candor-ts 0.34.0 → 0.36.0

package/AGENTS.md

@@ -1,7 +1,9 @@
 # Using candor-ts (instructions for an AI coding agent)
 
 You are working in a TypeScript project. **candor-ts** tells you, for every function, which side
-effects it can reach — network, filesystem, database, subprocess, env, clock — *including effects
+effects it can reach — network, calls to LLM/model providers (`Llm`, refines network), filesystem,
+database, subprocess, env, clock, IPC (`Ipc`), logging (`Log`), randomness (`Rand`), clipboard
+(`Clipboard`) — *including effects
 inherited transitively through any chain of calls across files*. Use it instead of tracing call
 chains by hand. The language-agnostic consumption contract is
 [candor-spec/AGENTS.md](https://github.com/tombaldwin/candor-spec/blob/main/AGENTS.md); this file is
@@ -21,7 +23,7 @@ the TypeScript-specific production + query surface.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.34)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.36)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >

package/README.md

@@ -90,7 +90,10 @@ the service reaching `user` and `follows`.
 
 **The classifier** is curated (the same under-report-and-say-so posture as the other engines): the
 Node builtins (`fs`, `net`/`http`/`tls`, `dns`, `child_process`, `worker_threads`, `node:sqlite`,
-`node:vm`, `process.env`, the clock), the HTTP/queue/mail tier (axios/got/node-fetch/undici/ws/
+`node:vm`, `process.env`, the clock), the **web network globals** (`fetch`, `XMLHttpRequest`,
+`navigator.sendBeacon`, and `WebSocket`/`EventSource` — construction, `send` and `close`, charged
+identically whether they resolve through `lib.dom` or through `@types/node`'s `undici-types`
+re-export), the HTTP/queue/mail tier (axios/got/node-fetch/undici/ws/
 socket.io/nodemailer, gaxios + googleapis-common + google-auth-library, stripe, @sentry/*,
 posthog-node, bull/bullmq), the database drivers (pg/mysql2/mongodb/redis/ioredis/sqlite3/
 better-sqlite3/knex) **and the ORM tier** (TypeORM — with `@Entity("…")` table extraction —
@@ -198,7 +201,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.34" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.36" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -216,7 +219,7 @@ read the Rust source".
 
 ## Status
 
-0.30.0, speaking candor-spec 0.34: the analysis core, the gate (`--policy` / `--gate-json` /
+0.30.0, speaking candor-spec 0.36: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier, and ⟨0.24⟩ `gate --report` — the gate applied to an EXISTING
 report, byte-equivalent to `scan --policy`'s verdict), the MCP server, the LSP server, and the watch loop are

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.34.0",
-  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.34)",
+  "version": "0.36.0",
+  "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.36)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",

package/query.mjs

@@ -717,7 +717,7 @@ function renderPathHuman(fns, cg, fnQ, eff, hedge = false) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.34";
+const SPEC_VERSION = "0.36";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]

package/scan-core.mjs

@@ -11,12 +11,193 @@ export function isTestPath(p) {
   return /(^|\/)(node_modules|__tests__|tests?|spec)(\/|$)/.test(p) || /\.(test|spec)\.[mc]?tsx?$/.test(p);
 }
 
+/** R111 — the `Performance` members that READ A CLOCK, as ONE definition read by BOTH tables.
+ *
+ * WHY THIS IS A SHARED EXPORT AND NOT TWO LITERALS. The same question — "is this `Performance` member
+ * effect-bearing?" — is answered in two places, because the same source line resolves to two different
+ * declarations depending on `lib`: through lib.dom it lands on `<es-lib>` and is judged by scan.mjs's
+ * `parent === "Performance"` arm; through `@types/node` it lands in `perf_hooks.d.ts` and is judged by
+ * the κ rule below. R109 and R110 are what those two tables did when each was edited alone: they
+ * disagreed in BOTH directions, once each way. This constant does not merge the tables — that is a
+ * costed, separate piece of work — but it does remove the ONE degree of freedom that produced both
+ * defects, by making the member set a single token that cannot be widened on one side only.
+ *
+ * MEMBERSHIP IS BY EXECUTED GROUND TRUTH under node 22.12.0, not by name or by intuition:
+ *   now()                    two calls in one process return different values                    → CLOCK
+ *   mark(name)               `performance.mark("m").startTime` is the live elapsed value;
+ *                            two marks 30ms apart differ by 30.05ms                              → CLOCK
+ *   measure(name[, start])   `measure("m")` with no end reads NOW (two calls 30ms apart differ)  → CLOCK
+ *   eventLoopUtilization()   `.active` advances with wall time between two calls                 → CLOCK
+ *
+ * AND THE MEMBERS DELIBERATELY LEFT OUT, each for a measured reason rather than an oversight — the
+ * precision half of this rule is the whole job, because User Timing is pervasive in tracing code:
+ *   timerify(fn)   NOT a clock read. MEASURED: it returns a NEW wrapper function (`t !== fn`, and two
+ *                  calls return two different objects); the clock read happens when the WRAPPER runs,
+ *                  observed via a PerformanceObserver `function` entry. The brief for this row asserted
+ *                  timerify "reads the clock"; it does not, and charging it here would be a fabrication
+ *                  on the enclosing function. The hole it leaves is real but is a DIFFERENT class — a
+ *                  factory returning an effectful callable — and is filed as such, not folded in here.
+ *   toJSON()       returns `{nodeTiming, timeOrigin, eventLoopUtilization}`, and MEASURED, its
+ *                  `nodeTiming` is a LIVE REFERENCE (`a.nodeTiming === b.nodeTiming`) — so the clock is
+ *                  read by the later `.duration` property access, not by this call. Same shape as
+ *                  timerify: the call hands you a reader.
+ *   timeOrigin, nodeTiming, and `PerformanceEntry.startTime`/`.duration`
+ *                  are PROPERTY ACCESSES, and the classify site they would have to be judged at
+ *                  (scan.mjs, `ts.isCallExpression(node) || ts.isNewExpression(node)`) never sees a bare
+ *                  property access. No regex here can reach them; saying so is the point, because
+ *                  "not charged" and "not reachable by this mechanism" are different facts and only the
+ *                  second one tells the next reader where to look. `timeOrigin` is separately
+ *                  interesting — measured CONSTANT within a process, and equal to the wall-clock at
+ *                  process start (`timeOrigin + now()` tracks `Date.now()`) — so it discloses the wall
+ *                  clock without reading it live. Filed, not fixed.
+ *   clearMarks, clearMeasures, clearResourceTimings, getEntries, getEntriesByName, getEntriesByType,
+ *   setResourceTimingBufferSize, markResourceTiming, addEventListener, removeEventListener
+ *                  read no clock at the call. `getEntries*` returns entries whose `startTime`s were
+ *                  recorded EARLIER (measured: the returned timestamps do not advance between two calls
+ *                  30ms apart) — a lookup of past reads, charged at the `mark` that made them.
+ *
+ * SO THIS IS A VERB LIST, NOT AN INTERFACE KEY, and that is the opposite call from R109's whole-`Storage`
+ * predicate for a reason that is about the interface rather than a preference: every `Storage` member
+ * touches the store, so a verb list there could only under-report, whereas `Performance` is genuinely
+ * mixed and ten of its members demonstrably read nothing. The denylist argument does not apply to a
+ * type whose majority surface is inert.
+ *
+ * ONE MEMBER IS NODE-ONLY AND THAT IS NOT AN ACCIDENT OF SPELLING: lib.dom's `Performance` declares no
+ * `eventLoopUtilization` at all, so a lib.dom fixture calling it does not COMPILE (§E3 — checked with
+ * `tsc`, not assumed). It is in this one set because the set is keyed on the MEMBER, and the es-lib arm
+ * simply never sees that name; an alternative that cannot match is not a fabrication risk, and splitting
+ * the set in two to avoid it would reintroduce exactly the drift this constant exists to prevent.
+ */
+export const CLOCK_READING_PERFORMANCE_MEMBERS = /^(now|mark|measure|eventLoopUtilization)$/;
+
+/**
+ * R114 — the same question asked of `process` and `console`, and the reason both are SHARED constants.
+ *
+ * R110's own commit wrote the criterion down — *"SPEC §1 defines `Clock` as reading wall-clock or
+ * monotonic time; staying in-process is not the question"* — and then applied it only to the module it
+ * was about. §9: an audit's boundary must not be drawn around its own trigger. Applied to the rest of
+ * the floor, it is violated by `process.uptime`, `os.uptime`, `process.hrtime`/`.bigint` on the MODULE
+ * path, and `console.time`/`timeLog`/`timeEnd`.
+ *
+ * GROUND TRUTH IS EXECUTED, node 22.12.0 — every charge below, measured, never read off a signature:
+ *
+ *     process.uptime()      over a 60 ms busy-wait   0.01006425 -> 0.069538625   delta 59.47 ms
+ *     os.uptime()           over a 1200 ms wait      1947079 -> 1947081          delta 2 s (1 s resolution)
+ *     process.hrtime.bigint()                        1947081928072375n -> 1947081932691916n
+ *     console.time("C"); …80ms…; console.time("D")   C: 119.891ms   D: 40.088ms
+ *
+ * That last pair is the one that had to be measured rather than argued: it proves `console.time()` ITSELF
+ * takes a timestamp (two timers started 80 ms apart end 80 ms apart), so it is a clock READ and not only
+ * console output. SPEC §1's exemption is for console WRITES — it says plain stdout/stderr is not `Log`
+ * and not `Fs` — and it says nothing about the monotonic read this API performs to compute a duration.
+ * The precedent is R111's `performance.mark()`, charged for recording a timestamp, which is the same
+ * operation under another name.
+ *
+ * TWO PATHS, ONE SET, and for `process` that is not hygiene — they had already DISAGREED. `scan.mjs`'s
+ * global arm charged `process.hrtime.bigint()` Clock while this file's floor listed `hrtime` and `bigint`
+ * as reviewed-pure, so ONE LINE HAD TWO ANSWERS SELECTED BY SPELLING (measured on 8c7484e, both `lib`
+ * shapes):
+ *
+ *     process.hrtime.bigint()                                    ->  ["Clock"]
+ *     import * as p from "node:process"; p.hrtime.bigint()       ->  absent, SILENT-PURE
+ *
+ * and the floor's own comment asserted the pure answer was right *"for the reason `Date.now()` is pure in
+ * this engine: nothing charges `Clock` for reading a timer"* — false twice over, since `Date.now()`
+ * charges Clock (measured) and the global arm already charged `hrtime`. Attack K: a comment explaining
+ * why something is safe, written by the change that needed it to be true. The member set now lives here
+ * and BOTH readers import it, so the two can no longer be widened separately — the single degree of
+ * freedom that produced R109, R110, R111 and this row.
+ *
+ * `bigint` is in the set because `process.hrtime.bigint()` resolves to a member declared on the `HRTime`
+ * interface in `process.d.ts`, so it arrives at κ under its own bare name with module key `process`.
+ *
+ * THE SWEEP OF WHAT IS DELIBERATELY LEFT PURE, decided on §1's definition and each one EXECUTED, because
+ * a charge list without its exclusions is a verb list that will be right today and stale next quarter:
+ *   os.freemem()          7912144896 -> 7736311808 across a 300 ms wait — it MOVES, and it is not time.
+ *   os.totalmem()         unchanged; host capacity.
+ *   os.loadavg()          unchanged over 200 ms; scheduler load, not a clock.
+ *   os.cpus()[].times     DOES advance — but it is per-core CPU-time ACCOUNTING, not a wall-clock or
+ *                         monotonic read, and `os.cpus()` is reached overwhelmingly for `.length`, so
+ *                         charging it would put Clock on every core-count query.
+ *   process.cpuUsage()    advances; same argument — consumed CPU time is resource accounting.
+ *   process.resourceUsage()  advances; same family.
+ *   process.memoryUsage() / constrainedMemory() / availableMemory()  memory, not time.
+ *   os.platform/arch/EOL/machine/getPriority, process.pid  inert — and these are the PRECISION control:
+ *                         they gain nothing from this change, in both `lib` arms.
+ * `os.homedir`/`tmpdir`/`hostname`/`userInfo`/`networkInterfaces` stay `Env` (their own rule, below) and
+ * `perf_hooks` stays with CLOCK_READING_PERFORMANCE_MEMBERS: three sets, three questions, no sharing
+ * between them, because a shared predicate across unrelated interfaces is a name collision dressed up.
+ */
+export const CLOCK_READING_PROCESS_MEMBERS = /^(uptime|hrtime|bigint)$/;
+export const CLOCK_READING_CONSOLE_MEMBERS = /^(time|timeEnd|timeLog)$/;
+
+/**
+ * R130 — the WEB NETWORK GLOBALS, and the third resolution split this family has measured (R109
+ * `localStorage`, R110 `performance.now`, now `WebSocket`/`EventSource`). Shared constants for the same
+ * reason those are: the es-lib arm in scan.mjs and the κ table below BOTH answer for these names, and a
+ * single degree of freedom between two tables is what produced all three rows.
+ *
+ * THE SPLIT. `@types/node` does not declare `WebSocket`/`EventSource` itself — `web-globals/fetch.d.ts`
+ * re-exports them from the `undici-types` PACKAGE, so the resolved declaration is not under `@types/node`
+ * and the ⟨0.32⟩ node-core floor (`declIsNodeTypes`) is never consulted. κ had no `undici-types` rule, so
+ * the call landed on pure. Resolve the SAME LINE with `"DOM"` in `lib` and the declaration lands in
+ * `typescript/lib/lib.dom.d.ts`, where the es-lib arm has charged `Net` since ⟨0.29⟩. MEASURED on
+ * PUBLISHED candor-ts 0.34.0, one variable (`lib: ["ES2022"]` vs `lib: ["ES2022","DOM"]`, `types:
+ * ["node"]` in both — both fixtures `tsc`-clean):
+ *
+ *     export function connect(u: string) { return new WebSocket(u); }
+ *       lib.dom     ->  inferred ["Net"], incomplete ["Net"]   deny Net -> exit 1
+ *       @types/node ->  inferred [],      invisible ["undici-types"]   ALL FIVE policy forms -> exit 0
+ *
+ * and identically for `new EventSource(u)` and for a fixture whose URL is the literal
+ * `"wss://evil.example.com/x"` (lib.dom captures the host; the node arm reports nothing to capture).
+ *
+ * `NODE_CORE_REVIEWED` says of the net cluster *"`WebSocket` is deliberately absent — it CONNECTS"*. That
+ * sentence was true of the list it sits in and false of the engine: the name never reached that list.
+ *
+ * GROUND TRUTH IS EXECUTED, node 22.12.0, against a real `http.createServer` listener on 127.0.0.1 that
+ * counts what arrives — not read off a signature:
+ *
+ *     new WebSocket(`ws://127.0.0.1:${port}/socket`)   -> the server's `upgrade` handler fires once
+ *     ws.send("SECRET-EXFIL")                          -> one client frame, unmasked payload
+ *                                                         EXACTLY "SECRET-EXFIL"
+ *     new EventSource(`http://127.0.0.1:${port}/sse`)  -> one HTTP request to /sse
+ *                                                         (node 22.12 needs --experimental-eventsource;
+ *                                                          @types/node declares it unconditionally, so
+ *                                                          source using it type-checks either way)
+ *
+ * TWO SETS, TWO QUESTIONS. The CTOR set is what OPENS the connection — it is host-ESTABLISHING, so a
+ * runtime URL there must mark the surface `incomplete` (scan.mjs `netEstablishing`). The WIRE set is what
+ * moves bytes on a connection someone else opened; its argument 0 is the PAYLOAD, never an endpoint, so it
+ * must NOT be read for a host literal (see NET_USE_VERBS in scan.mjs — `ws.send("api.example.com")`
+ * publishing `hosts:["api.example.com"]` is the same fabrication ⟨0.29⟩ fixed for dgram `send`).
+ *
+ * `send` IS THE ONE THAT WAS SILENT IN BOTH ARMS, which is the R111 shape — agreement between the two
+ * paths is the weakest signal here, not the strongest. `export function exfil(w: WebSocket, s: string) {
+ * w.send(s); }` was ABSENT from `functions` under lib.dom (a positive purity claim, no `invisible`, no
+ * `Unknown`) and `inferred: []` under `@types/node`, on published 0.34.0, while the es-lib arm three
+ * lines away already charges `XMLHttpRequest.send` for the identical operation.
+ *
+ * FAILURE DIRECTION, stated before the code: these are ADDITIVE name sets. Too NARROW and a connecting
+ * global stays pure — the cardinal direction; too WIDE and an inert construction over-charges `Net`,
+ * which is visible and complainable. The sets are deliberately the names lib.dom and `undici-types` BOTH
+ * declare, so the two arms converge rather than one arm being copied. `close` is in the wire set because
+ * it writes a close frame to the peer and because the node:net rule already charges `socket.end()` for
+ * the same teardown; `addEventListener`/`onmessage` are NOT — they register a local handler.
+ * `WebSocketStream`/`WebSocketError` exist in `undici-types` but are NOT re-exported as globals by
+ * `web-globals/fetch.d.ts` (checked, not assumed), so they are reachable only by importing `undici-types`
+ * directly, which no runtime package does.
+ */
+export const CONNECTING_WEB_CTORS = /^(WebSocket|EventSource)$/;
+export const WEB_WIRE_MEMBERS = /^(send|close)$/;
+
 // ---- κ — the curated classifier (CLASSIFIER §2: the dispatch/execution boundary, not builders) ----
 // Node builtins + a curated npm tier (the same under-report-and-say-so posture as the crate table:
 // an unlisted package contributes nothing — never a guess).
-// One rules TABLE, two readers: kappa() classifies a call; kappaKnows() answers "is this package
-// curated at all?" for the coverage ledger (a κ-known package whose given call is pure — a TypeORM
-// builder — is covered, not a blind spot). A single source so the two can never drift.
+// One rules TABLE, two readers, and ⟨R137⟩ they now ask it the SAME question: kappa() classifies a
+// call; kappaKnows() answers "did a rule COVER this call" for the coverage ledger — same module, same
+// member, same regexes. It used to answer the weaker "is this package named anywhere in the table",
+// and that reading disagreed with κ in the silent direction (see kappaKnows below).
 // [module-name regex, member regex (null = any member), effect]
 // The member token a rule matches against is the resolved declaration's name, EXCEPT a constructor
 // call (`new X()`), whose synthesized token is "new" (its decl `name` is empty — see CLASSIFY). This
@@ -112,6 +293,20 @@ export const KAPPA_RULES = [
   // claim an effect this engine cannot defend against the other three.
   [/^(node:)?process$/, /^(loadEnvFile|writeReport)$/, "Fs"],
   [/^(node:)?process$/, /^(getuid|geteuid|getgid|getegid|getgroups)$/, "Env"],
+  // R114 — the monotonic clocks that the floor below reviewed pure BY NAME. `uptime` and `hrtime`/
+  // `bigint` are REMOVED from that floor's member list in the same change, rather than left in a list
+  // titled "reviewed effect-free" while κ contradicts it one screen up. Set + ground truth at
+  // CLOCK_READING_PROCESS_MEMBERS; `scan.mjs`'s global-`process` arm reads the SAME object.
+  [/^(node:)?process$/, CLOCK_READING_PROCESS_MEMBERS, "Clock"],
+  // R114 — `console.time`/`timeLog`/`timeEnd` take and read a monotonic timestamp (EXECUTED: two timers
+  // started 80 ms apart report 119.891ms and 40.088ms). SPEC §1 exempts console WRITES from `Log`/`Fs`;
+  // it does not make the clock read behind them invisible. The es-lib arm in scan.mjs reads this same
+  // object for the lib.dom `Console` interface.
+  [/^(node:)?console$/, CLOCK_READING_CONSOLE_MEMBERS, "Clock"],
+  // R114 — `os.uptime()` is seconds since boot: monotonic, and it advanced 2 s over a 1.2 s wait when
+  // executed. Its own member rule rather than a shared set, because `os` shares no member NAME with
+  // `process` here and pretending otherwise would be the name collision the constants' comment warns of.
+  [/^(node:)?os$/, /^uptime$/, "Clock"],
   // node:module — the compile cache is a real on-disk cache directory.
   [/^(node:)?module$/, /^(enableCompileCache|flushCompileCache|getCompileCacheDir)$/, "Fs"],
   // node:util — `debuglog(section)`/`debug(section)` READ $NODE_DEBUG to decide whether the returned
@@ -119,7 +314,83 @@ export const KAPPA_RULES = [
   [/^(node:)?util$/, /^(debuglog|debug)$/, "Env"],
   // The Web Crypto RNG reached through @types/node's own global typings rather than through lib.dom
   // (the es-lib arm at the classify site covers the `Crypto` interface; this covers the node spelling).
+  //
+  // ON @types/node 25.9.2 THIS RULE DOES NOT FIRE FOR THE MEMBERS IT NAMES, and that is measured, not
+  // suspected: `web-globals/crypto.d.ts` declares only `var crypto` and the `Crypto`/`CryptoKey`/
+  // `SubtleCrypto` type aliases — every callable member is declared in `crypto.d.ts` (the `webcrypto`
+  // namespace), so `declModule` on the resolved `getRandomValues`/`randomUUID` declaration returns
+  // `crypto`, and the `(node:)?crypto` → Rand rule below is what actually charges them. Verified by
+  // printing the resolved declaration file under `lib: ["ES2022"], types: ["node"]`: both land in
+  // `@types/node/crypto.d.ts`. The rule is KEPT — a member DefinitelyTyped moves back into the
+  // web-globals file must not become silently pure on the day it moves — but its comment used to claim
+  // it "covers the node spelling", which is a guarantee, and a guarantee is what stops a property being
+  // measured (attack K). It is a belt over braces, not the load-bearing rule; the `crypto` rule below is.
   [/^web-globals\/crypto$/, /^(getRandomValues|randomUUID|generateKey)/, "Rand"],
+  // R110 — `performance.now()` is a monotonic CLOCK READ, and it was silent under `@types/node`.
+  // R111 — and so are `mark()`, `measure()` and `eventLoopUtilization()`, silently pure in BOTH arms.
+  //
+  // THE MIRROR OF R109, POINTING THE OTHER WAY. Resolved through lib.dom, `performance.now()` charges
+  // `Clock` at the es-lib arm in scan.mjs (`parent === "Performance" && name === "now"`). Resolved
+  // through `@types/node` it charged NOTHING: the declaration lands in `perf_hooks.d.ts`, whose
+  // NODE_CORE_REVIEWED entry marks the module reviewed-pure with the justification "(in-process
+  // timing)" — which conflates "does not leave the process" with "reads no clock". SPEC §1 defines
+  // `Clock` as *reading wall-clock or monotonic time*; staying in-process is not the question.
+  //
+  // Together with R109 the pair establishes that the two resolution paths disagree in BOTH directions,
+  // so neither is the trusted one. The direction chosen here is not "copy lib.dom": `now()` was
+  // ground-truthed by EXECUTION under node 22.12.0 — two calls in one process return different values,
+  // and `timeOrigin + now()` tracks `Date.now()` to within a few ms.
+  //
+  // THE MODULE KEY IS `perf_hooks`, NOT `web-globals/performance`, and that distinction is the whole
+  // reason this needed measuring rather than mirroring the crypto line above. `web-globals/
+  // performance.d.ts` declares `var performance` and nothing callable — its type is
+  // `perf_hooks.Performance`, so `declModule` on the resolved `now` declaration returns `perf_hooks`.
+  // A rule keyed on `web-globals/performance` would never fire. Printed the resolved declaration file
+  // for both arms before writing this: lib.dom → `typescript/lib/lib.dom.d.ts`, @types/node →
+  // `@types/node/perf_hooks.d.ts`.
+  //
+  // AND THE lib.dom ARM DOES MOVE, ON ONE SPELLING — said here rather than claimed untouched.
+  // `import { performance } from "node:perf_hooks"` (and the bare `"perf_hooks"` specifier) resolves
+  // its `now` into `perf_hooks.d.ts` NO MATTER WHICH `lib` is configured, so that spelling was silently
+  // pure under BOTH configs before this rule and is charged under both after it. That is a THIRD
+  // under-report, not part of the divergence — the two arms AGREED on it, and agreed wrongly, which is
+  // why engine agreement is the weakest signal this project has. Measured across nine spellings, both
+  // arms, pre and post: the GLOBAL `performance.now()` spelling under lib.dom is byte-identical before
+  // and after, so the convergence control holds in the direction it exists for — lib.dom loses nothing,
+  // it only gains where it was wrong too. `worker_threads.performance` is NOT a spelling: @types/node
+  // 25.9.2 exports no `performance` from that module and the fixture does not compile (§E3 applied
+  // before the claim was written, not after — it was in an earlier draft of this comment).
+  //
+  // A VERB LIST, NOT AN INTERFACE KEY, and this is the opposite call from R109's whole-`Storage`
+  // predicate. Every member of `Storage` touches the persistent store, so a verb list there could only
+  // under-report. `Performance` is genuinely MIXED: ten of its members — `clearMarks`, `clearMeasures`,
+  // `clearResourceTimings`, `getEntries`, `getEntriesByName`, `getEntriesByType`, `markResourceTiming`,
+  // `setResourceTimingBufferSize`, `addEventListener`, `removeEventListener` — read no clock at all,
+  // and charging them `Clock` would fabricate.
+  //
+  // R111 WIDENED THIS FROM A LIST OF ONE TO A LIST OF FOUR, and the member set now lives in
+  // `CLOCK_READING_PERFORMANCE_MEMBERS` at the top of this file, which the lib.dom arm in scan.mjs reads
+  // TOO. R110's original text said widening "would re-open the divergence in the opposite direction,
+  // because the lib.dom arm charges `now` and nothing else" — that was true of a widening applied to one
+  // table, and it is exactly why this widening was applied to the shared constant instead. The two arms
+  // are measured to agree on all four members, both directions, in this commit's own controls.
+  //
+  // `now` is declared exactly ONCE in all of @types/node (`perf_hooks.d.ts:83`, on `interface
+  // Performance`), and the module key is `perf_hooks` rather than a name, so this member regex cannot
+  // land on an unrelated `now`/`mark`/`measure` in some other module — the κ table asks the MODULE first.
+  [/^(node:)?perf_hooks$/, CLOCK_READING_PERFORMANCE_MEMBERS, "Clock"],
+  // R130 — `undici-types`, the package `@types/node` re-exports the web network globals FROM. Not
+  // `@types/undici` and not `undici`, so neither `declModule`'s `@types/X -> X` remap nor the `undici`
+  // rule below reaches it, and the ⟨0.32⟩ node-core floor does not either (its predicate is the FILE,
+  // and this file is not under `@types/node`). Two MEMBER-precise rules rather than a whole-module one:
+  // `undici-types` also declares `Headers`, `FormData`, `Request` and `Response`, whose construction and
+  // accessors are inert, and whose call sites are ordinary furniture in any project using global `fetch`
+  // — a whole-module Net here would fabricate on `new Headers()` and `res.json()`. Measured which
+  // declarations those spellings resolve to before choosing (all of them land in `undici-types/fetch.d.ts`).
+  // The CTOR rule matches because scan.mjs synthesizes the CLASS NAME as κ's member token for a
+  // connecting constructor — the `CONNECTING_CTORS` mechanism `new http.ClientRequest()` already uses.
+  [/^undici-types$/, CONNECTING_WEB_CTORS, "Net"],
+  [/^undici-types$/, WEB_WIRE_MEMBERS, "Net"],
   // the curated npm tier
   [/^(axios|got|node-fetch|undici|ws|socket\.io(-client)?|nodemailer)$/, null, "Net"],
   // gaxios is the axios-like HTTP client under googleapis (request/get/post/put/patch/delete/head do
@@ -238,16 +509,32 @@ export const KAPPA_RULES = [
   [/^(typeorm|@nestjs\/typeorm)$/,
    /^(find|save|remove|softRemove|recover|insert|update|upsert|delete|restore|count|exist|sum|average|minimum|maximum|query|clear|increment|decrement|getMany|getOne|getOneOrFail|getRawMany|getRawOne|getCount|getExists|execute|stream|transaction|initialize|connect|synchronize|runMigrations|undoLastMigration|dropDatabase)/,
    "Db"],
+  // ⟨R137, the CLASSIFIER half⟩ THE THREE ORMS BESIDE typeorm WERE MISSING ITS LIFECYCLE VERBS — §F1.3,
+  // separate implementations of one question that drifted. The typeorm rule above deliberately carries
+  // `initialize|connect|synchronize|runMigrations|undoLastMigration|dropDatabase|clear|stream` "the
+  // DataSource lifecycle that performs connection/DDL I/O", after `buildPostgresDataSource` read PURE on
+  // a real app. Its three siblings list only the QUERY surface, so the equivalent calls resolved to
+  // nothing — and because `kappaKnows` was package-granular they were not even ledgered (that is the
+  // other half of R137). Every verb added below is the named analogue of one typeorm already has:
+  //   connect/authenticate <- connect · disconnect/close <- (the pairing verb) · sync* <- synchronize
+  //   drop* <- dropDatabase · truncate <- clear · watch <- stream
+  // GROUND TRUTH IS EXECUTED for the one this was found on, node 22.12.0, real `mongoose@8` from npm
+  // against a `net.createServer` on 127.0.0.1 counting arrivals:
+  //     await mongoose.connect("mongodb://127.0.0.1:<port>/gt")  ->  1 TCP connection, 299 bytes sent
+  // The other five are ANALOGY to typeorm's own list, not execution, and are labelled as such rather
+  // than shared a sentence with the measured one. ADDITIVE and module-gated, so the direction this
+  // fails in is over-charge on a same-named member of one of these four ORMs; forgetting a verb
+  // under-fixes and cannot under-report.
   [/^(@prisma\/client|\.prisma|\.prisma\/client)$/,
-   /^(\$?(queryRaw|executeRaw|transaction)|find(Many|Unique|First)|create|createMany|update|updateMany|upsert|delete|deleteMany|aggregate|count|groupBy)/,
+   /^(\$?(queryRaw|executeRaw|transaction|connect|disconnect)|find(Many|Unique|First)|create|createMany|update|updateMany|upsert|delete|deleteMany|aggregate|count|groupBy)/,
    "Db"],
   [/^mongoose$/,
-   /^(find|save|create|insertMany|updateOne|updateMany|replaceOne|deleteOne|deleteMany|aggregate|countDocuments|estimatedDocumentCount|distinct|exec|bulkWrite)/,
+   /^(find|save|create|insertMany|updateOne|updateMany|replaceOne|deleteOne|deleteMany|aggregate|countDocuments|estimatedDocumentCount|distinct|exec|bulkWrite|connect|disconnect|close|drop|sync|watch)/,
    "Db"],
   // Sequelize is EXECUTE-ON-CALL: `Model.findAll()/create()/update()/destroy()` issue the query and
   // return a promise — so its verbs are the I/O boundary.
   [/^sequelize$/,
-   /^(find|create|update|destroy|upsert|count|max|min|sum|increment|decrement|reload|save|query|transaction)/,
+   /^(find|create|update|destroy|upsert|count|max|min|sum|increment|decrement|reload|save|query|transaction|authenticate|sync|close|drop|truncate)/,
    "Db"],
   // Drizzle is a BUILDER: `db.select().from().where()` / `db.insert().values()` / `db.update().set()` /
   // `db.delete().where()` issue NOTHING until a terminal `.execute()`/await/`.all()`/`.get()`/`.run()` (or
@@ -353,10 +640,23 @@ export const NODE_CORE_REVIEWED = [
   // ── wholly reviewed, effect-free at the call boundary ──
   // Deterministic in-process computation and string manipulation: assert (throws), async_hooks (in-process
   // hook registration), buffer, constants, diagnostics_channel (in-process pub/sub), domain, events, path,
-  // perf_hooks (in-process timing), punycode, querystring, string_decoder, url, util/types, zlib.
+  // perf_hooks, punycode, querystring, string_decoder, url, util/types, zlib.
+  // `perf_hooks` USED TO SAY "(in-process timing)" HERE, and that justification was wrong on its own
+  // terms (R110): SPEC §1's `Clock` is *reading wall-clock or monotonic time*, and whether the read
+  // leaves the process is not the question — the `timers` note three lines down gets this exactly right
+  // for the neighbouring module and this one did not. `performance.now()` resolves its declaration into
+  // this file, so the module-wide entry made it silently pure under any tsconfig naming `lib` without
+  // `DOM`, while the SAME line resolved through lib.dom charged `Clock`. κ now takes `now` above, before
+  // this floor is consulted; the REST of perf_hooks (the observer/histogram/entry-list surface) stays
+  // reviewed-pure here, which is the precision half of that fix and is pinned by its own controls.
   // Console/TTY I/O — `console`, `readline`, `tty`: §1 has no Console effect and this engine already
   // suppresses the fabricated `Net` on `process.stdout.write` for the same reason; classifying them here
   // would contradict that decision one door along.
+  // …AND THAT ARGUMENT IS ABOUT THE WRITE, WHICH IS NOT ALL `console` DOES (R114). `console.time`,
+  // `timeLog` and `timeEnd` take and read a monotonic timestamp to compute the duration they print —
+  // EXECUTED, two timers started 80 ms apart end 80 ms apart — so κ takes those three above, before this
+  // floor is consulted, and the REST of `console` stays reviewed-pure here. Same shape as `perf_hooks`
+  // one line up: a module whose justification was true of the surface its author had in mind.
   // `stream` and its submodules: transport plumbing. A stream's effect belongs to the concrete source or
   // sink, and is charged where THAT was constructed (`fs.createReadStream` → Fs) — charging `.pipe()` too
   // would double-count the same open.
@@ -374,15 +674,34 @@ export const NODE_CORE_REVIEWED = [
   // (Request/Response/Headers/FormData) is inert construction. It is listed here so the floor does not
   // stack a second, reasonless `Unknown` on top of a call this engine already answers precisely.
   // `web-globals/storage` is DELIBERATELY ABSENT: Node's `localStorage`/`sessionStorage` persist to a
-  // file, so it is not inert and has not been modelled — it fails closed.
+  // file, so it is not inert and has not been modelled — it fails closed HERE.
+  //
+  // AND "IT FAILS CLOSED" WAS A FALSE GUARANTEE FOR AS LONG AS IT STOOD (R109). This table is consulted
+  // only when the declaration came from `@types/node`. The SAME source line resolved through lib.dom —
+  // which is `lib: [...,"DOM"]` and also the DEFAULT `lib` for any ES target, i.e. the common case —
+  // never reached this floor at all: it landed on scan.mjs's conventionally-pure `<es-lib>` arm and read
+  // SILENT-PURE, so `deny Unknown` exited 0 over `localStorage.setItem("token", secret)`. One line, two
+  // answers, selected by tsconfig. The lib.dom half now has its own `parent === "Storage"` branch at the
+  // es-lib arm and converges on this answer; the guarantee has TWO halves and only one of them lives in
+  // this file. Same split as the `crypto` note below, which is where the fix shape came from.
+  //
+  // A FULL SWEEP of the twin set, because an audit scoped to its own trigger misses the next instance:
+  // asking `nodeCoreUnreviewed(m, <unenumerated member>)` for every file in `@types/node/web-globals`
+  // returns FAILS-CLOSED for `storage` and reviewed-pure for the other fifteen. `storage` was the only
+  // member of this class, and it is closed.
   [/^web-globals\/(abortcontroller|blob|console|crypto|domexception|encoding|events|fetch|importmeta|messaging|navigator|performance|streams|timers|url)$/, null],
   // ── mixed modules: the reviewed-pure half, member by member ──
   // node:crypto is deterministic computation plus entropy; κ above takes the entropy (`random*`,
   // `generateKey*`, `generatePrime*`). Written as a denylist of ONE: `setEngine` loads a shared OpenSSL
   // engine library into the process, which is a native-code load, not a hash.
   [/^(node:)?crypto$/, /^(?!setEngine$)/],
-  // node:os — the host-identity reads are Env above; the rest is inert introspection
-  // (platform/arch/cpus/freemem/uptime/EOL/…).
+  // node:os — the host-identity reads are Env above, `uptime` is Clock above (R114), and the rest is
+  // inert introspection (platform/arch/cpus/freemem/totalmem/loadavg/EOL/…). This line USED TO NAME
+  // `uptime` in that list, which is how a monotonic clock stayed pure: a module-wide `null` entry is a
+  // positive purity claim over every member κ does not take, and its prose is the only place the claim
+  // is legible. `freemem`/`loadavg`/`cpus().times` all MOVE between calls and are still left here on
+  // purpose — moving is not the criterion, reading a wall-clock or monotonic TIME is (SPEC §1). Each was
+  // executed; the measurements are at CLOCK_READING_PROCESS_MEMBERS.
   [/^(node:)?os$/, null],
   // node:util — everything but `debuglog`/`debug`, which κ takes as Env above.
   [/^(node:)?util$/, null],
@@ -444,11 +763,18 @@ export const NODE_CORE_REVIEWED = [
   // rather than left to fail closed, because the alternative is an `Unknown` on a call that returns a
   // number.
   [/^(node:)?process$/,
-  // `bigint` is `process.hrtime.bigint()` — a monotonic clock READ, declared on the `HRTime` interface
-  // in the same file, so it arrives here under its own bare name. Pure for the reason `Date.now()` is
-  // pure in this engine: nothing charges `Clock` for reading a timer, and charging one spelling of it
-  // and not the other is the inconsistency the `os.homedir`/`os.hostname` fix was about.
-   /^(|new|version|versions|arch|platform|release|config|features|moduleLoadList|uptime|getActiveResourcesInfo|cpuUsage|resourceUsage|memoryUsage|constrainedMemory|availableMemory|exit|exitCode|abort|finalization|hrtime|bigint|allowedNodeEnvironmentFlags|assert|emitWarning|nextTick|sourceMapsEnabled|setSourceMapsEnabled|getBuiltinModule|hasUncaughtExceptionCaptureCallback|setUncaughtExceptionCaptureCallback|cwd|env|argv|argv0|execArgv|execPath|pid|ppid|title|debugPort|stdout|stdin|stderr|openStdin|ref|unref|getReport|report|throwDeprecation|traceDeprecation|noDeprecation)$/],
+  // R114 REMOVED `uptime`, `hrtime` and `bigint` FROM THIS LINE. They were here under a comment claiming
+  // `bigint` was "pure for the reason `Date.now()` is pure in this engine: nothing charges `Clock` for
+  // reading a timer" — an assertion that was false in both halves. `Date.now()` charges Clock (measured),
+  // and `scan.mjs`'s global-`process` arm was ALREADY charging `hrtime` Clock, so this list was the
+  // dissenting half of a two-answer disagreement rather than a review. They are κ's now
+  // (CLOCK_READING_PROCESS_MEMBERS), which is consulted BEFORE this floor — so leaving them here would
+  // have been inert, and that is exactly why they had to go: an inert name in a list titled "reviewed
+  // effect-free" is how the next reader learns the wrong fact.
+  // `cpuUsage`, `resourceUsage`, `memoryUsage`, `constrainedMemory` and `availableMemory` STAY, measured
+  // and deliberately: they advance between calls, and advancing is not the criterion — §1's `Clock` is a
+  // wall-clock or monotonic TIME read, and consumed-CPU and heap bytes are resource accounting.
+   /^(|new|version|versions|arch|platform|release|config|features|moduleLoadList|getActiveResourcesInfo|cpuUsage|resourceUsage|memoryUsage|constrainedMemory|availableMemory|exit|exitCode|abort|finalization|allowedNodeEnvironmentFlags|assert|emitWarning|nextTick|sourceMapsEnabled|setSourceMapsEnabled|getBuiltinModule|hasUncaughtExceptionCaptureCallback|setUncaughtExceptionCaptureCallback|cwd|env|argv|argv0|execArgv|execPath|pid|ppid|title|debugPort|stdout|stdin|stderr|openStdin|ref|unref|getReport|report|throwDeprecation|traceDeprecation|noDeprecation)$/],
   // The EventEmitter surface, wherever a core module RE-DECLARES it for typed events instead of
   // inheriting it. `process.on("exit", …)` resolves to an overload declared in `process.d.ts`, not to
   // `events.d.ts`, so the module-wide `events` entry above never saw it and an inert listener
@@ -489,8 +815,39 @@ export const KAPPA_PURE = new Set([
   "class-validator", "class-transformer", "reflect-metadata",
   "rxjs", "zod", "lodash", "ramda", "date-fns",
 ]);
-export function kappaKnows(moduleName) {
-  return KAPPA_PURE.has(moduleName) || KAPPA_RULES.some(([mre]) => mre.test(moduleName));
+/**
+ * ⟨R137⟩ Did κ COVER THIS CALL? — the κ-coverage ledger's gate, asked of the same (module, member)
+ * pair `kappa()` itself was asked, against the same table and the same regexes.
+ *
+ * IT USED TO ASK A PACKAGE-GRANULAR QUESTION — `KAPPA_RULES.some(([mre]) => mre.test(moduleName))`,
+ * the member regex never consulted — which is a SECOND, weaker reading of the one table, and it
+ * disagreed with κ in the silent direction: the moment any rule named a package, every OTHER member
+ * of that package stopped being disclosed. R130 added two MEMBER-PRECISE `undici-types` rules and
+ * that flipped `undici-types` from uncovered to covered wholesale — 5 rows moved from
+ * `invisible:["undici-types"]` to entirely absent (a positive purity claim, SPEC §2 rule 3), 11 lost
+ * their `invisible`, and the report's whole `coverage:{uncovered:[…]}` block disappeared with its
+ * stderr advisory.
+ *
+ * AND THE CLASS IS NOT `undici-types`. Every member-precise npm rule has the same shape, and the
+ * trigger was the mildest instance of it. `mongoose`'s rule lists the QUERY verbs and not `connect`,
+ * so `mongoose.connect(uri)` — EXECUTED against a 127.0.0.1 listener: 1 TCP connection, 299 bytes on
+ * the wire — left the report with no Db, no Unknown, no `invisible` and no coverage entry, under a
+ * stderr line reading "nothing hidden — every effect sits where its name says it should".
+ *
+ * FAILURE DIRECTION: too WIDE ⇒ over-disclosure. A partly-classified package now contributes
+ * `invisible:[pkg]` and a `coverage.uncovered` entry for the calls κ did not answer. `invisible`
+ * carries no effect and no `Unknown`, so it cannot flip a `deny <Effect>` gate and cannot silence
+ * anything — the direction this cannot fail in is silence, which is the side to be wrong on.
+ *
+ * `KAPPA_PURE` is unchanged and is still the whole-package ratification outlet: a package whose
+ * REMAINING surface has been reviewed effect-free belongs there, so this needed no second table. A
+ * WHOLE-MODULE rule (`null` member regex) still covers every member, because its author classified
+ * the module's whole call surface — that is what the null means.
+ */
+export function kappaKnows(moduleName, member) {
+  if (KAPPA_PURE.has(moduleName)) return true;
+  const m = member ?? "";
+  return KAPPA_RULES.some(([mre, vre]) => mre.test(moduleName) && (!vre || vre.test(m)));
 }
 
 // Refine the Exec cliff (spec §4 ⟨0.5⟩): the effects a literal, statically-known subprocess head