons that get the same boolean: genuinely OUR OWN package, and `nearestPackageName`
+// finding no package.json at all above the file (an unowned file, neither ours nor a dependency's). The
+// second reading looked like the same hole as the `.d.ts`-shadow cardinal sin one level further out, and
+// a fix was drafted (treat `own === null` as boundary-crossing for disclosure purposes). MEASURED false:
+// candor-ts's OWN suite hits this exact shape legitimately — a single-file scan target (`scan.mjs
+// a.ts`, not the whole package directory) whose sibling import (`./mock`) is outside `projectFiles`
+// (only the given file was walked) and sits in a directory with no `package.json` (a temp fixture dir).
+// That sibling is real local code, not a foreign package, and the draft fix charged it `blind` —
+// converting a correct silent-pure into a fabricated over-disclosure, on `test.mjs`'s own pinned CONTROL
+// row. A single-file scan target has no reliable way to tell "no owner because nobody has ever recorded
+// one" apart from "no owner because this scan's OWN target set stops here" — that distinction needs the
+// scan's notion of its own target boundary, not just a file's package.json ancestry, and is a bigger
+// change than this pass's remit. Left as a filed, un-closed finding rather than shipped: the corpus and
+// this codebase's own tests could not tell it apart from a real project file.
+
+// ⟨scan-boundary, own-`.d.ts`-shadow⟩ npm ships `dist/foo.js` beside `dist/foo.d.ts`, and TypeScript's own
+// module resolution treats the co-located `.d.ts` as the AUTHORITATIVE type source for every IMPORTER of
+// `foo.js` — even one this same scan (`--allow-js`) is analysing as project source. A same-file reference
+// (`this.method()`, a call inside the file that DECLARES the callee) never crosses a module boundary, so it
+// resolves straight to the `.js` implementation and is unaffected; a CROSS-FILE call — the ordinary case
+// for a helper imported from a sibling module — resolves the checker's signature onto a node IN THE
+// `.d.ts` instead (measured: got's own `calculateRetryDelay({...})`, called from `core/index.ts`'s
+// `_beforeError`, and `new RequestError(...)`/`new TimeoutError(...)` alike). `declModule` is RIGHT to
+// call that `.d.ts` foreign to `projectFiles` (the file walk deliberately excludes every `.d.ts`, ⟨§2⟩) —
+// but nothing downstream of that classification was built for "foreign file that is secretly the scan's
+// own code": `crossesPackageBoundary` is (correctly) false for it, so the cross-package arm's `blind`/
+// `unanswerableKey` disclosures both decline to fire, on file identity they were never wrong about — and
+// the call vanishes. Silent, on the DIRECT-effect gate this package's retry path failed the source arm on.
+//
+// The fix resolves rather than hedges: ask the SIBLING IMPLEMENTATION FILE — same directory, same
+// basename, an extension this scan actually analysed (`projectFiles`, so an `@types/node`-style
+// declaration-only package with no such sibling is untouched by any of this) — for its OWN module symbol
+// directly. That is not a cross-module import lookup (the thing the `.d.ts`-preference rule governs); it
+// is asking a SourceFile already open in this program about its own exports, and the checker answers with
+// the REAL declaration (the arrow function's `VariableDeclaration`, the class itself for a constructor —
+// exactly the nodes `nodeName` already minted units against in pass 1). A callee name that names exactly
+// one export redirects `decl`/`mod` to it, so every existing `<local>` arm downstream (class-CHA fan-out,
+// HOF callback flow, coercion desugars) runs precisely as it would have on an ordinary same-package call —
+// no parallel machinery, no new report shape. A name that matches NOTHING in the sibling (an export
+// `nodeName` never minted a unit for) or matches MORE THAN ONE declaration (never guess, the family's
+// standing rule) still owes a disclosure: `Unknown`, not silence, for the same reason the cross-package
+// arm discloses when it can name an owner but not a body.
+function siblingImplFile(dtsFileName) {
+  const m = dtsFileName.match(/\.d\.([cm]?)ts$/);
+  if (!m) return null;
+  const stem = dtsFileName.slice(0, -m[0].length);
+  const exts = m[1] === "m" ? [".mjs", ".mts"] : m[1] === "c" ? [".cjs", ".cts"]
+    : [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx"];
+  for (const ext of exts) { const cand = stem + ext; if (projectFiles.has(cand)) return cand; }
+  return null;
+}
+// implFile -> Map<exportedLocalName, declaration | undefined>. `undefined` marks a name TWO DIFFERENT
+// declarations in the same file both claim (never happens for ordinary JS/TS top-level bindings, kept as
+// a guard rather than an assumption) — treated identically to "not found" by every caller (`.get` returns
+// the same falsy value either way), so a collision degrades to disclosure, never a guess.
+const siblingModuleNameMap = new Map();
+function siblingImplExports(implFile) {
+  if (siblingModuleNameMap.has(implFile)) return siblingModuleNameMap.get(implFile);
+  const map = new Map();
+  const sf = program.getSourceFile(implFile);
+  const modSym = sf && checker.getSymbolAtLocation(sf);
+  if (modSym) {
+    let exps = [];
+    try { exps = checker.getExportsOfModule(modSym); } catch { exps = []; }
+    for (const ex of exps) {
+      let target = ex;
+      if (target.flags & ts.SymbolFlags.Alias) { try { target = checker.getAliasedSymbol(target); } catch { continue; } }
+      for (const d of target?.declarations ?? []) {
+        if (d.getSourceFile().fileName !== implFile) continue;
+        const nm = d.name?.getText?.();
+        if (!nm) continue;
+        map.set(nm, map.has(nm) && map.get(nm) !== d ? undefined : d);
+      }
+    }
+  }
+  siblingModuleNameMap.set(implFile, map);
+  return map;
+}
+
 // ⟨0.19⟩ The bare-package ROOT of an import specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`,
 // a relative/absolute path → null (not a package). Used to match an import against `declaredButUninstalled`.
 function pkgRoot(spec) {
@@ -2864,6 +2987,80 @@ const fns = new Map();           // qualified name -> { direct, edges, hosts, ta
 const bodylessDecls = new Map(); // qual -> {node, mod, abstract, owner, member}
 const unlistedSeen = new Map();  // the κ-coverage ledger: unlisted npm package -> call-site count
 const nodeName = new WeakMap();  // declaration node -> qualified name
+// ⟨scan-boundary, export-alias⟩ `module.exports = { thing: _internalImplName }` / `exports.thing =
+// _internalImplName` — a RENAMED re-export whose RHS NAMES an EXISTING declaration rather than being an
+// inline function. `localName` mints a CJS unit for `module.exports = function(){}` and
+// `exports.foo = function(){}` (the inline-literal shapes), but a reference names no NEW node to hang a
+// unit off — the referenced function already has its own unit, under its OWN name. Without this, the
+// package's report keys the effect under `_internalImplName` only; a consumer whose `.d.ts` types the
+// import as `thing` (the ordinary case: a hand- or tool-written `.d.ts` has no static connection to the
+// `.js` runtime shape at all) joins a key the report never had, reads SILENT-PURE, and a real effect
+// vanishes at the package boundary. Candidates are collected here (during the same walk that mints every
+// unit) and resolved in ONE place — see below — after every source file's units exist, because the
+// referenced declaration may sit in a later file or a later line of the same one.
+//
+// FOUR spellings feed this list, not one: a bare BinaryExpression assignment (`exports.thing = impl`,
+// `module.exports.thing = impl`, the bracket variants `exports['thing'] = impl`), the whole-object
+// literal (`module.exports = { thing: impl }`), and `Object.defineProperty(exports, "thing", { get(){
+// return impl } })` — TSC's OWN standard CommonJS emit for `export { x } from './impl'`, and what
+// webpack/rollup's ESM<->CJS interop shims emit too, so it is not an exotic shape but a large fraction of
+// what published packages actually ship. A single-statement enumeration of assignment shapes proved not
+// to be the family boundary: the descriptor form is a structurally different node (a CallExpression, not
+// a BinaryExpression) that carries the SAME "name binds to an existing thing" meaning. What IS shared
+// across every spelling, and is what actually closes the class rather than the next syntax, is `exportAliasRef`
+// below: the checker's own alias resolution (`getSymbolAtLocation` + `getAliasedSymbol`, used identically
+// in the resolution pass beneath) walks through a bare identifier AND a namespace-member access
+// (`impl_1.x`, what TSC emits for a CROSS-FILE re-export's `require()` binding) to the same real
+// declaration — so every collection site here only needs to recognize the SHAPE that carries a reference,
+// not resolve it; resolution is one shared mechanism, checked, not matched.
+const exportAliasCandidates = []; // [{mod, name, ident}] — ident is the reference naming the real decl
+const aliasHashTail = new Map();  // alias qual -> the exported name `unitHash` must use INSTEAD of rec.local
+// ⟨scan-boundary, dynamic re-export⟩ THE FIFTH "neither voice fired" instance (see `dynamicReexportPkgs`
+// at the consumer side; filed, not attempted, at `1d4f648`): `Object.keys(impl).forEach(k => { exports[k]
+// = impl[k]; })` and its `Object.defineProperty(exports, k, …)` twin (tslib/rollup's `__exportStar`
+// generalizes into this when the forwarded name is itself computed) bind an export name to a RUNTIME
+// STRING no static per-statement matcher can read — resolving it would be guessing, not analysis, so
+// unlike `exportAliasCandidates` above this is never resolved into a name. What CAN be established
+// without naming a single one: whether this package performs a dynamic re-export AT ALL. A count, not a
+// boolean, purely for a human reading the report; the consumer-side gate only asks whether it is nonzero.
+let dynamicReexportSites = 0;
+// A WELL-KNOWN SYMBOL key (`Symbol.toStringTag`, `Symbol.iterator`, …) is not a forwarded NAME — it is a
+// fixed, statically-known value the same in every build, and `import { name } from 'pkg'` can never bind
+// to a Symbol-keyed property in the first place (there is no string spelling that reaches it). MEASURED
+// as a false-positive source on the real corpus: `Object.defineProperty(exports, Symbol.toStringTag, {
+// value: "Module" })` is esbuild/Rollup/tsup's own standard ESM-interop stamp, present in a large
+// fraction of published bundled CJS output (`@simple-git/args-pathspec`, `@simple-git/argv-parser`), and
+// carries no forwarding semantics at all — flagging it as a dynamic re-export would mark ordinary bundled
+// packages "dynamic" and disclose Unknown over every one of their calls for no real reason. `Symbol.for(x)`
+// with a non-literal `x` is a genuinely dynamic symbol and is NOT excluded here — only a plain `Symbol.<id>`
+// well-known-symbol access is.
+function isWellKnownSymbolKey(keyArg) {
+  return ts.isPropertyAccessExpression(keyArg) && ts.isIdentifier(keyArg.expression) && keyArg.expression.text === "Symbol";
+}
+// True when `lhs` is `exports[K]` / `module.exports[K]` with K NOT a string literal (and not the
+// well-known-symbol false positive above) — the bracket-alias site above (`cjsExportPropertyName`)
+// already claims the string-literal case (`exports['thing']`, answerable); this claims exactly what that
+// one structurally cannot: a key no static read can name. A non-exports element access (`someObj[k] = v`)
+// is not this pattern and returns false.
+function isDynamicExportsKeyWrite(lhs) {
+  if (!ts.isElementAccessExpression(lhs) || !lhs.argumentExpression) return false;
+  if (ts.isStringLiteralLike(lhs.argumentExpression)) return false;
+  if (isWellKnownSymbolKey(lhs.argumentExpression)) return false;
+  const b = lhs.expression.getText().replace(/\s+/g, "");
+  return b === "exports" || b === "module.exports";
+}
+// The `Object.defineProperty(exports, K, desc)` twin of the above — the descriptor-form alias site
+// (`Object.defineProperty(exports, "thing", {...})`) requires `keyArg` to be a string literal; a
+// non-literal, non-well-known-symbol key targeting `exports`/`module.exports` is the identical
+// dynamic-forwarding shape one call form over.
+function isDynamicExportsDescriptor(call) {
+  if (!ts.isCallExpression(call) || call.expression.getText().replace(/\s+/g, "") !== "Object.defineProperty") return false;
+  if (call.arguments.length < 2) return false;
+  const targetText = call.arguments[0].getText().replace(/\s+/g, "");
+  if (targetText !== "exports" && targetText !== "module.exports") return false;
+  const keyArg = call.arguments[1];
+  return !ts.isStringLiteralLike(keyArg) && !isWellKnownSymbolKey(keyArg);
+}
 // ORM table declarations: `@Entity("user")` on a class maps that class to its table — the JVM's
 // read-the-declarations move (TypeORM tables live in decorators, not SQL strings, so the `tables`
 // surface couldn't fire on the most common TS app shape). LITERAL decorator arg only; a no-arg
@@ -3162,6 +3359,49 @@ function localName(node) {
   }
   return null;
 }
+// A reference the export-alias pass (see `exportAliasCandidates` above) can resolve THROUGH: a bare
+// local identifier (`_internalImplName`, the same-file case) or a namespace-member access (`impl_1.x`,
+// what tsc emits for a CROSS-FILE `export { x } from './impl'` — `impl_1` is the `require()` binding,
+// and `checker.getSymbolAtLocation` walks straight through the member access to the real declaration in
+// the required file, MEASURED: compiling `export { x } from './impl'` with this repo's own tsc and
+// resolving the emitted `impl_1.x` returns `impl.js`'s `FunctionDeclaration` directly). Anything else — a
+// call, a template, a ternary — names no single declaration to alias and is deliberately left alone; the
+// resolution pass's existing `nodeName.has(decl)` gate is the actual safety net (a reference that resolves
+// to something this scan never minted a unit for adds nothing), so widening the accepted SHAPE here can't
+// by itself fabricate an alias.
+const exportAliasRef = (node) => ts.isIdentifier(node) || ts.isPropertyAccessExpression(node);
+// The property name a single-property CJS export assignment's LHS names: `exports.NAME` /
+// `module.exports.NAME` (PropertyAccessExpression) or the bracket spelling `exports['NAME']` /
+// `module.exports['NAME']` (ElementAccessExpression with a string-literal key — a COMPUTED key names no
+// single property and returns null, the same "never guess" rule as everywhere else in this pass).
+function cjsExportPropertyName(lhs) {
+  const baseText = (n) => n.getText().replace(/\s+/g, "");
+  if (ts.isPropertyAccessExpression(lhs)) {
+    const b = baseText(lhs.expression);
+    return (b === "exports" || b === "module.exports") ? lhs.name.text : null;
+  }
+  if (ts.isElementAccessExpression(lhs) && lhs.argumentExpression && ts.isStringLiteralLike(lhs.argumentExpression)) {
+    const b = baseText(lhs.expression);
+    return (b === "exports" || b === "module.exports") ? lhs.argumentExpression.text : null;
+  }
+  return null;
+}
+// The reference an accessor DESCRIPTOR property resolves to: a data descriptor's `value: REF`, or a
+// `get(){ return REF; }` / `get: () => REF` accessor's sole returned expression (checked against
+// `exportAliasRef` at the call site, same as every other candidate). A getter doing anything more than
+// returning one expression is left alone — that is a real computed accessor, not a rename.
+function descriptorAliasRef(descProp) {
+  if (!ts.isPropertyAssignment(descProp) || ts.isComputedPropertyName(descProp.name)) return null;
+  const name = descProp.name.text ?? descProp.name.getText();
+  if (name === "value") return descProp.initializer;
+  if (name !== "get") return null;
+  const fn = descProp.initializer;
+  if (!(ts.isFunctionExpression(fn) || ts.isArrowFunction(fn)) || !fn.body) return null;
+  if (!ts.isBlock(fn.body)) return fn.body; // arrow concise body: () => REF
+  if (fn.body.statements.length !== 1) return null;
+  const s = fn.body.statements[0];
+  return ts.isReturnStatement(s) && s.expression ? s.expression : null;
+}
 // True when `node` is lexically inside a FUNCTION body — so its bare local name can collide with a
 // module-level or sibling-scope unit of the same name (see the qual disambiguation below). A namespace/
 // module block and the source file are NOT function scopes (their members are top-level units).
@@ -3238,6 +3478,58 @@ for (const sf of sources) {
       }
       nodeName.set(node, ctorQual);
     }
+    // CJS EXPORT-ALIAS candidate (see `exportAliasCandidates` above): `module.exports = { thing:
+    // _internalImplName }` / `exports.thing = _internalImplName` / `module.exports.thing =
+    // _internalImplName` / the bracket spelling `exports['thing'] = _internalImplName`, where the RHS
+    // is a reference (`exportAliasRef`) rather than the inline-function shapes `localName` below already
+    // handles. Recorded, not resolved, here — resolution needs every file's units minted first.
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+      const lhs = node.left.getText().replace(/\s+/g, "");
+      const rhs = node.right;
+      if (lhs === "module.exports" && ts.isObjectLiteralExpression(rhs)) {
+        for (const p of rhs.properties) {
+          if (ts.isPropertyAssignment(p) && !ts.isComputedPropertyName(p.name) && exportAliasRef(p.initializer))
+            exportAliasCandidates.push({ mod, name: p.name.text ?? p.name.getText(), ident: p.initializer });
+          // ⟨scan-boundary, dynamic re-export⟩ `module.exports = { [k]: impl[k] }` — the same runtime-string
+          // binding as the bracket-write/descriptor forms, one more spelling over: a COMPUTED property name
+          // in the whole-object reassignment itself. A literal-wrapped computed key (`{ ['thing']: fn }`) is
+          // still statically knowable and excluded, same as everywhere else in this pass.
+          else if (ts.isPropertyAssignment(p) && ts.isComputedPropertyName(p.name)
+                   && !ts.isStringLiteralLike(p.name.expression) && !isWellKnownSymbolKey(p.name.expression))
+            dynamicReexportSites += 1;
+        }
+      } else {
+        const name = cjsExportPropertyName(node.left);
+        if (name && exportAliasRef(rhs)) exportAliasCandidates.push({ mod, name, ident: rhs });
+      }
+    }
+    // CJS EXPORT-ALIAS candidate, DESCRIPTOR form: `Object.defineProperty(exports, "thing", { get(){
+    // return _internalImplName } })` — TSC's OWN standard CommonJS emit for `export { x } from './impl'`
+    // (verified against this repo's own tsc output), and what webpack/rollup's ESM<->CJS interop shims
+    // emit too. `descriptorAliasRef` pulls the getter's returned expression (or a data descriptor's
+    // `value`); `exportAliasRef` accepts it whether it's a bare identifier (same-file) or a
+    // `require()`-binding member access (cross-file re-export) — the SAME reference shape the
+    // BinaryExpression arm above accepts, resolved by the identical mechanism below.
+    if (ts.isCallExpression(node) && node.expression.getText().replace(/\s+/g, "") === "Object.defineProperty"
+        && node.arguments.length >= 3) {
+      const targetText = node.arguments[0].getText().replace(/\s+/g, "");
+      const keyArg = node.arguments[1], descArg = node.arguments[2];
+      if ((targetText === "exports" || targetText === "module.exports")
+          && ts.isStringLiteralLike(keyArg) && ts.isObjectLiteralExpression(descArg)) {
+        for (const p of descArg.properties) {
+          const ref = descriptorAliasRef(p);
+          if (ref && exportAliasRef(ref)) { exportAliasCandidates.push({ mod, name: keyArg.text, ident: ref }); break; }
+        }
+      }
+      if (isDynamicExportsDescriptor(node)) dynamicReexportSites += 1;
+    }
+    // ⟨scan-boundary, dynamic re-export⟩ `exports[k] = impl[k]` / `module.exports[k] = impl[k]` — the
+    // fifth "neither voice fired" instance. NOT collected into `exportAliasCandidates`: there is no
+    // NAME here to alias, only a runtime string. Counted, so the package-level `dynamicReexport` envelope
+    // field a chained consumer reads is not zero — see `dynamicReexportSites` above for why a count
+    // rather than a bare boolean, and `dynamicReexportPkgs` for what the consumer does with it.
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken
+        && isDynamicExportsKeyWrite(node.left)) dynamicReexportSites += 1;
     const n = localName(node);
     const isCjsExport = _lastCjs; // captured immediately: localName set it for THIS node only
     if (n) {
@@ -3307,6 +3599,46 @@ for (const sf of sources) {
   })(sf);
 }
 
+// Resolve the CJS export-alias candidates collected above, now that every source file's units exist.
+// `ident` (an Identifier OR a PropertyAccessExpression — see `exportAliasRef`) names a value at its use
+// site; follow it through an import alias (the got/`.d.ts`-shadow fix's own move) to the declaration it
+// actually names — the SAME `getSymbolAtLocation` + `getAliasedSymbol` move resolves a bare identifier
+// (the same-file case) and a `require()`-binding member access (`impl_1.x`, the cross-file re-export
+// case) identically, with no separate code path — and only act when that declaration is a unit THIS scan
+// already minted (`nodeName.has`) — a reference that resolves to nothing local, to an ambient/foreign
+// declaration, or to more than one candidate declaration (never guess) adds nothing, and the existing
+// disclosure ladder (blind / unanswerableKey) keeps whatever it already said about the miss. A name that
+// collides with an EXISTING, DIFFERENT unit is skipped rather than overwritten — this pass only ADDS a key
+// a real declaration is missing, never reassigns one that already means something else. The alias shares
+// the SAME record as the original (not a copy): every Set it carries (`direct`, `edges`, `hosts`, …) is
+// the identical object, so the pass-3 fixpoint below — driven by iterating `fns` — computes the identical
+// effect closure for both names with no separate bookkeeping, and the ONE place that would otherwise
+// diverge (`unitHash`, keyed off `rec.local`) is corrected via `aliasHashTail` so the alias's report entry
+// carries the ALIAS's own hash, not the original's.
+//
+// CLASSES ARE EXCLUDED ON PURPOSE. `export class Setter {}` compiles to `class Setter {} exports.Setter =
+// Setter;` — a SELF-referential CJS export, not a rename — and the identifier resolves to the
+// ClassDeclaration, whose OWN unit is the SYNTHESIZED CONSTRUCTOR (`nodeName` keys it under
+// `mod.Setter.constructor`, never bare `mod.Setter`; that IS the hash tail an external `new Setter()`
+// already joins via `chargeExternalDecl`'s `tailOverride`). Treating the export statement as a candidate
+// would build `aliasQual = mod.Setter` — DIFFERENT from the ctor's own qual — and mint a SPURIOUS second
+// hash for it. Measured against date-fns's compiled `fp/cdn.js` (a duplicated bundle) and
+// `parse/_lib/Setter.js`: two UNRELATED classes both named `ValueSetter` already share the bare-name hash
+// `date-fns#ValueSetter` (a pre-existing collision this fix must not add a THIRD contributor to), and
+// aliasing the class production would have done exactly that.
+for (const { mod, name, ident } of exportAliasCandidates) {
+  let sym = checker.getSymbolAtLocation(ident);
+  if (sym && sym.flags & ts.SymbolFlags.Alias) { try { sym = checker.getAliasedSymbol(sym); } catch { sym = undefined; } }
+  const decl = (sym?.declarations ?? []).find((d) => nodeName.has(d) && !ts.isClassDeclaration(d));
+  if (!decl) continue;
+  const qual = nodeName.get(decl);
+  const rec = fns.get(qual);
+  const aliasQual = `${mod}.${name}`;
+  if (!rec || aliasQual === qual || fns.has(aliasQual)) continue;
+  fns.set(aliasQual, rec);
+  aliasHashTail.set(aliasQual, name);
+}
+
 // Class-CHA universe (the override half of the Rust engine's local-trait / bounded-CHA move): a
 // method call on a BASE-class-typed receiver resolves statically to the base method, but a SUBCLASS
 // may override it with an effectful body — `class Dog extends Animal { speak(){ fs.readFileSync() } }`.
@@ -3823,6 +4155,32 @@ function unanswerableKey(decl) {
   if ((ts.isMethodDeclaration(decl) || ts.isPropertyDeclaration(decl)
        || ts.isGetAccessorDeclaration(decl) || ts.isSetAccessorDeclaration(decl))
       && (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Abstract)) return decl; // `abstract` member of a declared class
+  // A BARE call/construct signature reached DIRECTLY — not through a property/method (that shape is
+  // already normalized above by `memberSigOf`) but as the callable shape of the value itself:
+  // `interface Fetcher { (url: string): Response }`, a callable type alias, or an intersection of call
+  // signatures (tar's `TarCommand<AsyncClass, SyncClass>` — `exports.create` is typed this way and
+  // reached as a bare `tar.create(...)` call, not a member dispatch). There is no body under this key in
+  // ANY implementation — a call signature declares a shape, never flesh — so a chained report's silence
+  // answers nothing, the same evidential status as an interface method. Measured: --dep-inits chained a
+  // real `tar` scan (its module units DO carry Unknown-tagged effects) and this call still read
+  // SILENT-PURE, because `unanswerableKey` returned null for it — the join correctly found no crossDeps
+  // hit (a bare call signature mints no name to hash), but with no `abstraction` either, neither
+  // disclosure arm fires and the call vanishes from the callgraph. Restricted to a signature with NO
+  // name (`decl.name` is always absent on Call/ConstructSignatureDeclaration, so this never overlaps a
+  // named member) — the same reason PropertySignature/MethodSignature are unconditionally unanswerable.
+  if (ts.isCallSignatureDeclaration(decl) || ts.isConstructSignatureDeclaration(decl)) return decl;
+  // A bare FUNCTION-TYPE node with no redirect above — `memberSigOf` only lifts one whose PARENT is a
+  // property/method signature; this is everything else the checker can still resolve a call onto: a
+  // VALUE-BINDING export's explicit annotation (`export declare const chownr: (p, uid, gid, cb) =>
+  // void`, the shape `.d.ts` emits for `export const chownr = (p, ...) => {...}` — chownr, and any
+  // package using this ordinary TS style, not just tar's intersection-of-call-signatures), a callable
+  // type alias's aliased type, or a parameter/type-argument position. A FunctionTypeNode is a type
+  // annotation, never a body — the same "shape, not flesh" argument as a call/construct signature above
+  // — so landing here means the checker resolved a TYPE, and the join two blocks up already tried and
+  // failed to build a key from it (`nameDecl.name` is undefined on a FunctionTypeNode, so `localTail`
+  // stayed null and no lookup ran) — there is no report shape that could have answered this key, chained
+  // or not, so its absence is not evidence of anything.
+  if (ts.isFunctionTypeNode(decl)) return decl;
   return null;
 }
 // ⟨scan-boundary, half 1⟩ THE DISCLOSURE ITSELF, in ONE place. It had two copies — the CallExpression arm
@@ -3854,29 +4212,22 @@ const dispatchWhy = (qualifiedOwner, member) =>
   qualifiedOwner && member ? `dispatch:${qualifiedOwner}.${member}`
                            : `callback:${qualifiedOwner ?? member ?? "unresolved call"}`;
 
-// Charge `rec` for reaching a resolved EXTERNAL declaration through a DESUGARED site — one that is not a
-// CallExpression, so the (CLASSIFY)/join/ledger arm of the call path never sees it. This is the same
-// decision procedure that arm runs, in the same order: the chained sibling report (the SPEC §2 `hash`
-// join), then the §5.1 package manifest, then the κ-coverage ledger's `invisible`. Nothing is fabricated:
-// a member declared in the ES lib / a project file / an unnameable package resolves to nothing and adds
-// nothing, and a chained report that omits the entry is making its purity claim (SPEC §2 rule 3).
-// `tailOverride` names the dep report's local tail explicitly when the declaration cannot supply it — a
-// CONSTRUCTOR has no `name`, and the producer hashed it as `<Class>.constructor`.
-function chargeExternalDecl(rec, decl, tailOverride) {
-  if (!rec || !decl) return;
-  const mod = declModule(decl);
-  if (!mod || mod.startsWith("<")) return;             // project source / the ES lib — not a package reach
-  const pkg = mod.startsWith("@types/") ? mod.slice("@types/".length) : mod;
-  const nameDecl = memberSigOf(decl); // a function-typed property names its member one level up
-  const member = nameDecl.name?.getText?.();
-  // Owner-prefixed first (`Owner.member` — how the dep's own scan hashes a method), bare member as the
-  // fallback (a CJS dist scan hashes a top-level export under its bare name). Identical to the call arm.
-  const owner = nameDecl.parent?.name?.getText?.();
-  const hit = tailOverride ? crossDeps.get(`${pkg}#${tailOverride}`)
-    : member && ((owner ? crossDeps.get(`${pkg}#${owner}.${member}`) : undefined)
-      ?? crossDeps.get(`${pkg}#${member}`));
-  if (hit) { applyDepHit(rec, hit); return; }
-  const file = decl.getSourceFile().fileName;
+// ⟨THE FUNNEL⟩ Every site that reaches a resolved EXTERNAL declaration whose own κ lookup found nothing
+// answers the SAME question — chained sibling report, §5.1 manifest, κ-coverage ledger, or the
+// unanswerable-key disclosure — and it used to answer it up to four times over, independently, in the
+// CallExpression (CLASSIFY) arm, the desugared-declaration arm (coercion/HOF-ref sites, this function),
+// and the tagged-template arm. Two of those copies drifted out of step with each other and a third never
+// grew the unanswerable-key half at all — the exact "two individually-correct checks whose conjunction is
+// silence" shape hit twice already (⟨0.33⟩ `.d.ts`-shadow, ⟨0.33⟩ `--dep-inits`). `disclosureTail` is now
+// the ONE place that ordering lives; every caller reaches it (directly, or through this function) rather
+// than re-deriving the four-conjunct AND. Its contract: given a declaration already established as an
+// external reach (`mod` computed, not project/lib source), it either adds a real effect (the chained
+// dep's own recorded hit, a declared-pure `[]`), discloses (`blind`, `Unknown`), or does nothing ONLY
+// because the reach is legitimately unaccounted-for by this funnel (κ already reviewed it and said pure,
+// or the dependency's own report already answered by omission — SPEC §2 rule 3) — never a fourth,
+// unexamined silent case. Called directly for a resolved external CallExpression too (see the CLASSIFY
+// arm and the tagged-template arm) so the whole family shares one implementation.
+function disclosureTail(rec, decl, pkg, file) {
   const declared = packageManifestEffects(file);
   if (declared !== null) { for (const e of declared) rec.direct.add(e); return; } // [] = declared pure
   const abstraction = unanswerableKey(decl);
@@ -3892,12 +4243,50 @@ function chargeExternalDecl(rec, decl, tailOverride) {
     if (abstraction && incompleteDepPkgs.has(pkg)) discloseUnanswerableKey(rec, pkg, abstraction);
     return;
   }
-  // ⟨scan-boundary, half 1⟩ the UNANSWERABLE key, on the desugared sites too — the CallExpression arm's
-  // twin (see there for the argument). `[1].forEach(job.run)` where `job` is typed as a chained dep's
-  // INTERFACE hands the join a key no report can carry, and a covered package silences the ledger, so the
-  // caller read confidently pure. Same three conjuncts, same reason class.
+  // ⟨scan-boundary, half 1⟩ the UNANSWERABLE key. `[1].forEach(job.run)` where `job` is typed as a chained
+  // dep's INTERFACE hands the join a key no report can carry, and a covered package silences the ledger,
+  // so the caller read confidently pure. Same three conjuncts, same reason class.
   if (abstraction && depCoveredPkgs.has(pkg) && crossesPackageBoundary(file))
     discloseUnanswerableKey(rec, pkg, abstraction);
+  // ⟨scan-boundary, half 2 — dynamic re-export⟩ THE FIFTH "neither voice fired" instance (`1d4f648`,
+  // filed there rather than fixed). SPEC §2 rule 3 reads a covered package's silence under a key as that
+  // key's purity claim — but a package that ALSO performs a dynamic re-export write somewhere
+  // (`dynamicReexportPkgs`, fed by the producer's `dynamicReexportSites`) forwards names no static
+  // matcher could enumerate, so its silence under THIS particular key is no longer distinguishable from
+  // "forwarded through the runtime loop and never independently examined". Guarded on `!abstraction`
+  // (the arm above already disclosed when there was a real reason) and never resolves a name — minting an
+  // alias for a runtime-computed key would be a guess, exactly what this class exists to refuse. A package
+  // with NO dynamic re-export write is unaffected (`dynamicReexportPkgs` empty), byte-identical to
+  // pre-fix output; a package that dynamically re-exports a genuinely PURE function gains this same
+  // `Unknown`, never a fabricated concrete effect — the honest answer either way.
+  if (!abstraction && depCoveredPkgs.has(pkg) && crossesPackageBoundary(file) && dynamicReexportPkgs.has(pkg)) {
+    rec.direct.add("Unknown");
+    rec.why.add(`reflect:dynamic-reexport:${pkg}`);
+  }
+}
+// Charge `rec` for reaching a resolved EXTERNAL declaration through a DESUGARED site — one that is not a
+// CallExpression, so the (CLASSIFY)/join/ledger arm of the call path never sees it. This is the same
+// decision procedure that arm runs, in the same order: the chained sibling report (the SPEC §2 `hash`
+// join), then `disclosureTail` (manifest, then the κ-coverage ledger's `invisible`). Nothing is
+// fabricated: a member declared in the ES lib / a project file / an unnameable package resolves to
+// nothing and adds nothing, and a chained report that omits the entry is making its purity claim (SPEC §2
+// rule 3). `tailOverride` names the dep report's local tail explicitly when the declaration cannot supply
+// it — a CONSTRUCTOR has no `name`, and the producer hashed it as `<Class>.constructor`.
+function chargeExternalDecl(rec, decl, tailOverride) {
+  if (!rec || !decl) return;
+  const mod = declModule(decl);
+  if (!mod || mod.startsWith("<")) return;             // project source / the ES lib — not a package reach
+  const pkg = mod.startsWith("@types/") ? mod.slice("@types/".length) : mod;
+  const nameDecl = memberSigOf(decl); // a function-typed property names its member one level up
+  const member = nameDecl.name?.getText?.();
+  // Owner-prefixed first (`Owner.member` — how the dep's own scan hashes a method), bare member as the
+  // fallback (a CJS dist scan hashes a top-level export under its bare name). Identical to the call arm.
+  const owner = nameDecl.parent?.name?.getText?.();
+  const hit = tailOverride ? crossDeps.get(`${pkg}#${tailOverride}`)
+    : member && ((owner ? crossDeps.get(`${pkg}#${owner}.${member}`) : undefined)
+      ?? crossDeps.get(`${pkg}#${member}`));
+  if (hit) { applyDepHit(rec, hit); return; }
+  disclosureTail(rec, decl, pkg, decl.getSourceFile().fileName);
 }
 
 // ---- implicit VALUE-COERCION desugaring (the silent-pure holes where the JS coercion protocol calls a
@@ -4517,7 +4906,7 @@ function visitCalls(node) {
     if (owner) {
       const rec = fns.get(owner);
       const sig = checker.getResolvedSignature(node);
-      const decl = sig && sig.declaration;
+      let decl = sig && sig.declaration;
       if (!decl) {
         // `new C()` on a class with an IMPLICIT constructor resolves to no declaration — edge to
         // the class's (synthesized) ctor unit via the class identifier before concluding Unknown.
@@ -4582,7 +4971,27 @@ function visitCalls(node) {
           }
         }
       } else {
-        const mod = declModule(decl);
+        let mod = declModule(decl);
+        // OWN-`.d.ts`-SHADOW redirect (see `siblingImplFile`): a cross-file call the checker typed through
+        // a co-located declaration file this scan's file walk excluded from `projectFiles` on purpose.
+        // Gated on the declaration file actually BEING a `.d.ts` with a SIBLING this scan analysed — an
+        // ordinary external dependency (`@types/node`, an uninstalled package's types) has no such sibling
+        // and this never touches its handling below.
+        if (mod !== "<local>" && ts.isIdentifier(node.expression) && /\.d\.[cm]?ts$/.test(decl.getSourceFile().fileName)) {
+          const implFile = siblingImplFile(decl.getSourceFile().fileName);
+          if (implFile) {
+            const redirected = siblingImplExports(implFile).get(node.expression.text);
+            if (redirected && nodeName.has(redirected)) { decl = redirected; mod = "<local>"; }
+            else {
+              // The sibling exists (this IS our own scanned code) but no single export answers the
+              // callee's name — an ambiguous collision, or a shape `nodeName` never minted a unit for.
+              // The ordinary cross-package arm below stays silent for this exact file (same reasoning
+              // `crossesPackageBoundary` already applies to it), so disclose here or the call vanishes.
+              rec.direct.add("Unknown");
+              rec.why.add(`callback:${node.expression.text.slice(0, 40)}`);
+            }
+          }
+        }
         // A LOCAL function/method passed BY REFERENCE to a NON-LOCAL (opaque) callee — `xs.map(loadFree)`,
         // `arr.forEach(this.m)`, `setTimeout(handler)`, `external(cb)` — may be INVOKED by that callee, so
         // its effects are reachable here. The precise callback-flow below only resolves a LOCAL callee's
@@ -4716,7 +5125,10 @@ function visitCalls(node) {
               const kMod = d2 && declModule(d2);
               const kMember = d2?.name?.getText?.()
                 ?? (ts.isPropertyAccessExpression(invokedRef) ? invokedRef.name.text : ts.isIdentifier(invokedRef) ? invokedRef.text : null);
-              const kEff = kMod && kMember ? kappa(kMod, kMember) : null;
+              // SELF-NAME GUARD (see `isOwnPackageDecl`): the reflectively-invoked reference may be OUR
+              // OWN package's own function, reached through its own `dist/*.d.ts` — never let κ answer
+              // for it, same reasoning as the (CLASSIFY) arm.
+              const kEff = kMod && kMember && !isOwnPackageDecl(d2) ? kappa(kMod, kMember) : null;
               if (kEff) {
                 rec.direct.add(kEff);
                 if (kEff === "Unknown") rec.why.add(`reflect:${kMod.replace(/^node:/, "")}.${kMember}`);
@@ -4730,6 +5142,13 @@ function visitCalls(node) {
                 rec.direct.add("Unknown");
                 rec.why.add(`callback:${recvText.slice(0, 40)}.${m}`); // method on an indeterminate-valued receiver (no resolvable owner TYPE) — canonical `callback:`, not the frontier's `dispatch:OWNER.member`
               }
+              // THE FUNNEL: `d2` resolved to a concrete, non-local declaration that named neither a κ effect
+              // nor a value-holder shape above — a reflective `.call`/`.apply`/`Reflect.apply` onto an
+              // uncurated dependency's exported function (`depFn.call(this, x)`), the by-reference sibling
+              // of the HOF-ref arm's own `chargeExternalDecl(rec, d2)` call. Without this the invoke was
+              // NEITHER edged, NOR κ-classified, NOR disclosed — silent-pure on a call that unquestionably
+              // runs caller-reachable code, the same shape as the two cardinal sins this funnel closes.
+              else if (d2 && !declIsLocal(d2)) chargeExternalDecl(rec, d2);
             }
           }
           // EXPLICIT iterator force: `it.next()` / `it.return()` / `it.throw()` on an OPAQUE iterator
@@ -5110,9 +5529,26 @@ function visitCalls(node) {
           let kMod = mod;
           if (ctorClassDecl && !kappa(mod, member)) {
             const cm = declModule(ctorClassDecl);
-            if (cm !== mod && kappa(cm, member)) kMod = cm;
+            // The re-key must not LAND us on our own package's name either (`isOwnPackageDecl`,
+            // fabrication vein above): a same-package class with no own constructor, inherited from a
+            // sibling declared in the same `dist/*.d.ts` tree, re-keys onto the scanned package's own
+            // name exactly like the direct case below — never accept that as an external module.
+            if (cm !== mod && !isOwnPackageDecl(ctorClassDecl) && kappa(cm, member)) kMod = cm;
           }
-          let eff = kappa(kMod, member); // (CLASSIFY)
+          // SELF-NAME GUARD (fabrication only, not resolution — see `isOwnPackageDecl`): `decl` may be
+          // OUR OWN scanned package's code reached through its own co-located `dist/*.d.ts`, which
+          // `declModule` resolves to the scanned package's own name — a whole-module κ rule (a `null`
+          // member-regex) then matches unconditionally and charges the package's own internal calls its
+          // own effect. This fires for every call SHAPE the `.d.ts`-shadow redirect above doesn't reach
+          // (`super(x)`, `obj.method()`, `new ns.Ctor()`, a bare call whose `.js` sibling isn't in
+          // `projectFiles`) — refusing to let κ answer is enough to stop the fabrication: `mod`/`kMod`
+          // are left exactly as `declModule` computed them (never rewritten to `"<local>"`), so the
+          // κ-coverage ledger below — already keyed on `crossesPackageBoundary`, which already treats
+          // this exact file as OURS — falls silent precisely as it does for an own-package name that
+          // never happened to collide with anything (no new disclosure, no fabrication). A genuine
+          // node_modules-installed dependency of the same name is untouched: `isOwnPackageDecl` excludes
+          // `node_modules/` outright, before the name is ever compared.
+          let eff = isOwnPackageDecl(decl) ? null : kappa(kMod, member); // (CLASSIFY)
           // process.stdout/stderr/stdin are typed `tty.WriteStream`, which EXTENDS `net.Socket`, so a
           // `.write()`/`.end()` on them resolves to `net.Socket.write` and the whole-module Net rule
           // paints it Net. But a console write to fd 0/1/2 is TTY/console I/O, NOT network — there is no
@@ -5331,48 +5767,12 @@ function visitCalls(node) {
             // via @types/lodash was falsely disclosed — kappaKnows saw the unstripped name).
             const pkg = mod.startsWith("@types/") ? mod.slice("@types/".length) : mod;
             const file = decl.getSourceFile().fileName;
-            // SPEC §5.1: a package that DECLARES its effects (candorEffects in package.json) is read
-            // at the declared-not-verified tier — its effects are attributed and it is NOT a blind
-            // spot. Otherwise the κ ledger names it (an uncurated dependency the review must read).
-            const declared = packageManifestEffects(file);
-            const abstraction = unanswerableKey(decl);
-            if (declared !== null) {
-              for (const e of declared) rec.direct.add(e); // [] = declared pure: covered, adds nothing
-            } else if (!kappaKnows(pkg) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
-              unlistedSeen.set(pkg, (unlistedSeen.get(pkg) ?? 0) + 1);
-              // Per-fn HONESTY: this fn calls into a genuinely-blind package (κ-unknown, not dep-covered).
-              // Recorded per fn, propagated transitively, emitted as `invisible` — so `inferred` is never an
-              // unqualified completeness claim. This branch already IS the global-blind condition, so no
-              // post-filter is needed (κ either knows a package or it doesn't).
-              rec.blind.add(pkg);
-              // ⟨0.21⟩ …and half 1 STILL speaks for a package whose only chained report declares itself
-              // incomplete, which lands here because its coverage was withheld. See the twin in
-              // `chargeExternalDecl`: the ledger hedge must ADD to the Unknown, never replace it, or the
-              // completeness fix silently narrows `deny E Unknown[dispatch]` (standing bar item 0).
-              if (abstraction && incompleteDepPkgs.has(pkg)) discloseUnanswerableKey(rec, pkg, abstraction);
-            } else if (abstraction && depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
-              // ⟨scan-boundary, half 1⟩ THE UNANSWERABLE KEY, candor-spec DEP-RECEIVER-TYPING-DESIGN.md.
-              // A chained lookup that comes back empty has two readings with OPPOSITE evidential weight:
-              //   * KEYED-AND-MISSED — the key names a BODY the dep scanned (`declare class C { m() }`,
-              //     `declare function f()`), and the dep's report omits pure functions, so absence IS its
-              //     answer (SPEC §2 rule 3). Silence is correct; nothing happens here.
-              //   * NO ANSWERABLE KEY — resolution landed on an ABSTRACTION (an interface method/property
-              //     signature, an anonymous type-literal member, an `abstract` member). There is no body
-              //     under that name in the dependency, so its report can NEVER carry the key, whatever the
-              //     implementations do. No question was asked, and silence answers none.
-              // TypeScript reaches this case by a different road than rust: a receiver it genuinely cannot
-              // type is `any`, which already reads `callback:` Unknown. Its unformed key is the receiver
-              // typed to an abstraction the dependency's report has no vocabulary for — `build(): Fetcher`
-              // exported over a `.d.ts` whose only implementation, `Client`, is what the dep actually
-              // hashed. Measured: `go` was absent from the report entirely while the dep's own report read
-              // `depkit#Client.fetch -> ['Fs']`.
-              // THE THIRD CONJUNCT (`depCoveredPkgs.has(pkg)` — the dependency is CHAINED) is the arm
-              // above, and it is load-bearing rather than incidental: for an UNCHAINED package the κ ledger
-              // already discloses `invisible: [pkg]`, so a second voice would be pure false uncertainty. It
-              // is exactly when the package IS covered that the ledger correctly falls silent and that
-              // silence becomes the confident purity claim this rung exists to prevent.
-              discloseUnanswerableKey(rec, pkg, abstraction);
-            }
+            // SPEC §5.1 manifest, then the κ-coverage ledger, then the unanswerable-key disclosure
+            // (candor-spec DEP-RECEIVER-TYPING-DESIGN.md) — THE FUNNEL, see `disclosureTail`. This arm
+            // already ran its own chained-dep lookup above (`inheritedFromDep`, with its constructor/
+            // owner-prefix spelling), so it hands the tail an already-external, already-unmatched `decl`
+            // rather than re-deriving the join.
+            disclosureTail(rec, decl, pkg, file);
           }
         }
       }
@@ -5910,19 +6310,21 @@ function visitCalls(node) {
         // nothing — no fabrication.
         const mod = declModule(decl);
         const member = decl.name ? decl.name.getText() : "";
-        const eff = kappa(mod, member);
+        // SELF-NAME GUARD (see `isOwnPackageDecl`): an external-looking tag may be OUR OWN package's
+        // own function, reached through its own `dist/*.d.ts` — never let κ answer for it. `mod` stays
+        // whatever `declModule` computed, so the ledger below (already keyed on
+        // `crossesPackageBoundary`, which already treats this file as ours) falls silent exactly as it
+        // does for an own-package name that never collided with anything.
+        const eff = isOwnPackageDecl(decl) ? null : kappa(mod, member);
         if (eff) { rec.direct.add(eff); if (eff === "Unknown") rec.why.add(`reflect:${mod.replace(/^node:/, "")}.${member}`); }
-        else {
-          const file = decl.getSourceFile().fileName;
-          const pkg = mod.startsWith("@types/") ? mod.slice("@types/".length) : mod;
-          const declared = packageManifestEffects(file);
-          if (declared !== null) { for (const e of declared) rec.direct.add(e); }
-          else if (!mod.startsWith("<") && !kappaKnows(pkg) && !depCoveredPkgs.has(pkg)
-              && crossesPackageBoundary(file)) {
-            unlistedSeen.set(pkg, (unlistedSeen.get(pkg) ?? 0) + 1);
-            rec.blind.add(pkg);
-          }
-        }
+        // THE FUNNEL (see `chargeExternalDecl`/`disclosureTail`): this arm used to hand-roll only the
+        // manifest + blind-ledger half — no chained-dep join, no unanswerable-key disclosure — so a
+        // tagged call into a covered-but-abstract dependency (an interface-typed `sql` tag, say) vanished
+        // exactly like the two cardinal sins this funnel exists to prevent, one arm silently missing two
+        // of the four checks the other arms already had. Routing through the shared function costs nothing
+        // for the cases this arm already got right (declared-pure, an uncurated/uncovered blind package —
+        // both unchanged) and closes the two it never had.
+        else chargeExternalDecl(rec, decl);
       }
     }
   }
@@ -6426,7 +6828,10 @@ for (const e of netPartnerErrs) console.error(`candor-ts: ${e.why} — ${e.raw}`
 // name this scan has no record of, and empty is OMITTED from the row rather than guessed at.
 const unitHash = (name) => {
   const rec = fns.get(name);
-  return rec ? `${pkgName}#${rec.local}` : "";
+  // An export-alias entry (see `exportAliasCandidates`) SHARES its rec with the original declaration, so
+  // `rec.local` still names the ORIGINAL — `aliasHashTail` carries the alias's own exported name, the tail
+  // its `.d.ts` and a consumer's join actually use.
+  return rec ? `${pkgName}#${aliasHashTail.get(name) ?? rec.local}` : "";
 };
 const functions = [];
 for (const [name, rec] of fns) {
@@ -6999,6 +7404,12 @@ if (partnersUsed.size) {
 // OMITTED when empty — a complete scan stays byte-identical to a pre-rung report — so a MACHINE reading
 // --json sees the incompleteness the stderr warning alone used to hide.
 if (unanalyzedUnits.length) envelope.unanalyzed = unanalyzedUnits.map((u) => ({ path: u.path, reason: u.reason }));
+// ⟨scan-boundary, dynamic re-export⟩ the fifth "neither voice fired" instance's ONLY provenance across
+// the package boundary — see `dynamicReexportSites` for the shapes counted and `dynamicReexportPkgs` for
+// what a chained consumer does with it. OMITTED when zero, the same wire-compatibility rule as every
+// other envelope field on this file: a package with no dynamic re-export write is byte-identical to a
+// pre-this-fix report.
+if (dynamicReexportSites) envelope.dynamicReexport = { count: dynamicReexportSites };
 const cg = {};
 for (const [name, rec] of fns) cg[name] = [...rec.edges].sort();
 // Write ATOMICALLY (temp + rename): a concurrent reader — the MCP server or another `query` while
@@ -7054,7 +7465,17 @@ let peekAttempted = false;
 // per CLASS, so the answer is too: a class is peeked only when no file of that class went unread.
 const peekUnread = new Set();
 let peekUnattributed = false;
-if (policyPath && excludedFiles.length) {
+if (policyPath) {
+  // ⟨0.33⟩ NO LONGER GATED ON `excludedFiles.length`. A tree with a policy and NOTHING excluded used to
+  // skip this whole block, so `outOfScopeFindings`/`scannedUnderRules` stayed `null` and both
+  // `outOfScope` and `scannedUnder` were OMITTED — the SAME document a tree with no policy at all
+  // produces. SPEC §2 ⟨0.29⟩/⟨0.33⟩ bind both keys' presence to "a policy was CONFIGURED and HONOURED",
+  // never to "there was something to peek": present-and-empty is *asked-and-clear*, and collapsing it
+  // into *never asked* is the exact ⟨0.26⟩ partial-manifest failure this format exists to prevent.
+  // MEASURED four-way: candor-java and candor-rust both emit `outOfScope: []` and `scannedUnder` over a
+  // no-exclusion tree; this engine emitted neither. The subprocess peek itself still has nothing to do
+  // when there is nothing excluded — that stays conditioned on `excludedFiles.length` below — but the
+  // QUESTION was still asked and the answer is still recorded.
   // ⟨0.30⟩ HOISTED, because the matcher below needs it. It was a `const` inside the try, so the
   // evaluatePolicy call added in this rung threw ReferenceError straight into the "a peek that cannot
   // run must not fail the gate" catch — findings silently empty, gate green. The catch is right; a bug
@@ -7077,8 +7498,9 @@ if (policyPath && excludedFiles.length) {
   // passed at exit 0 while the strictly weaker `deny Exec` exited 2 on the same files. MEASURED four-way.
   if ((peekPolicy?.deny ?? []).length) {
     // ⟨0.32⟩ THE PEEK WAS ATTEMPTED — this run's policy asks a question whose answer depends on code
-    // outside the scan's scope, and there is something excluded to look at. The `unreadClasses` rule below
-    // keys on THIS, not on whether the peek then succeeded; see the note there.
+    // outside the scan's scope. ⟨0.33⟩ this fires even when NOTHING is excluded — the question was still
+    // put, and `[]` answers it. The `unreadClasses` rule below keys on THIS, not on whether the peek then
+    // succeeded; see the note there.
     peekAttempted = true;
     outOfScopeFindings = [];
     // ⟨0.33⟩ RECORDED HERE, ALONGSIDE `outOfScopeFindings`'s own assignment, and BEFORE any file is
@@ -7087,6 +7509,10 @@ if (policyPath && excludedFiles.length) {
     // is the SAME renderer `ruleUpgrade` quotes back to an operator for the provable-purity upgrade, so
     // the string an operator reads and the string a gate compares cannot become two spellings of one rule.
     scannedUnderRules = canonicalDenySet(peekPolicy.deny);
+    // ⟨0.33⟩ NOTHING TO PEEK: the question above is still asked and answered (`outOfScopeFindings`/
+    // `scannedUnderRules` are already set), but spawning a child scan over an empty file list buys
+    // nothing — skip the subprocess entirely and leave the findings at the trivially-true `[]`.
+    if (excludedFiles.length) {
     // ⟨0.31⟩ A FILE THIS ENGINE CANNOT READ CANNOT BE PEEKED, AND THE CLASS MUST SAY SO.
     //
     // MEASURED: an excluded file performing a denied `Fs`, with the policy `deny Fs`. Readable, the peek
@@ -7274,6 +7700,7 @@ if (policyPath && excludedFiles.length) {
     } finally {
       fs.rmSync(peekDir, { recursive: true, force: true });
     }
+    }
   }
 }
 // ⟨0.30⟩ NOTHING ANALYZABLE, AND THE PEEK FOUND NOTHING EITHER: REFUSE — AND REFUSE BEFORE AN ENVELOPE